HTTPS Traffic Baseline Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection and mitigation techniques are inadequate for identifying and addressing HTTPS flood attacks, as they cannot differentiate between legitimate and malicious encrypted traffic, leading to increased computational resources being exploited and server unresponsiveness.
Innovation Solution
A method and system that compute short-term and long-term baselines for HTTPS traffic behavior, using rate-based and rate-invariant features to detect anomalies without decrypting traffic, allowing for early detection and mitigation of HTTPS flood attacks by generating alarms and implementing mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If decryption techniques are used to detect HTTPS traffic, then detection precision improves, but device complexity and computational resource requirements increase significantly
Solution Approach 1:
The patent extracts only the necessary metadata from HTTPS traffic (TLS handshake information, SNI fields, certificate details) without decrypting the actual encrypted payload. This selective extraction enables detection while avoiding the computational burden of full decryption, resolving the contradiction between detection precision and device complexity
Solution Approach 2:
The system performs preliminary analysis of TLS handshake metadata and certificate information before any potential decryption occurs. By establishing detection rules based on pre-handshake information (SNI, server indicators, certificate validation), the system achieves effective detection without requiring computationally expensive decryption operations
2Measurement precision
If decryption of high volumes of traffic is performed, then detection precision improves, but processing speed decreases due to computational overhead
Solution Approach 1:
The patent extracts only essential metadata (TLS version, cipher suite, SNI, certificate subject) from the traffic flow without decrypting the encrypted payload. This selective extraction reduces processing time dramatically while maintaining sufficient detection precision for identifying HTTPS flood attacks
Solution Approach 2:
The system performs partial decryption or analysis only when anomalies are detected in the metadata layer. For normal traffic, only lightweight metadata inspection is performed, while full decryption is reserved for suspicious packets requiring deeper analysis, thus balancing processing speed and detection precision
3Measurement precision
If private encryption keys are obtained for decryption, then detection precision improves, but security risks increase
Solution Approach 1:
The patent extracts detection-relevant information from public, non-encrypted portions of the TLS protocol (SNI fields, certificate subject names, server indicators) without requiring access to private encryption keys. This approach maintains detection precision for HTTPS flood attacks while eliminating the security risks associated with key management
Solution Approach 2:
The system uses TLS metadata and certificate information as an intermediary layer for detection. Instead of directly accessing encrypted content (which would require private keys), the system analyzes the public handshake metadata that contains sufficient information to identify attack patterns without compromising security
4Ease of operation
If conventional DoS mitigation techniques are applied to encrypted traffic, then ease of operation improves, but detection precision deteriorates
Solution Approach 1:
The patent changes the detection parameters from payload-based analysis (used in conventional techniques) to metadata-based analysis specific to encrypted traffic. By monitoring TLS handshake characteristics, SNI frequency, and certificate validation results, the system maintains ease of operation while achieving precision tailored to encrypted HTTPS flood attacks
Data Source
AI summary
A system and method for detecting anomalous hypertext transfer protocol secure (HTTPS) traffic are provided. The method includes receiving samples of at least rate-based features, wherein the rate-based features demonstrate a normal behavior of at least HTTPS traffic directed to a protected entity; computing a short-term baseline and a long-term baseline based on the received samples, wherein the short-term baseline is adapted to relatively rapid changes in the HTTPS traffic and the long-term baseline is adapted to relatively slow changes in the HTTPS traffic; computing at least one short-term threshold respective of the short-term baseline and at least one long-term threshold respective of the long-term baseline; evaluating each of the at least one threshold against real-time samples of HTTPS traffic to determine whether behavior of the HTTPS traffic is anomalous; and generating alarm when anomaly is detected.