Back to results
US 12,750,379 B1Granted
System and method for encrypted network traffic classification using transformed snippets and on the fly built classifiers
AssigneeCorelight, Inc.
InventorJulien Piet
Life of this patent
Estimating the term…
Abstract
A system and method for encrypted data traffic classification may use transformed snippets to train on-the-fly traffic classifiers and build traffic classifiers that leverage interpretable feature sets without the need to inspect payloads in which snippets are transformed to be used for encrypted data traffic classification.
Claims31
A network traffic classifier, comprising:
- a memory that stores a plurality of lines of instructions;
- a processor that executes the plurality of lines of instructions wherein the processor is configured to:
- generate one or more transformed encrypted data snippets wherein each transformed encrypted data snippet is an unencrypted snippet whose length is adjusted based on both a type of encryption used in the encrypted data and a TLS protocol version of the encrypted data, each snippet including a string of lengths field, an anchor field and a negation field;
- receive at least one trained traffic classifier, trained using one or more transformed encrypted data snippets, to identify encrypted data;
- receive a set of current network traffic data;
- and
- identify, in the set of current network traffic data, encrypted protocol data using the at least one trained traffic classifier.
4 more elements
A network traffic classifier method, the method comprising:
- generating one or more transformed encrypted data snippets wherein each transformed encrypted data snippet is an unencrypted snippet whose length is adjusted based on both a type of encryption used in the encrypted data and a TLS protocol version of the encrypted data, each snippet including a string of lengths field, an anchor field and a negation field;
- receiving, at a computing device that classifies network traffic, at least one trained traffic classifier, trained using one or more transformed encrypted data snippets, to identify encrypted data;
- receiving, at the network traffic classifier computing device, a set of current network traffic data;
- and
- identifying, at the network traffic classifier computing device in the set of current network traffic data, encrypted protocol data using the at least one trained traffic classifier.
2 more elements
An apparatus for generating an encrypted data traffic classifier, comprising:
- a memory that stores a plurality of lines of instructions;
- a processor that executes the plurality of lines of instructions wherein the processor is configured to:
- receive network data traffic;
- identify unencrypted data traffic that includes encrypted protocol data traffic;
- identify an encryption type of the encrypted protocol data traffic and a protocol version for the encrypted protocol data traffic;
- generate one or more transformed snippets that represent the encrypted protocol data traffic, wherein each transformed encrypted snippet is an unencrypted data snippet whose length is adjusted based on a type of encryption of the encrypted data and a TLS protocol version of the encrypted data, each snippet including a string of lengths field, an anchor field and a negation field;
- and
- train a classifier for the encrypted data using the one or more generated transformed snippets.
5 more elements
A method for generating an encrypted data traffic classifier, the method comprising:
- receiving, at a computing device, network traffic data;
- identifying, at the computing device, unencrypted data traffic that includes encrypted protocol data traffic;
- identifying, at the computing device, an encryption type of the encrypted protocol data traffic and a protocol version for the encrypted protocol data traffic;
- generating, at the computing device, one or more transformed snippets that represent the encrypted protocol data traffic, wherein each transformed encrypted snippet is an unencrypted data snippet whose length is adjusted based on a type of encryption of the encrypted data and a TLS protocol version of the encrypted data, each snippet including a string of lengths field, an anchor field and a negation field;
- and
- training a classifier for the encrypted data using the one or more generated transformed snippets.
3 more elements
Dependencies are inferred from the claim text.