Network Traffic Information Leak Measurement System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data loss prevention systems are unable to detect obfuscated information leaks in network traffic, making it difficult to prevent hackers or malicious insiders from extracting sensitive information by hiding it within normal outbound traffic.
Innovation Solution
A method and system that measure and constrain the maximum information leak capacity in network traffic by creating a library of potential message field values and comparing actual network messages to identify and quantify information content, exploiting the fact that a large portion of legitimate network traffic is repeated or constrained by protocol or application specifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional compression algorithms are used to measure information content in network traffic, then the measurement process is simple, but the precision is insufficient and cannot detect obfuscated information leaks
Solution Approach 1:
The patent segments network messages into distinct fields (source IP, destination IP, source port, destination port, protocol type, etc.) and creates a library of potential values for each field. This segmentation allows precise measurement of information content by comparing actual field values against the library, enabling detection of obfuscated leaks while maintaining manageable system complexity through structured organization.
Solution Approach 2:
The patent performs preliminary action by pre-populating a library of potential message field values based on protocol specifications and observed traffic patterns before actual measurement occurs. This pre-computed library enables efficient comparison during runtime, achieving high measurement precision without requiring complex real-time analysis systems.
2Reliability
If manual inspection of network traffic is performed, then information leaks can be detected, but the process is unreasonably expensive and inefficient given the volume of traffic
Solution Approach 1:
The patent implements self-service by automatically measuring information content in network traffic through systematic comparison of message fields against the pre-populated library. The system autonomously processes traffic without manual inspection, achieving both high reliability through comprehensive field analysis and high productivity through automated, efficient comparison operations.
Solution Approach 2:
The patent changes parameters by measuring information content in terms of bits required to encode field values rather than analyzing raw traffic volume. This parameter transformation enables efficient automated processing while maintaining reliable detection, as the bit-based measurement approach is computationally lightweight compared to manual inspection methods.
3Measurement precision
If data loss prevention systems check outgoing traffic for known confidential information, then naive adversaries are stopped, but encrypted or obfuscated information leaks cannot be identified
Solution Approach 1:
The patent introduces an intermediary library of potential message field values that mediates between the raw network traffic and the detection analysis. This library serves as a reference framework that enables precise measurement of information content in obfuscated traffic without requiring complex decryption or analysis algorithms, achieving enhanced detection capability with controlled system complexity.
Solution Approach 2:
The patent replaces mechanical inspection methods (manual analysis, pattern matching for known confidential information) with an information-theoretic measurement system that calculates bits of information content. This substitution enables detection of obfuscated leaks by measuring information entropy rather than searching for specific patterns, achieving superior precision without proportionally increasing system complexity.
Data Source
AI summary
Method, system and computer program product for comparing or measuring information content in at least one data stream including one or more data segments is provided. In at least one embodiment of the invention, information leak capacity in network traffic is quantified. Instead of trying to detect the presence of sensitive data—an impossible task in the general case—one goal of the method, system and computer program product is to measure and constrain its maximum volume. Most network traffic is repeated or determined by external information, such as protocol specifications or messages sent by a server. By filtering this data, one can isolate and quantify true information flowing from a computer. Measurement algorithms for the Hypertext Transfer Protocol (HTTP), the main protocol for web browsing are provided. When applied to real web browsing traffic, the algorithms were able to discount 98.5% of measured bytes and effectively isolate information leaks.