Encrypted Traffic Detection via ML Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in detecting targeted data exfiltration within encrypted network traffic, as they often require decryption or rely on instrumented clients and servers, which can be impractical due to legal and technical constraints.
Innovation Solution
A machine learning-based classifier is applied to traffic data to infer characteristics of encrypted content, allowing for the detection of sensitive files within encrypted traffic without decryption, by correlating file characteristic data with inferred content characteristics and enforcing network policies based on these detections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If decryption is used to detect data exfiltration, then detection accuracy is improved, but legal and technical constraints make it impractical
Solution Approach 1:
The patent introduces an intermediary approach by using traffic characterization techniques that analyze encrypted traffic patterns without requiring decryption. The system acts as a mediator between network monitoring and data exfiltration detection, using observable traffic characteristics (packet sizes, timing, protocols) to infer content characteristics and identify exfiltration attempts while maintaining legal and technical compliance.
Solution Approach 2:
The patent replaces the mechanical decryption process with a computational approach using machine learning classifiers and traffic characterization. Instead of physically decrypting traffic to inspect content, the system substitutes this with analyzing traffic patterns and characteristics to infer what is being transmitted, achieving detection without decryption.
2Reliability
If instrumented clients and servers are used for detection, then detection capability is improved, but deployment complexity increases
Solution Approach 1:
The patent applies universality by creating a detection system that can be deployed at network infrastructure points (routers, switches, firewalls) without requiring specialized instrumented clients or servers. The same traffic characterization and machine learning classification approach works across different network locations, making the system universally applicable and simplifying deployment compared to requiring specific instrumentation at multiple endpoints.
Solution Approach 2:
The system performs self-service detection by using the traffic data itself as the analysis target. Rather than requiring external instrumentation or additional agents on clients/servers, the network infrastructure devices analyze the traffic flows directly, using the traffic's own characteristics (packet sizes, timing patterns, protocol behavior) to detect exfiltration, eliminating the need for complex client/server instrumentation.
3Ease of operation
If encrypted traffic is analyzed without decryption, then legal and technical constraints are satisfied, but detection precision deteriorates
Solution Approach 1:
The patent applies parameter changes by transforming the analysis from content-based parameters (decrypted payload data) to traffic-based parameters (packet sizes, inter-arrival times, protocol states, flow patterns). The machine learning classifier is trained to recognize exfiltration patterns in these transformed traffic parameters, enabling precise detection without changing the encrypted nature of the traffic or requiring decryption.
Solution Approach 2:
The patent replaces the mechanical decryption process with a computational characterization approach. Instead of decrypting traffic to inspect content directly, the system substitutes this with extracting traffic characteristics and using machine learning to infer content properties from these characteristics, maintaining compliance while achieving detection precision through intelligent pattern recognition.
Data Source
AI summary
In one embodiment, a service that monitors a network obtains file characteristic data of a file stored on a first endpoint in the network. The service infers characteristics of encrypted content within encrypted traffic in the network between the first endpoint and a second endpoint, by applying a machine learning-based classifier to traffic data regarding the encrypted traffic session. The service compares the file characteristic data of the file to the inferred content characteristics of the encrypted content within the encrypted traffic, to detect the file within the encrypted traffic. The service enforces a network policy in the network, based on the detection of the file within the encrypted traffic.