Encrypted Traffic Classification via User-Action Log Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring user activities through encrypted communication over communication networks is challenging due to the encryption protocols used by applications like Gmail, Facebook, and Instagram, making it difficult for marketing personnel to provide tailored marketing materials based on user behavioral and demographic profiles.
Innovation Solution
A system that uses machine-learning techniques to classify encrypted network traffic by correlating user-action logs with network-traffic reports, identifying corresponding blocks of packets, and training classifiers to associate packet properties with user actions without decrypting the traffic or requiring manually labeled samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted protocols (SSL/TLS) are used for communication, then security and privacy are improved, but the ability to monitor and classify user activities is worsened
Solution Approach 1:
The patent introduces an intermediary classification system that operates on encrypted traffic metadata without requiring decryption. The system uses machine learning classifiers to analyze packet properties, timing patterns, and flow characteristics as intermediate representations, enabling activity monitoring while preserving encryption security.
Solution Approach 2:
The patent replaces traditional content-based inspection mechanisms with machine learning-based pattern recognition. Instead of examining encrypted payload content, the system substitutes analysis of statistical properties, timing patterns, and flow characteristics that can be observed without decryption, enabling classification while maintaining security.
2Measurement precision
If manual labeling of traffic samples is performed, then training data accuracy is improved, but time consumption and labor requirements are worsened
Solution Approach 1:
The patent implements self-service through automated label generation using user-action logs. The system automatically correlates encrypted traffic with corresponding user actions recorded in logs, generating training labels without human intervention. This eliminates manual labeling time while maintaining accuracy through direct observation of user behaviors.
Solution Approach 2:
The patent performs preliminary action by pre-recording user-action logs that document user behaviors, timestamps, and application states. These logs are prepared in advance and automatically correlated with traffic data during classifier training, eliminating the need for post-capture manual labeling and significantly reducing time consumption.
3Loss of information
If encrypted traffic analysis is performed without decryption, then privacy preservation is improved, but classification accuracy may be worsened
Solution Approach 1:
The patent transitions from analyzing encrypted payload content to analyzing multiple alternative dimensions including packet timing patterns, inter-arrival times, flow duration, packet size distributions, and protocol handshake characteristics. This dimensional shift enables accurate classification while preserving privacy by operating on metadata rather than content.
Solution Approach 2:
The patent changes the parameters being analyzed from encrypted content bytes to statistical properties and temporal patterns. By transforming the analysis from content-based to behavior-based parameters, the system achieves classification accuracy while maintaining encryption, as the behavioral patterns remain observable even when content is encrypted.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for the monitoring of encrypted communication over communication networks and the application of machine-learning techniques to facilitate such monitoring. The system comprises a communication interface and a processor which are configured to obtain a user-action log. The user-action log specifies a series of actions performed using an application and the respective times at which the actions were performed. The system uses the communication interface to obtain a network-traffic report that specifies properties of a plurality of packets that were exchanged between the application and a server for the application during performance of the actions. The properties including respective receipt times for the packets while the packets were en route between the application and the server. The system defines multiple non-overlapping blocks of consecutive ones of the packets based on the receipt times. It identifies a correspondence between the actions and respective corresponding ones of the blocks by correlating between the action times and the receipt times. The system uses the identified correspondence to train a classifier to associate other blocks of packets with respective ones of the action types based on the properties of the other blocks.