Encrypted Network Traffic Service Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The widespread adoption of encrypted communications protocols, such as TLS/SSL and encrypted DNS queries, has rendered existing techniques obsolete for ISPs and network operators to identify network service usage, as they cannot inspect encrypted datagrams or DNS queries, making it difficult to classify network requests, especially with the rise of cloud and distributed computing where multiple services are hosted under a single IP address.
Innovation Solution
The described techniques involve extracting domain and host information from encrypted network requests during a TLS handshake, modeling network transactions to generate fingerprints, creating mappings between IP addresses and services, and using response sizes and times to classify network requests without decrypting the content, allowing for reliable identification of network services even when DNS is encrypted and TLS/SSL are in use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted communications protocols (TLS/SSL, encrypted DNS) are adopted to protect network privacy, then network security and user privacy are improved, but the ability to identify and classify network service usage deteriorates
Solution Approach 1:
The patent extracts unencrypted metadata from encrypted network traffic, such as domain names from TLS handshakes, IP addresses, packet sizes, and timing information. This extraction allows service identification without decrypting the actual communication content, thus maintaining security while recovering identification capability.
Solution Approach 2:
Instead of trying to decrypt encrypted traffic to identify services, the patent inverts the approach by analyzing the encrypted traffic's external characteristics (metadata, timing, size patterns) to infer service identity. This indirect method preserves encryption while enabling classification.
2Productivity
If cloud computing and distributed computing are adopted to consolidate services under single IP addresses, then resource efficiency and scalability are improved, but the precision of network service classification based on IP addresses deteriorates
Solution Approach 1:
The patent segments the identification process into multiple dimensions: IP address, port, packet size patterns, timing characteristics, and TLS handshake metadata. By analyzing multiple segments together rather than relying solely on IP addresses, the system achieves accurate service classification despite IP consolidation in cloud environments.
Solution Approach 2:
The patent transitions from single-dimension IP-based classification to multi-dimensional analysis including temporal patterns, packet size distributions, and protocol-specific metadata. This dimensional expansion enables precise service identification even when multiple services share the same IP address space.
3Reliability
If DNS queries are encrypted to protect user privacy, then network privacy is improved, but the ability to perform DNS-based service identification deteriorates
Solution Approach 1:
The patent performs identification actions before encryption fully obscures the data by capturing TLS handshake metadata and other pre-encryption characteristics. This preliminary capture of identification information occurs at points in the communication flow where data is still visible or inferable, before full encryption takes effect.
Data Source
AI summary
The disclosed embodiments are directed toward monitoring and classifying encrypted network traffic. In one embodiment, a method is disclosed comprising intercepting an encrypted network request, the network request transmitted by a client device to a network endpoint; identifying a network service associated with the network endpoint based on unencrypted properties of the encrypted network request; identifying, based on the encrypted network request and a series of subsequent network requests issued by the client device, an action taken by the client device, the action comprising an activity performed during a session established with the network service; and updating a catalog of network interactions using the network service and the action.