Network Agent Tracks Socket Calls for Cotenant Process Visibility

The patent introduces an intermediary component (process identification module) that sits between the network traffic flow and the analysis system. This module intercepts socket connection calls at the operating system level and extracts process IDs before the traffic enters the network transport layer. By placing this intermediary at the socket level rather than performing deep packet inspection of encrypted or complex network protocols, the system achieves accurate process identification without the high complexity and cost associated with DPI techniques.

The system performs preliminary action by extracting process identification information at the socket connection establishment phase, before the actual network data transmission occurs. The process ID is captured when the socket call is made, and this identification is cached and associated with subsequent traffic flows. This preliminary extraction eliminates the need for time-consuming deep packet inspection during active data transmission, significantly reducing processing time while maintaining accurate process identification throughout the communication session.

The patent extracts the process identification information from the encrypted network traffic at the socket level, where it is still accessible as metadata associated with the connection. By taking out this identification data at the point of socket connection establishment—before the encrypted payload is transmitted—the system preserves network visibility for monitoring and troubleshooting purposes while maintaining the security benefits of encryption for the actual data content. The extracted process IDs enable attribution of encrypted traffic to specific processes without requiring decryption.