# US 2012/0084464 A1 · Obfuscating Network Traffic from Previously Collected Network Traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2012/0084464 A1 - Document ID: US20120084464A1 - Status: Published application - Kind: A1 - Application number: 12/895,973 - Filed: 2010-10-01 - Published: 2012-04-05 - Earliest claimed: 2010-10-01 - Assignees: Telcordia Technologies, Inc. - Inventors: Munir Cochinwala; Marc Pucci - Web page: https://patentgrep.com/patent/US20120084464A1 ## CPC - H04L 43/026: using flow identification - H04L 43/18: Protocol analysers - H04L 43/50: Testing arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An obfuscated network traffic server is operative to generate obfuscated network traffic. The obfuscated network traffic server maintains the relationship between extracted application content and extracted network header content such that the obfuscated network traffic is indistinguishable from the monitored network traffic. The obfuscated network traffic server may include a network monitor operative to monitor network traffic and to extract application content and network header content from the monitored network traffic. The obfuscated network traffic server may also include a data masking processor operative to mask a portion of the separated application content and/or the separated network header content. The obfuscated network traffic server may further include a masking attribute selector operative to specify the attributes of the application content and/or the network header content that is to be masked. ## Claims ### Claim 1 A system for generating obfuscated network traffic, the system comprising: a computer-readable storage device comprising: an application content database operative to store application content extracted from a first network traffic flow by a network monitor; a network header content database operative to store network header content extracted from the first network traffic flow by the network monitor; and, an obfuscated network traffic database operative to store obfuscated network header content; a data masking processor operative to: retrieve the network header content stored in the network header content database; and, mask at least a selected portion of the network header content to generate the obfuscated network header content; and, an obfuscated network traffic request interface operative to: receive a request for obfuscated network traffic; and, transmit the obfuscated network header content stored in the obfuscated network traffic database based upon the request for obfuscated network traffic. ### Claim 2 (depends on 1) The system of claim 1, further comprising a masking attribute selector operative to receive an input specifying one or more network header attributes to be masked, wherein the data masking processor is further operative to mask the selected portion of the network header based on the input received by the masking attribute selector. ### Claim 3 (depends on 1) The system of claim 1, further comprising a replacement application content database operative to store replacement application content, wherein: at least a portion of the application content extracted by the network monitor is replaced with the replacement application content stored in the replacement application content database. ### Claim 4 (depends on 1) The system of claim 1, wherein: the application content is identified as being sensitive application content not intended to be viewed by a recipient other than the recipient identified in the network header content; and the application content is replaced with replacement application content having similar characteristics as the identified application content. ### Claim 5 (depends on 1) The system of claim 1, wherein: the first network traffic flow is a first type of network traffic flow; the application content database is further operative to store application content extracted from a second network traffic flow; the network header content database is further operative to store network header content extracted from the second network traffic flow; and, the second network traffic flow is a second type of network traffic flow different from the first type of network flow. ### Claim 6 (depends on 5) The system of claim 5, wherein: the first type of network traffic flow comprises the File Transfer Protocol (“FTP”); and, the second type of network traffic flow comprises the Hypertext Transfer Protocol (“HTTP”). ### Claim 7 (depends on 1) The system of claim 1, wherein: the first network flow is identified based on a destination port specified in the network header content. ### Claim 8 (depends on 1) The system of claim 1, wherein: the application content and network header content are separated based on a network traffic type of the first network traffic flow. ### Claim 9 (depends on 1) The system of claim 1, further comprising: a network traffic flow multiplexer operative to: receive obfuscated network header content from the data masking processor; request application content from the application, content database based on an application content identifier; reconstruct an obfuscated network traffic flow comprising the requested obfuscated network header content and the requested application content; and, store the obfuscated network traffic flow in the obfuscated network traffic database. ### Claim 10 (depends on 9) The system of claim 9, wherein the network traffic flow multiplexer is further operative to: replace the requested obfuscated network traffic header content stored in the obfuscated network traffic database with the reconstructed obfuscated network traffic flow. ### Claim 11 (depends on 1) The system of claim 1, wherein the obfuscated network traffic database is segmented according to an obfuscated