Encrypted Traffic Process Identification Using TLS Context Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately identify the process associated with encrypted traffic sessions, particularly in TLS, due to multiple processes sharing the same fingerprint, complicating security and networking diagnostics.
Innovation Solution
A device captures telemetry data from encrypted sessions, including TLS features and auxiliary information, and uses a probabilistic model to identify the most probable process by referencing a TLS fingerprint database augmented with contextual data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If TLS fingerprinting is used to identify processes from encrypted traffic, then process identification capability is improved, but identification accuracy deteriorates because multiple processes share the same fingerprint
Solution Approach 1:
The patent transitions from single-dimension TLS fingerprint matching to multi-dimensional identification by incorporating additional features: destination context (IP addresses, ports, server names), temporal patterns (session timing, duration, frequency), and behavioral characteristics. This dimensional expansion allows differentiation between processes that share identical TLS fingerprints.
Solution Approach 2:
The system changes the parameters used for identification from solely cryptographic TLS parameters to a broader set including network layer parameters (destination IP, port), application layer parameters (server names), and temporal parameters (session timing, duration). This parameter diversification enables more precise process identification.
2Measurement precision
If clear-text process description is sent with traffic (as in SSL/HTTP), then process identification accuracy is improved, but security deteriorates due to unencrypted information exposure
Solution Approach 1:
The patent extracts and utilizes metadata that is already present in encrypted TLS traffic without requiring decryption or addition of clear-text process identifiers. By leveraging existing TLS handshake parameters, destination information, and temporal patterns, the system achieves process identification while maintaining encryption integrity and security.
3Ease of manufacture
If automatic software updates are deployed across multiple versions, then system maintainability is improved, but process identification accuracy deteriorates as multiple versions share the same TLS fingerprint
Solution Approach 1:
The system performs preliminary classification by grouping processes into families based on shared TLS fingerprints, then applies secondary discrimination using contextual features (destination addresses, ports, temporal patterns) to distinguish between specific versions. This two-stage approach maintains the benefits of automated updates while enabling precise identification of vulnerable instances.
Data Source
AI summary
In one embodiment, a device obtains one or more packets of a traffic session in a network. The device determines, for a particular packet of the one or more packets that match a filter, a fingerprint for the particular packet. The device identifies a plurality of traffic sessions whose packets match the fingerprint, wherein each of the plurality of traffic sessions is associated with at least one process. The device updates a process with the traffic session by applying a classifier to the plurality of traffic sessions.