Network Traffic Process Attribution via Kernel Packet Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods cannot attribute Domain Name System (DNS) requests to their origin processes, which is crucial for cyber security investigations, as this information is not directly available in packet data.
Innovation Solution
The method correlates packets received from a packet capture library with a kernel monitoring mechanism to identify the process ID associated with DNS communications using the 4-tuple (source address, source port, destination address, destination port) without requiring proprietary drivers, utilizing OS-supplied infrastructure like libpcap for Linux and Winpcap/NDISCapture for Windows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If packet capture libraries are used to monitor network traffic, then packet data can be captured and analyzed, but the origin process information is not available in the packet data itself
Solution Approach 1:
The patent combines packet capture data from libraries like libpcap with kernel event data from mechanisms like Ftrace/Kprobes. By merging these two data sources and correlating them through the 4-tuple (source address, source port, destination address, destination port), the system recovers origin process information that would be lost if only packet capture were used.
Solution Approach 2:
The patent introduces an intermediary correlation mechanism that uses the 4-tuple as a key to match packets with their corresponding kernel events. This intermediary layer bridges the gap between packet capture data and process information, enabling attribution without requiring direct modification of packet protocols or installation of proprietary drivers.
2Loss of information
If proprietary drivers are installed to capture process information, then origin attribution can be achieved, but system compatibility and ease of deployment are reduced
Solution Approach 1:
The patent leverages universally available OS infrastructure components that exist across different operating systems without requiring proprietary drivers. By using standard packet capture libraries (libpcap, Winpcap, NDISCapture) and kernel monitoring mechanisms (Ftrace, Kprobes, ETW, Event Viewer) that are part of the OS itself, the solution achieves broad compatibility and ease of deployment while still capturing process attribution data.
Solution Approach 2:
The patent enables the operating system to serve itself by utilizing its own built-in infrastructure for packet capture and event monitoring. The OS's existing packet capture libraries and kernel mechanisms are repurposed to provide process attribution information, eliminating the need for external proprietary drivers and simplifying deployment.
3Loss of information
If kernel monitoring mechanisms are used to obtain process information, then process ID can be captured, but real-time correlation with packets requires precise timing synchronization
Solution Approach 1:
The patent performs preliminary capture and buffering of both packet data and kernel event data with their associated timestamps. By pre-capturing this information and maintaining it in buffers until correlation is needed, the system avoids time-critical processing during actual correlation, reducing timing precision requirements and enabling real-time operation.
Solution Approach 2:
The patent implements a feedback mechanism where captured packets and kernel events are continuously correlated using the 4-tuple matching. The correlation process provides feedback on successful matches, allowing the system to adjust timing windows and correlation parameters dynamically to maintain accuracy while operating in real-time.
Data Source
AI summary
A method of monitoring and reporting of packets including their attribution to their origin processes from a user space application without installing proprietary drivers, rather using only infrastructures and capabilities supplied by the operating system (OS). The method relies on correlation between packets received from a packet capture library and a kernel monitoring mechanism that supplies an event with the process ID which is executed on the same time frame for transmitting or receiving of that traffic. The attribution between the event and the packet is based on the 4-tuple (or other exemplar) that exists on both the event and the packet where the “4-tuple” is a set of: source address, source port, destination address, destination port.