network traffic database schema, the obfuscated network traffic database schema comprising: an Internet Protocol (“IP”) packet segment specifying IP packet attributes for the obfuscated network header content; a request and response segment specifying request and response attributes for the obfuscated network header content; a time segment specifying time attributes for the obfuscated network header content; a server segment specifying server attributes for the obfuscated network header content; a customer segment specifying customer attributes for the obfuscated network header content; and, a Uniform Resource Locator (“URL”) segment specifying URL attributes for the obfuscated network header content. ### Claim 12 A method for generating masked network traffic, the method comprising: receiving extracted application content of a first network traffic flow and extracted network header content of the first network traffic flow; masking, with the data masking processor, at least a selected portion of the network header content to generate masked network header content; combining the masked network header content with the separated application content based on a maintained relationship between the application content and the network header content; and, transmitting the combined masked network header content and application content in response to a request for masked network traffic. ### Claim 13 (depends on 12) The method of claim 12, further comprising receiving, with a masking attribute selector, an input specifying one or more network header attributes to be masked, wherein the masking of the selected portion of the network header by the data masking processor is based on the input received by the masking attribute selector. ### Claim 14 (depends on 12) The method of claim 12, further comprising: storing replacement application content in the computer-readable storage device; and, replacing at least a portion of the application content separated from the network header content with the replacement application content stored in the computer-readable storage device. ### Claim 15 (depends on 12) The method of claim 12, further comprising: identifying the application content as being sensitive application content not intended to be viewed by a recipient other than the recipient identified in the network header content; and replacing the sensitive application content with replacement application content having similar characteristics as the identified sensitive application content. ### Claim 16 (depends on 12) The method of claim 12, wherein the first network traffic flow is a first type of network traffic flow, and further comprising: receiving extracted application content of a second network traffic flow and extracted network header content of the second network traffic flow, wherein: the second network traffic flow is a second type of network traffic flow different from the first type of network flow. ### Claim 17 (depends on 16) The method of claim 16, wherein: the first type of network traffic flow comprises the File Transfer Protocol (“FTP”); and, the second type of network traffic flow comprises the Hypertext Transfer Protocol (“HTTP”). ### Claim 18 (depends on 12) The method of claim 12, wherein: the first network flow is identified based on a destination port specified in the network header content. ### Claim 19 (depends on 12) The method of claim 12, wherein: the application content and the network header content are separated based on a network traffic type of the first network traffic flow. ### Claim 20 (depends on 12) The method of claim 12, further comprising: masking, with the data masking processor, the application content of the first network traffic flow based on at least one first masking attribute. ### Claim 21 (depends on 20) The method of claim 20, wherein: the network header content of the first network traffic flow is first network header content; the application content of the first network traffic flow is first application content; the masked application of the first network traffic flow is first masked application content; and, further comprising: receiving second network header content and second application content extracted from a second network traffic flow; and, masking, with the data masking processor, the second application content based on at least one second masking attribute; wherein: the at least one first masking attribute and the at least one second masking attribute are different. ### Claim 22 (depends on 12) The method of claim 12, further comprising: establishing a masked network traffic database operative to store the masked network header content; segmenting the masked network traffic database according to a masked network traffic database schema, wherein maintaining the relationship between the separated application content and separated network header content is based on the masked network traffic database schema; and, storing the masked network header content in the masked network traffic database according to the masked network traffic database schema. ### Claim 23 (depends on 22) The method of claim 22, wherein the masked network traffic database schema comprises: an Internet Protocol (“IP”) packet segment specifying IP packet attributes for the masked network header content; a request and response segment specifying request and response attributes for the masked network header content; a time segment specifying time attributes for the masked network header content; a server segment specifying server attributes for the masked network header content; a customer segment specifying customer attributes for the masked network header content; and, a Uniform Resource Locator (“URL”) segment specifying URL masked for the obfuscated network header content.