Real-time threat detection for encrypted communications

A system for threat detection for encrypted communications including a memory for storing computer-readable program code and a processor for executing the computer-readable program code, the system comprising:

• a monitoring component for monitoring a data stream in a network, the data stream including encrypted message data and non-encrypted metadata associated with the encrypted message data being transmitted between endpoints on the network;
• a data stream metadata extraction component for extracting data stream metadata from the data stream, the data stream metadata including data points extracted from the non-encrypted metadata;
• a metadata enriching component for enriching the data stream metadata with contextual data relating to one or more of threat, vulnerability and reputation data points and being obtained from one or more signal sources to output enriched data;
• a threat assessment component for analysing the enriched data and calculating a risk probability score associated therewith;
• and,
• an actioning component for initiating an action in accordance with the risk probability score so as to mitigate a threat present on the network.

A computer program product for threat detection for encrypted communications, the computer program product comprising a computer-readable medium having stored computer-readable program code for performing the steps of:

• monitoring a data stream in a network, the data stream including encrypted message data and non-encrypted metadata associated with the encrypted message data being transmitted between endpoints on the network;
• extracting data stream metadata from the data stream, the data stream metadata including data points extracted from the non-encrypted metadata;
• enriching the data stream metadata with contextual data relating to one or more of threat, vulnerability and reputation data points and being obtained from one or more signal sources to output enriched data;
• analysing the enriched data and calculating a risk probability score associated therewith;
• and,
• initiating an action in accordance with the risk probability score so as to mitigate a threat present on the network.