Encrypted Traffic Service Identification via Investigative Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Law enforcement agencies face challenges in identifying services used by users of interest when network traffic is encrypted, particularly if DNS queries are also encrypted, making it difficult to determine the services associated with communication endpoints.
Innovation Solution
A system that communicates investigative traffic over the network to ascertain services using communication endpoints by receiving DNS responses or certification error responses, and computes signature vectors to cluster endpoints based on statistical properties of packets, associating services with clusters and storing these associations in memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic is encrypted to protect privacy and security, then communication security is improved, but the ability to identify services exchanged over the network deteriorates
Solution Approach 1:
The system introduces an intermediary approach by using investigative traffic as a mediator between the monitoring system and encrypted services. The investigative traffic interacts with the encrypted communication endpoints and returns responses that reveal service identities without decrypting the actual communication content, thus maintaining security while enabling identification.
Solution Approach 2:
The patent replaces the traditional mechanical approach of decrypting traffic to identify services with a substitute method based on statistical analysis. By computing signature vectors from packet statistical properties (sizes, inter-packet times) and clustering endpoints based on these vectors, the system identifies services without mechanical decryption of encrypted content.
2Difficulty of detecting and measuring
If statistical analysis of packet properties is used to identify services, then service identification capability is improved, but the complexity of the monitoring system increases
Solution Approach 1:
The system segments the complex task of service identification into distinct modular components: packet statistical property extraction, signature vector computation, endpoint clustering, and service identification. Each component handles a specific aspect of the analysis, making the overall system more manageable and implementable despite the inherent complexity.
Solution Approach 2:
The patent transforms the identification problem by changing parameters from analyzing encrypted payload content to analyzing statistical properties of packets (sizes, inter-packet times, transmission patterns). This parameter transformation simplifies the analysis by working with observable metadata rather than requiring decryption of protected content.
3Measurement precision
If investigative traffic is communicated to ascertain services, then accurate service identification is improved, but network traffic volume and processing time increase
Solution Approach 1:
The system performs preliminary actions by pre-computing signature vectors from packet statistical properties and pre-clustering communication endpoints based on these vectors before actual service identification is needed. This preliminary processing creates a ready-to-use classification framework that speeds up subsequent service identification when investigative traffic is deployed.
Solution Approach 2:
The patent uses copying by creating signature vectors that represent the statistical characteristics of communication patterns. These signature vectors are copies or representations of the actual traffic patterns that can be analyzed and compared without requiring continuous real-time analysis of every packet, thus reducing processing time while maintaining identification accuracy.
Data Source
AI summary
System and method to receive respective copies of communication packets exchanged, over a network, with respective communication endpoints belonging to respective servers, the packets containing respective endpoint identifiers, each of which includes a respective Internet Protocol (IP) address and port number identifying the communication endpoint with which the packet containing the endpoint identifier was exchanged. The processor is further configured to ascertain respective services that use the communication endpoints, by communicating investigative traffic over the network. The processor is further configured to store an association between the communication endpoints and the services, respectively, in the memory, in response to ascertaining the services.