# US 10,454,961 B2 · Extracting encryption metadata and terminating malicious connections using machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,961 B2 - Document ID: US10454961B2 - Status: Granted - Kind: B2 - Application number: 15/798,893 - Filed: 2017-10-31 - Published: 2018-05-03 - Granted: 2019-10-22 - Earliest claimed: 2016-11-02 - Assignees: Cujo LLC - Applicants: Cujo LLC - Inventors: Yuri Frayman; Robert Beatty; Leonid Kuperman; Gabor Takacs - Web page: https://patentgrep.com/patent/US10454961B2 ## CPC - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06N 20/20: Ensemble learning - H04B 10/1149: {Arrangements for indoor wireless networking of information} - H04L 12/2825: {Reporting to a device located outside the home and the home network (access arrangements H04L12/2856; for remote control or remote monitoring of applications H04L67/025; telephonic communication systems adapted for combination with telemetering systems H04M11/002)} - H04L 12/2827: {Reporting to a device within the home network; wherein the reception of the information reported automatically triggers the execution of a home appliance functionality} - H04L 12/2834: {Switching of information between an external network and a home network (access arrangements H04L12/2856)} - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/082: using revocation of authorisation - H04W 12/088: using filters or firewalls - G06N 3/08: Learning methods - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04B: TRANSMISSION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network traffic hub extracts encryption metadata from messages establishing an encrypted connection between a smart appliance and a remote server and determines whether malicious behavior is present in the messages. For example, the network traffic hub can extract an encryption cipher suite, identified encryption algorithms, or a public certificate. The network traffic hub detects malicious behavior or security threats based on the encryption metadata. These security threats may include a man-in-the-middle attacker or a Padding Oracle On Downgraded Legacy Encryption attack. Upon detecting malicious behavior or security threats, the network traffic hub blocks the encrypted traffic or notifies a user. ## Claims ### Claim 1 A network traffic hub for detecting malicious behavior based on network communications establishing an encrypted connection between a smart appliance and a remote server, the network traffic hub comprising: a network interface communicatively coupled to a smart appliance via a first communication channel in a local network and communicatively coupled to a remote server via a second communication channel in a wide area network; a processor; and a memory storing program code, the program code when executed causes the processor to: intercept, via the first communication channel, a first network communication from the smart appliance for transmission, via the second communication channel, to the remote server, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server; extract the encryption suite from the first network communication; transmit, via the second communication channel, the first network communication to the remote server; intercept, via the second communication channel, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms; extract the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications; transmit, via the first communication channel, the one or more second network communications to the smart appliance; detect malicious behavior performed by the smart appliance or remote server, via the first and second communication channels, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms; and block network communications between the smart appliance and the remote server in response to detecting malicious behavior in the network communications between the smart appliance and the remote server. ### Claim 2 (depends on 1) The network traffic hub of claim 1, further comprising program code to allow, responsive to a lack of detection of malicious behavior in the network communications between the smart appliance and the remote server, continued network traffic communications between the smart appliance and the remote server. ### Claim 3 (depends on 1) The network traffic hub of claim 1, wherein the program code to detect malicious behavior in encrypted network communications further comprises program code to detect using a threat detection model. ### Claim 4 (depends on 3) The network traffic hub of claim 3, wherein the threat detection model is a decision tree. ### Claim 5 (depends on 3) The network traffic hub of claim 3, wherein the threat detection model is a machine-learned model. ### Claim 6 (depends on 5) The network traffic hub of claim 5, wherein the threat detection model is trained using known-malicious training data and known-benign training data, the known-malicious training data comprising examples where a secure connection between a smart appliance and a remote server is attacked while the secure connection was being established and the known-benign training data comprising examples where a secure connection between a smart appliance and a remote server is successful connected without being compromised. ### Claim 7 (depends on 1) The network traffic hub of claim 1, further comprising program code to receive a designation, from a behavior analysis engine, of whether malicious behavior is present in the first network communication or the one or more second network communications based on analysis from a threat detection model. ### Claim 8 A method for detecting malicious behavior based on network communications establishing an encrypted connection between a smart appliance and a remote server, comprising: intercepting, by a network traffic hub in a local network, a first network communication from a smart appliance in the local network, for transmission to a remote server in a wide area network, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server; extracting the encryption suite from the first network communication; transmitting, by the network traffic hub, the first network communication to the remote server; intercepting, by the network traffic hub, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms; extracting the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications; transmitting, by the network traffic hub, the one or more second network communications to the smart appliance; detecting malicious behavior performed by the smart appliance or remote server, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms; and blocking network communications between the smart appliance and the remote server, responsive to detecting malicious behavior in the network communications between the smart appliance and the remote server by the network traffic hub. ### Claim 9 (depends on 8) The method of claim 8, further comprising, responsive to not detecting malicious behavior in the network communications between the smart appliance and the remote server, allowing continued network traffic communications between the smart appliance and the remote server by the network traffic hub. ### Claim 10 (depends on 8) The method of claim 8, wherein detecting malicious behavior in encrypted network communications uses a threat detection model. ### Claim 11 (depends on 10) The method of claim 10, wherein the threat detection model is a decision tree. ### Claim 12 (depends on 10) The method of claim 10, wherein the threat detection model is a machine-learned model. ### Claim 13 (depends on 12) The method of claim 12, wherein the threat detection model is trained using known-malicious training data and known-benign training data, the known-malicious training data comprising examples where a secure connection between a smart appliance and a remote server is attacked while the secure connection was being established and the known-benign training data comprising examples where a secure connection between a smart appliance and a remote server is successful connected without being compromised. ### Claim 14 (depends on 8) The method of claim 8, further comprising receiving, from a behavior analysis engine a designation of whether malicious behavior is present in the first network communication or the one or more second network communications based on analysis from a threat detection model. ### Claim 15 A non-transitory computer-readable medium comprising stored program code, the program code comprised of computer-executable instructions that, when executed by a processor, causes the processor to: intercept, via a first communication channel in a local network, a first network communication from a smart appliance for transmission, via a second communication channel in a wide area network, to a remote server, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server; extract the encryption suite from the first network communication; transmit, via the second communication channel, the first network communication to the remote server; intercept, via the second communication channel, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms; extract the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications; transmit, via the first communication channel, the one or more second network communications to the smart appliance; detect malicious behavior performed by the smart appliance or remote server, via the first and second communication channels, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms; and block network communications between the smart appliance and the remote server, in response to detecting malicious behavior in the network communications between the smart appliance and the remote server. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, further comprising, responsive to not detecting malicious behavior in the network communications between the smart appliance and the remote server, allowing continued network traffic communications between the smart appliance and the remote server. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the program code further comprises instruction to detect malicious behavior in encrypted network communications using a threat detection model. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the threat detection model is a decision tree. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the threat detection model is a machine-learned model. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the threat detection model is trained using known-malicious training data and known-benign training data, the known-malicious training data comprising examples where a secure connection between a smart appliance and a remote server is attacked while the secure connection was being established and the known-benign training data comprising examples where a secure connection between a smart appliance and a remote server is successful connected without being compromised. ### Claim 21 (depends on 15) The non-transitory computer-readable medium of claim 15, further comprising program code to receive a designation, from a behavior analysis engine, of whether malicious behavior is present in the first network communication or the one or more second network communications based on analysis from a threat detection model.