TLS Fingerprinting Process Identification via Probabilistic Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in identifying the process associated with encrypted TLS traffic sessions is exacerbated by the fact that multiple executables or processes often share the same TLS fingerprint, making it difficult to detect vulnerable endpoints and prioritize traffic effectively in network security and diagnostics.
Innovation Solution
A device captures telemetry data from encrypted traffic sessions, including TLS features and auxiliary information, and uses a probabilistic model to assign probabilities to candidate processes from a TLS fingerprint database, allowing for the identification of the process that initiated the session based on contextual data such as destination addresses, ports, and server names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If TLS fingerprinting is used to identify processes from encrypted traffic, then process identification capability is improved, but identification accuracy deteriorates because multiple processes share the same TLS fingerprint
Solution Approach 1:
The patent segments the identification problem into two parts: first identifying the TLS fingerprint (coarse-grained identification), then using a probabilistic model with multiple candidate processes to refine the identification (fine-grained identification). This segmentation allows the system to handle the many-to-one mapping of TLS fingerprints to processes by breaking down the identification into hierarchical steps, thereby resolving the contradiction between detection capability and identification accuracy.
Solution Approach 2:
The patent changes the identification parameters from relying solely on TLS fingerprint characteristics to incorporating additional contextual parameters such as destination addresses, ports, and server names. By expanding the parameter set used for identification, the system can distinguish between multiple processes that share the same TLS fingerprint, thus improving accuracy while maintaining detection capability.
2Measurement precision
If clear-text process descriptions are transmitted with traffic, then process identification accuracy is improved, but network security deteriorates due to exposure of process information
Solution Approach 1:
The patent introduces a probabilistic model as an intermediary between the encrypted TLS traffic and the process identification system. This intermediary translates cryptographic parameters into probabilistic process identifications without requiring clear-text process descriptions, thereby maintaining both identification accuracy and network security by avoiding direct exposure of process information.
Solution Approach 2:
The patent replaces the mechanical approach of transmitting clear-text process descriptions with a statistical/probabilistic approach. Instead of directly sending process names or descriptions in clear text, the system uses probabilistic modeling based on cryptographic parameters to infer process identities, thus eliminating security risks while preserving identification accuracy.
3Ease of manufacture
If automatic software updates are deployed across multiple versions, then system maintainability is improved, but process identification accuracy deteriorates as different versions share the same TLS fingerprint
Solution Approach 1:
The patent adds another dimension to the identification process by incorporating contextual information (destination addresses, ports, server names) beyond just the TLS fingerprint. This dimensional expansion allows the system to distinguish between different software versions that share the same TLS fingerprint, maintaining both ease of deployment and identification accuracy.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
In embodiments, a device obtains telemetry data regarding an encrypted traffic session in a network. The telemetry data includes Transport Layer Security (TLS) features of the traffic session and auxiliary information indicative of a destination address of the traffic session, a destination port of the traffic session, or a server name associated with the traffic session. The device retrieves, using the obtained telemetry data, a plurality of candidate processes from a TLS fingerprint database that relates processes with telemetry data from encrypted traffic sessions initiated by those processes. The device uses a probabilistic model to assign probabilities to each of the plurality of candidate processes. The device identifies one of the plurality of candidate processes as having initiated the encrypted traffic session based on its assigned probability.