# US 8,782,794 B2 · Detecting secure or encrypted tunneling in a computer network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,794 B2 - Document ID: US8782794B2 - Status: Granted - Kind: B2 - Application number: 13/298,597 - Filed: 2011-11-17 - Published: 2012-03-08 - Granted: 2014-07-15 - Earliest claimed: 2010-04-16 - Assignees: Bank of America Corporation - Applicants: Ronald Ramcharran - Inventors: Ronald Ramcharran - Web page: https://patentgrep.com/patent/US8782794B2 ## CPC - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/166: {at the transport layer} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 61/2592: using tunnelling or encapsulation - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer assisted method for detecting encrypted tunneling or proxy avoidance is presented. The method may include electronically receiving information from a proxy server, extracting information regarding a CONNECT function of Hyper Text Transport Protocol (HTTP) from the electronically received information, determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds and attempting to negotiate a standard HTTPS session with each of the at least one destination. Further, the computer assisted method may further include, for each of the at least one destination, determining whether the destination is hosting an encrypted tunneling or proxy avoidance application, wherein such a determining may be based on characteristics of an Secure Socket Layer (SSL) certificate associated with the destination or a response received from the destination over a TCP/IP connection. ## Claims ### Claim 1 A computer assisted method for detecting encrypted tunneling comprising: electronically receiving information from a proxy server; extracting information regarding a CONNECT function of Hyper Text Transport Protocol (HTTP) from the electronically received information; determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds; attempting to negotiate a standard Hyper Text Transport Protocol Secure (HTTPS) session with each of the at least one destination; for each of the at least one destination, determining if a Secure Socket Layer (SSL) certificate associated with the destination has been issued by a trusted certificate authority; determining whether the destination is hosting an encrypted tunneling application, wherein the determining whether the destination is hosting an encrypted tunneling application includes: identifying a plurality of characteristics of the SSL certificate; comparing the plurality of characteristics of the SSL certificate with a list of authentic characteristics to determine whether the SSL certificate is authentic; wherein identifying the plurality of characteristics includes determining at least a name of at least one of: to whom the SSL certificate was issued and who issued the SSL certificate; and identifying, based on the identified plurality of characteristics of the SSL certificate, a type of encrypted tunneling application associated with the at least one destination. ### Claim 2 (depends on 1) The method according to claim 1, wherein the at least one destination is at least one IP address or at least one IP address in combination with at least one port number. ### Claim 3 (depends on 1) The method according to claim 1, further comprising: determining if a destination, of the at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds, is a destination that has been previously identified by the method as a destination hosting an encrypted tunneling or proxy avoidance application by comparing the destination with a database of previously identified destinations. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: for each destination of the at least one destination, comparing the destination with a database of previously identified destinations identified as hosting an encrypted tunneling application; and determining if the destination, is a previously identified destination. ### Claim 5 (depends on 4) The method according to claim 4, further comprising: upon determining the destination is hosting an encrypted tunneling application, recording the destination in a database of previously identified destinations identified as hosting an encrypted tunneling application. ### Claim 6 (depends on 1) The method according to claim 1, further comprising: upon determining the destination is hosting an encrypted tunneling application, generating a security alert. ### Claim 7 (depends on 1) The method according to claim 1, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining whether the SSL certificate is self signed. ### Claim 8 (depends on 1) The method according to claim 1, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining whether at least the name of at least one of: to whom the SSL certificate was issued and who issued the SSL certificate, contains a string of random characters that is unintelligible. ### Claim 9 (depends on 1) The method according to claim 1, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining a service being operated at the destination. ### Claim 10 (depends on 1) The method according to claim 1, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining at least one of: a port or channel hopping patterns of a service being operated at the destination, a length of traffic of a service being operated at the destination. ### Claim 11 (depends on 1) The method according to claim 1, wherein the extracting information regarding a CONNECT function of HTTP from the electronically received information and the determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds occur immediately upon the electronically received information from the proxy server being received. ### Claim 12 An encrypted tunneling detecting apparatus comprising: at least one processor; and at least one memory storing computer executable instructions that cause the at least one processor to perform a method for detecting encrypted tunneling comprising: electronically receiving information from a proxy server; extracting information regarding a CONNECT function of Hyper Text Transport Protocol (HTTP) from the electronically received information; determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds; attempting to negotiate a standard Hyper Text Transport Protocol Secure (HTTPS) session with each of the at least one destination; for each of the at least one destination, determining if a Secure Socket Layer (SSL) certificate associated with the destination has been issued by a trusted certificate authority; and determining whether the destination is hosting an encrypted tunneling application, wherein the determining whether the destination is hosting an encrypted tunneling application includes: identifying a plurality of characteristics of the SSL certificate; comparing the plurality of characteristics of the SSL certificate with a list of authentic characteristics to determine whether the SSL certificate is authentic; wherein identifying the plurality of characteristics includes determining at least a name of at least one of: to whom the SSL certificate was issued and who issued the SSL certificate; and identifying, based on the identified plurality of characteristics of the SSL certificate, a type of encrypted tunneling application associated with the at least one destination. ### Claim 13 (depends on 12) The apparatus according to claim 12, further comprising: determining if a destination, of the at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds, is a destination that has been previously identified by the method as a destination hosting an encrypted tunneling or proxy avoidance application by comparing the destination with a database of previously identified destinations. ### Claim 14 (depends on 12) The apparatus according to claim 12, further comprising: for each destination of the at least one destination, comparing the destination with a database of previously identified destinations identified as hosting an encrypted tunneling application; and determining if the destination, is a previously identified destination. ### Claim 15 (depends on 14) The apparatus according to claim 14, further comprising: upon determining the destination is hosting an encrypted tunneling application, recording the destination in a database of previously identified destinations identified as hosting an encrypted tunneling application. ### Claim 16 (depends on 12) The apparatus according to claim 12, further comprising: upon determining the destination is hosting an encrypted tunneling application, generating a security alert. ### Claim 17 (depends on 12) The apparatus according to claim 12, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining whether the SSL certificate is self signed. ### Claim 18 (depends on 12) The apparatus according to claim 12, wherein the determining whether the destination is hosting an encrypted tunneling application includes determining a service being operated at the destination. ### Claim 19 A computer assisted method for detecting encrypted tunneling or proxy avoidance comprising: electronically receiving information from a proxy server; extracting information regarding a CONNECT function of Hyper Text Transport Protocol (HTTP) from the electronically received information; determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds; attempting to negotiate a standard Hyper Text Transport Protocol Secure (HTTPS) session with each of the at least one destination; for each of the at least one destination, determining whether the destination is hosting an encrypted tunneling or proxy avoidance application, wherein such a determining includes: identifying a plurality of characteristics of a Secure Socket Layer (SSL) certificate associated with the at least one destination, wherein identifying the plurality of characteristics includes determining at least a name of at least one of: to whom the SSL certificate was issued and who issued the SSL certificate; comparing the plurality of characteristics of the SSL certificate with a list of authentic characteristics to determine whether the SSL certificate is authentic; and identifying, based on the identified plurality of characteristics of the SSL certificate, a type of encrypted tunneling application associated with the at least one destination.