# US 11,451,578 B2 · Analyzing encrypted traffic behavior using contextual traffic data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,578 B2 - Document ID: US11451578B2 - Status: Granted - Kind: B2 - Application number: 17/029,156 - Filed: 2020-09-23 - Published: 2021-01-07 - Granted: 2022-09-20 - Earliest claimed: 2016-10-06 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Jan Kohout; Blake Harrell Anderson; Martin Grill; David McGrew; Martin Kopp; Tomas Pevny - Web page: https://patentgrep.com/patent/US11451578B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 20/00: Machine learning - H04L 41/0686: Additional information in the notification, e.g. enhancement of specific meta-data - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/168: {above the transport layer} - G06N 20/20: Ensemble learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device in a network detects an encrypted traffic flow associated with a client in the network. The device captures contextual traffic data regarding the encrypted traffic flow from one or more unencrypted packets associated with the client. The device performs a classification of the encrypted traffic flow by using the contextual traffic data as input to a machine learning-based classifier. The device generates an alert based on the classification of the encrypted traffic flow. ## Claims ### Claim 1 A method, comprising: detecting, at a device in a network, an encrypted traffic flow associated with a client in the network; receiving, at the device, a sequence of packets sent by the client associated with the encrypted traffic flow, the sequence of packets including 1) an encrypted request packet of the encrypted traffic flow and 2) one or more unencrypted packets sent by the client sequentially before or after the encrypted request packet; capturing, by the device, contextual traffic data regarding the encrypted traffic flow from the one or more unencrypted packets; performing, by the device, a classification of the encrypted traffic flow by using the captured contextual traffic data as input to a machine learning-based classifier; and generating, by the device, an alert based on the classification of the encrypted traffic flow wherein capturing the contextual traffic data further comprises: analyzing, by the device, the encrypted traffic flow to infer a header field of the encrypted traffic flow; and comparing, by the device, the inferred header field of the encrypted traffic flow with a header field of the one or more unencrypted packets. ### Claim 2 (depends on 1) The method as in claim 1, wherein the machine learning-based classifier is configured to infer the header field of the encrypted traffic flow based on a cipher suite that is advertised in one or more other header fields of the encrypted traffic flow. ### Claim 3 (depends on 1) The method as in claim 1, wherein the one or more unencrypted packets are Hypertext Transfer Protocol (HTTP) packets, and the encrypted traffic flow comprises one or more HTTP Secure (HTTPS) packets. ### Claim 4 (depends on 1) The method as in claim 1, wherein capturing the contextual traffic data for the encrypted traffic flow further comprises: extracting, by the device, header information from the one or more unencrypted packets; and constructing, by the device, a feature vector for input to the machine learning-based classifier based on the extracted header information. ### Claim 5 (depends on 4) The method as in claim 4, wherein the header information is extracted from one or more of: a content-type header field, a user-agent header field, an accept-language header field, a server header field, or a status-code header field. ### Claim 6 (depends on 1) The method as in claim 1, wherein the header field of the encrypted traffic flow is a user-agent header field of the encrypted traffic flow, and the header field of the one or more unencrypted packets is a user-agent header field of the one or more unencrypted packets. ### Claim 7 (depends on 1) The method as in claim 1, wherein capturing the contextual traffic data further comprises: selecting, by the device, the one or more unencrypted packets for analysis based on the client having sent the one or more unencrypted packets within a predefined timespan of a request packet of the encrypted traffic flow. ### Claim 8 (depends on 1) The method as in claim 1, wherein capturing the contextual traffic data further comprises: generating, by the device, a fixed-size set of the one or more unencrypted packets. ### Claim 9 (depends on 1) The method as in claim 1, wherein the one or more unencrypted packets are included among a plurality of unencrypted packets, and capturing the contextual traffic data comprises: generating, by the device, two or more groups of the plurality of unencrypted packets, wherein each group indicates micro-activity by the client. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: detect an encrypted traffic flow associated with a client in the network; receive a sequence of packets sent by the client associated with the encrypted traffic flow, the sequence of packets including 1) an encrypted request packet of the encrypted traffic flow and 2) one or more unencrypted packets sent by the client sequentially before or after the encrypted request packet; capture contextual traffic data regarding the encrypted traffic flow from the one or more unencrypted packets; perform a classification of the encrypted traffic flow by using the captured contextual traffic data as input to a machine learning-based classifier; and generate an alert based on the classification of the encrypted traffic flow, wherein the apparatus further captures the contextual traffic data by: analyzing the encrypted traffic flow to infer a header field of the encrypted traffic flow; and comparing the inferred header field of the encrypted traffic flow with a header field of the one or more unencrypted packets. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the machine learning-based classifier is configured to infer the header field of the encrypted traffic flow based on a cipher suite that is advertised in one or more other header fields of the encrypted traffic flow. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the one or more unencrypted packets are Hypertext Transfer Protocol (HTTP) packets, and the encrypted traffic flow comprises one or more HTTP Secure (HTTPS) packets. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the apparatus further captures the contextual traffic data for the encrypted traffic flow by: extracting header information from the one or more unencrypted packets; and constructing a feature vector for input to the machine learning-based classifier based on the extracted header information. ### Claim 14 (depends on 13) The apparatus as in claim 13, wherein the header information is extracted from one or more of: a content-type header field, a user-agent header field, an accept-language header field, a server header field, or a status-code header field. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the header field of the encrypted traffic flow is a user-agent header field of the encrypted traffic flow, and the header field of the one or more unencrypted packets is a user-agent header field of the one or more unencrypted packets. ### Claim 16 (depends on 10) The apparatus as in claim 10, wherein the apparatus further captures the contextual traffic data by: selecting the one or more unencrypted packets for analysis based on the client having sent the one or more unencrypted packets within a predefined timespan of a request packet of the encrypted traffic flow. ### Claim 17 (depends on 10) The apparatus as in claim 10, wherein the apparatus further captures the contextual traffic data by: generating a fixed-size set of the one or more unencrypted packets. ### Claim 18 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further operable to: perform anomaly detection on the encrypted traffic flow by using the contextual traffic data as input to a machine learning-based anomaly detector. ### Claim 19 A tangible, non-transitory, computer-readable medium storing program instructions that cause a networking device in a network to execute a process comprising: detecting, at the device, an encrypted traffic flow associated with a client in the network; receiving, at the device, a sequence of packets sent by the client associated with the encrypted traffic flow, the sequence of packets including 1) an encrypted request packet of the encrypted traffic flow and 2) one or more unencrypted packets sent by the client sequentially before or after the encrypted request packet; capturing, by the device, contextual traffic data regarding the encrypted traffic flow from the one or more unencrypted packets; performing, by the device, a classification of the encrypted traffic flow by using the captured contextual traffic data as input to a machine learning-based classifier; and generating, at the device, an alert based on the classification of the encrypted traffic flow wherein capturing the contextual traffic data further comprises: analyzing, by the device, the encrypted traffic flow to infer a header field of the encrypted traffic flow; and comparing, by the device, the inferred header field of the encrypted traffic flow with a header field of the one or more unencrypted packets. ### Claim 20 (depends on 19) The computer-readable medium as in claim 19, wherein the machine learning-based classifier is configured to infer the header field of the encrypted traffic flow based on a cipher suite that is advertised in one or more other header fields of the encrypted traffic flow.