System and method for estimating an amount of acknowledged application data transmitted by encrypted transport

A system to process bidirectional network traffic having encrypted application data and using an encrypted transport protocol, the system comprising:

• a memory configured to store instructions;
• a processor disposed in communication with the memory, wherein the processor upon execution of the instructions is configured to:
• estimate a size of encrypted application data in respective packets of the bidirectional network traffic, wherein the packets of the bidirectional network traffic are transported in opposing directions;
• assign timing criteria to the respective application packets transported in the opposing directions that were determined to include a minimum amount of encrypted application data, the timing criteria being based on a time of observation at an observation point of the corresponding application packet;
• acknowledge, for the respective packets of the application packets, selected application packets that were selected based on the timing criteria assigned to the respective application packets;
• and
• estimate an amount of encrypted application data transported in at least one of the opposing directions, the estimation of the amount of encrypted application data being based on a sum of the estimated size of the encrypted application data in the respective acknowledged packets transported in the at least one of the opposing directions that were observed during a selected time interval.

A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• estimate a size of encrypted application data in respective packets of the bidirectional network traffic, wherein the packets of the bidirectional network traffic are transported in opposing directions;
• assign timing criteria to the respective application packets transported in the opposing directions that were determined to include a minimum amount of encrypted application data, the timing criteria being based on a time of observation at an observation point of the corresponding application packet;
• acknowledge, for the respective packets of the application packets, selected application packets that were selected based on the timing criteria assigned to the respective application packets;
• and
• estimate an amount of encrypted application data transported in at least one of the opposing directions, the estimation of the amount of encrypted application data being based on a sum of the estimated size of the encrypted application data in the respective acknowledged packets transported in the at least one of the opposing directions that were observed during a selected time interval.