File Movement Tracking Using Metadata in Encrypted Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to identify and prevent the transfer of sensitive files within encrypted network traffic without decrypting the data, especially in environments where TLS termination proxies are not feasible, and they fail to account for unmonitored endpoints.
Innovation Solution
A traffic analysis service uses machine learning-based classifiers to infer file sensitivity from metadata such as file size, name, path, and user information, correlating this data with encrypted traffic patterns to detect and mitigate policy violations without decrypting the content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TLS termination proxies are used to decrypt traffic for sensitive file detection, then detection accuracy improves, but system complexity and deployment feasibility worsen
Solution Approach 1:
The patent introduces a file movement tracking system that acts as an intermediary between endpoint devices and the network. This system collects file metadata locally at monitored endpoints, correlating it with network traffic data to identify sensitive file transfers without requiring TLS decryption. The intermediary approach maintains detection accuracy by using trusted local agents while avoiding the complexity of deploying TLS termination proxies throughout the network infrastructure.
2Reliability
If DLP agents are installed on every endpoint for file monitoring, then file detection capability improves, but ease of deployment and maintenance worsens
Solution Approach 1:
The patent implements a universal file movement tracking system that functions across multiple endpoints simultaneously through a centralized management approach. The system collects file metadata from various sources including endpoint devices, cloud storage services, and collaborative platforms through a single integrated platform. This multi-functional capability allows the system to monitor sensitive file movements across diverse environments without requiring separate deployment on every individual endpoint, thereby maintaining detection reliability while improving ease of deployment and maintenance.
3Reliability
If encrypted traffic is monitored without decryption, then privacy and security are preserved, but detection precision of sensitive files worsens
Solution Approach 1:
The patent extracts file metadata from encrypted network traffic without requiring decryption of the actual file contents. The system collects metadata such as file names, sizes, hashes, and contextual information from endpoint devices and correlates this extracted data with network traffic patterns. This extraction approach preserves the confidentiality of encrypted communications while maintaining sufficient detection precision by analyzing metadata characteristics that identify sensitive file types and transfer patterns without exposing the actual file contents.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
In embodiments, a traffic analysis service that monitors a network obtains file metadata regarding an electronic file. The traffic analysis service determines a sensitivity score for the electronic file based on the file metadata. The traffic analysis service detects the electronic file within traffic in the network. The traffic analysis service causes performance of a mitigation action regarding the detection of the electronic file within the traffic, based on the sensitivity score of the electronic file.