Encrypted Peer-to-Peer Detection via Traffic Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls are unable to effectively detect and block encrypted peer-to-peer traffic, leading to network performance issues and potential security risks, as they rely on signature and heuristic analysis that cannot access encrypted data, resulting in false positives and incomplete blocking of peer-to-peer applications.
Innovation Solution
Implementing a system that monitors network traffic to identify peer-to-peer applications, generates emulated peer-to-peer traffic to determine if a client is executing such applications, and classifies sessions using a 3-tuple of client identifier, protocol type, and port number, allowing for effective detection and blocking of encrypted peer-to-peer communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If firewalls use signature and heuristic analysis to detect peer-to-peer traffic, then detection capability is improved, but encrypted peer-to-peer traffic cannot be effectively detected resulting in false positives and incomplete blocking
Solution Approach 1:
The system performs preliminary detection of unencrypted peer-to-peer traffic patterns before the traffic is encrypted. By identifying P2P applications during their unencrypted phase and maintaining a mapping of these applications to their subsequent encrypted traffic flows, the firewall can proactively detect and block encrypted P2P traffic without relying solely on signature analysis, thereby resolving the contradiction between detection accuracy and blocking effectiveness
Solution Approach 2:
The patent introduces an intermediary mapping mechanism that connects unencrypted P2P traffic patterns to encrypted traffic flows. This mapping acts as a mediator that allows the firewall to recognize encrypted P2P traffic by its origin and destination relationships established during the unencrypted phase, enabling reliable blocking of encrypted traffic while maintaining detection accuracy
2Reliability
If firewalls block all suspected peer-to-peer traffic, then security is improved, but false positives increase causing legitimate traffic to be blocked
Solution Approach 1:
The system performs preliminary classification of traffic during the unencrypted phase before blocking decisions are made. By establishing a mapping between unencrypted P2P traffic and subsequent encrypted traffic flows, the firewall can precisely identify which encrypted traffic should be blocked, thereby reducing false positives while maintaining high security levels
Solution Approach 2:
The patent implements a feedback mechanism where the firewall monitors traffic patterns, identifies P2P applications, and uses this information to inform subsequent blocking decisions. The mapping created from unencrypted to encrypted traffic provides feedback that enables the system to distinguish between legitimate and malicious encrypted traffic, reducing false positives while maintaining security
3Measurement precision
If firewalls monitor network traffic to identify peer-to-peer applications, then detection capability is improved, but encrypted traffic cannot be accessed for analysis
Solution Approach 1:
The system performs traffic identification and classification during the unencrypted phase before encryption occurs. By capturing and analyzing traffic patterns, source and destination information during the unencrypted phase and storing this mapping, the firewall can identify encrypted P2P traffic without needing to decrypt it, thus maintaining identification accuracy while preserving encrypted data confidentiality
Solution Approach 2:
The patent creates a copy or mapping of the traffic flow information during the unencrypted phase. This mapping copy contains all necessary identification information (source, destination, traffic patterns) that allows the firewall to recognize and classify encrypted traffic without accessing the actual encrypted data content, thereby maintaining identification accuracy while respecting data encryption
Data Source
AI summary
Encrypted peer-to-peer detection is provided. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a first client to determine whether the first client is executing a peer-to-peer application; and generating network traffic that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting unknown network traffic sent from the first client to the second client. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a client to determine that the client is sending a request for information for a peer-to-peer application executing on the client; and generating a network traffic response to the client that emulates peer-to-peer network traffic.