SYSTEM AND METHOD FOR PASSIVELY IDENTIFYING ENCRYPTED AND INTERACTIVE NETWORK SESSIONS
First Claim
1. A method for passively identifying encrypted and interactive network sessions, comprising:
- distributing a passive vulnerability scanner that observes activity on a network, wherein the activity observed by the passive vulnerability scanner includes a plurality of packets that travel across the network during one or more sessions on the network;
sniffing, by the passive vulnerability scanner, the plurality of packets that travel across the network during the one or more sessions on the network, wherein the passive vulnerability scanner sniffs the plurality of packets to determine whether the one or more sessions communicate interactive or encrypted data;
reconstructing the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein reconstructing the one or more sessions includes identifying an originating host and a receiving host for the interactive or encrypted data;
identifying, by the passive vulnerability scanner, one or more potential vulnerabilities associated with the one or more reconstructed sessions; and
preparing, by the passive vulnerability scanner, a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities.
3 Assignments
0 Petitions
Accused Products
Abstract
The system and method for passively identifying encrypted and interactive network sessions described herein may distribute a passive vulnerability scanner in a network, wherein the passive vulnerability scanner may observe traffic travelling across the network and reconstruct a network session from the observed traffic. The passive vulnerability scanner may then analyze the reconstructed network session to determine whether the session was encrypted or interactive (e.g., based on randomization, packet timing characteristics, or other qualities measured for the session). Thus, the passive vulnerability scanner may monitor the network in real-time to detect any devices in the network that run encrypted or interactive services or otherwise participate in encrypted or interactive sessions, wherein detecting encrypted and interactive sessions in the network may be used to manage changes and potential vulnerabilities in the network.
196 Citations
20 Claims
-
1. A method for passively identifying encrypted and interactive network sessions, comprising:
-
distributing a passive vulnerability scanner that observes activity on a network, wherein the activity observed by the passive vulnerability scanner includes a plurality of packets that travel across the network during one or more sessions on the network; sniffing, by the passive vulnerability scanner, the plurality of packets that travel across the network during the one or more sessions on the network, wherein the passive vulnerability scanner sniffs the plurality of packets to determine whether the one or more sessions communicate interactive or encrypted data; reconstructing the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein reconstructing the one or more sessions includes identifying an originating host and a receiving host for the interactive or encrypted data; identifying, by the passive vulnerability scanner, one or more potential vulnerabilities associated with the one or more reconstructed sessions; and preparing, by the passive vulnerability scanner, a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. A system for passively identifying encrypted and interactive network sessions, comprising:
-
a network that includes a plurality of hosts; and a passive vulnerability scanner that observes a plurality of packets travelling across the network during one or more sessions on the network, wherein the passive vulnerability scanner is configured to; sniff the plurality of packets that travel across the network during the one or more sessions on the network, wherein the passive vulnerability scanner sniffs the plurality of packets to determine whether the one or more sessions communicate interactive or encrypted data; reconstruct the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein the one or more reconstructed sessions identify an originating host and a receiving host for the interactive or encrypted data; identify one or more potential vulnerabilities associated with the one or more reconstructed sessions; and prepare a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities, wherein the report further identifies one or more ports and one or more services that communicate the interactive or encrypted data between the originating host and the receiving host. - View Dependent Claims (13, 14, 15, 16, 17, 18, 19, 20)
-
Specification