METHOD OF NON-INTRUSIVE ANALYSIS OF SECURE AND NON-SECURE WEB APPLICATION TRAFFIC IN REAL-TIME

• US 20090265463A1
• Filed: 04/27/2009
• Published: 10/22/2009
• Est. Priority Date: 05/30/2003
• Status: Active Grant

• Current Assignee: Borland Software Corporation (Open Text Corporation)
• Original Assignee: Borland Software Corporation (Open Text Corporation)
• Inventors: Greifeneder, Bernd, Schwarzbauer, Gunter, Spiegl, Helmut, Reichl, Bernhard
• Granted Patent: US 8,103,765 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Provided is a method and system for monitoring and analysis of networked systems, that is non-intrusive and real time. Both secure and non-secure traffic may be analyzed. The provided method involves non-intrusively copying data from a communication medium, reconstructing this data to a higher level of communication, such as the application level, grouping the data into sets, each set representing a session, and organizing the data for chosen sessions in hierarchical fashion which corresponds to the hierarchy of the communicated information. If monitored communications are encrypted, they are non-intrusively decrypted in real time. Hierarchically reconstructed session data is used by one or more plug-in applications, such as alarms, archival applications, visualization applications, script generation applications, abandonment monitoring applications, error detection applications, performance monitoring applications, and others.

Claims

1. A method for non-intrusive real-time analysis of secure communications between a first application and a second application, wherein the first and second applications communicate through a communication channel, comprising the steps of:

non-intrusively and securely capturing a plurality of secure communications between the first application and the second application substantially in real-time;

processing the plurality of communications to form a first plurality of information units, each information unit comprising application level information substantially in real-time;

analyzing a second plurality of information units up to an application layer, the second plurality comprising one or more of the first plurality of information units, to determine a plurality of dependencies among the second plurality of information units substantially in real-time;

organizing the second plurality of information units into a hierarchical data structure according to the plurality of dependencies among the information units.