Correlating decrypted data with network connections

A method, comprising:

• obtaining, by one or more processing circuits, responsive to an establishment of a connection with a network, network connection information associated with communication across the network, wherein a plurality of computing devices and a server communicate via the network;
• storing, by the one or more processing circuits, the network connection information in a first data cache, wherein one or more respective segments of the network connection information are retrievable, from the first data cache, using a corresponding network socket handle;
• detecting, by the one or more processing circuits, via a first Extended Berkeley Packet Filter (eBPF) program, an initiation of a Secure Sockets Layer (SSL) function, wherein the SSL function is initiated by a first computing device of the plurality of computing devices, and wherein the SSL function is associated with an encrypted data packet having a payload;
• identifying, by the one or more processing circuits, responsive to the initiation of the SSL function, via a second eBPF program, an initiation of data transmission function that results in (i) a transmission of the encrypted data packet to a network stack or (ii) receipt of the encrypted data packet from the network stack;
• detecting, by the one or more processing circuits, via a third eBPF program, a termination of the data transmission function, wherein the termination of the data transmission function returns a network socket handle utilized during the data transmission function;
• storing, by the one or more processing circuits, the network socket handle in a second data cache, wherein the network socket handle is linked, in the second data cache, to the encrypted data packet;
• detecting, by the one or more processing circuits, via a fourth eBPF program, a termination of the SSL function, wherein detection of the termination of the SSL function triggers:
• a first retrieval, from the second data cache, of the network socket handle;
• and
• a second retrieval, from the first data cache using the network socket handle, one or more segments of the network connection information;
• and
• associating, by the one or more processing circuits, the one or more segments of the network connection information with the payload based on a context of the SSL function.

One or more non-transitory storage medium storing instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• obtaining, responsive to an establishment of a connection with a network, network connection information associated with communication across the network, wherein a plurality of computing devices and a server communicate via the network;
• storing the network connection information in a first data cache, wherein one or more respective segments of the network connection information are retrievable, from the first data cache, using a corresponding network socket handle;
• detecting, via a first Extended Berkeley Packet Filter (eBPF) program, an initiation of a Secure Sockets Layer (SSL) function, wherein the SSL function is initiated by a first computing device of the plurality of computing devices, and wherein the SSL function is associated with an encrypted data packet having a payload;
• identifying, responsive to the initiation of the SSL function, via a second eBPF program, an initiation of data transmission function that results in (i) a transmission of the encrypted data packet to a network stack or (ii) receipt of the encrypted data packet from the network stack;
• detecting, via a third eBPF program, a termination of the data transmission function, wherein the termination of the data transmission function returns a network socket handle utilized during the data transmission function;
• storing the network socket handle in a second data cache, wherein the network socket handle is linked, in the second data cache, to the encrypted data packet;
• detecting, via a fourth eBPF program, a termination of the SSL function, wherein detection of the termination of the SSL function triggers:
• a first retrieval, from the second data cache, of the network socket handle;
• and
• a second retrieval, from the first data cache using the network socket handle, one or more segments of the network connection information;
• and
• associating the one or more segments of the network connection information with the payload based on a context of the SSL function.