Intelligent dataflow-based service discovery and analysis

A non-transitory computer readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:

• intercepting an encrypted network request, the encrypted network request transmitted by a client device to a network endpoint to establish a secure session;
• identifying a network service associated with the network endpoint based on unencrypted properties of the encrypted network request, the encrypted network request comprising an encrypted portion and a plaintext portion, the unencrypted properties determined based on the plaintext portion;
• identifying an activity performed during the secure session by:
• capturing a series of subsequent encrypted network requests issued by the client device to the network endpoint during a transaction burst occurring during the secure session,
• generating a fingerprint based on the series of subsequent encrypted network requests, the fingerprint comprising at least one aggregated feature computed using properties of the series of subsequent encrypted network requests,
• inputting the fingerprint and an identification of the network service to a predictive model, the predictive model trained using transaction bursts by extracting one or more transaction properties from the transaction burst, assigning labels to the one or more transaction properties, a given label comprising one or more of a network service and an action, and training the predictive model with labeled data, and
• using an output of the predictive model as the activity;
• and
• updating a catalog of network interactions using the network service and the activity;
• extracting a property from the encrypted network request;
• and
• updating a mapping using the property and the network service.

A device comprising:

• a processor;
• and
• a storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic causing the processor to perform operations of:
• intercepting an encrypted network request, the encrypted network request transmitted by a client device to a network endpoint to establish a secure session,
• identifying a network service associated with the network endpoint based on unencrypted properties of the encrypted network request, the encrypted network request comprising an encrypted portion and a plaintext portion, the unencrypted properties determined based on the plaintext portion,
• identifying an activity performed during the secure session by:
• capturing a series of subsequent encrypted network requests issued by the client device to the network endpoint during a transaction burst occurring during the secure session,
• generating a fingerprint based on the series of subsequent encrypted network requests, the fingerprint comprising at least one aggregated feature computed using properties of the series of subsequent encrypted network requests,
• inputting the fingerprint and an identification of the network service to a predictive model, the predictive model trained using transaction bursts by extracting one or more transaction properties from the transaction burst, assigning labels to the one or more transaction properties, a given label comprising one or more of a network service and an action, and training the predictive model with labeled data, and
• using an output of the predictive model as the activity, and
• updating a catalog of network interactions using the network service and the activity,
• extracting a property from the encrypted network request, and
• updating a mapping using the property and the network service.