Determining sum length of host and path in encrypted HTTP request message
AssigneeCujo LLC
InventorsFilip Savin, Leonardas Marozas
Life of this patent
Estimating the term…
Abstract
An encrypted hypertext transfer protocol (HTTP) connection between a client and a server is intercepted. The encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message. A sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message is determined by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message.
Claims19
A computer-implemented method comprising:
- intercepting an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;
- determining a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message;
- and
- in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, performing a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.
An apparatus comprising:
- one or more memories;
- and
- one or more processors coupled to the one or more memories configured to:
- intercept an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;
- determine a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message;
- and
- in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, perform a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.
A non-transitory computer-readable medium comprising a computer program with instructions which, when executed by an apparatus, cause the apparatus to:
- intercept an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;
- determine a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message;
- and
- in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, perform a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.
Dependencies are inferred from the claim text.