Inference-based selective flow inspection

A system comprising:

• one or more processors;
• and
• one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, at a first network device associated with a network, a decryption policy comprising one or more traffic rules for applying the decryption policy to network traffic associated with connection flows through the network;
• receiving network traffic associated with a first connection flow between a first client device and a first application executing on a second network device of the network;
• generating a connection pattern associated with the first connection flow based at least in part on first behavioral characteristics of the first client device and second behavioral characteristics of the first application;
• generating a first risk score associated with the first connection flow based at least in part on the connection pattern associated with the first connection flow;
• and
• decrypting at least a portion of the network traffic based at least in part on the first risk score and the decryption policy.

A method comprising:

• receiving, at a first network device associated with a network, a decryption policy comprising one or more traffic rules for applying the decryption policy to connection flows through the network;
• receiving network traffic associated with a first connection flow between a first client device and a first application executing on a second network device of the network;
• generating a connection pattern associated with the first connection flow based at least in part on first behavioral characteristics of first client device and second behavioral characteristics of the first application;
• generating a first risk score associated with the first connection flow based at least in part on the connection pattern associated with the first connection flow;
• and
• refraining from decrypting the network traffic associated with the first connection flow based at least in part on the first risk score and the decryption policy.