METHODS, SYSTEMS, AND COMPUTER READABLE MEDIA FOR RAPID FILTERING OF OPAQUE DATA TRAFFIC

• US 20150052601A1
• Filed: 03/13/2013
• Published: 02/19/2015
• Est. Priority Date: 03/30/2012
• Status: Active Grant

• Current Assignee: SRI International, Inc., SR International, University of North Carolina At Chapel Hill (University of North Carolina System)
• Original Assignee: SRI International, Inc., Board of Regents of the University of Michigan (University of Michigan), University of North Carolina At Chapel Hill (University of North Carolina System)
• Inventors: Monrose, Fabian, Porras, Phillip Andrew, White, Andrew Maxwell, Krishnan, Srinivas, Bailey, Michael Donald
• Granted Patent: US 9,973,473 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods, systems, and computer readable media for rapid filtering of opaque data traffic are disclosed. According to one method, the method includes receiving a packet containing a payload. The method also includes analyzing a portion of the payload for determining whether the packet contains compressed or encrypted data. The method further includes performing, if the packet contains compressed or encrypted data, at least one of sending the packet to an opaque traffic analysis engine for analysis, discarding the packet, logging the packet, or marking the packet.

Claims

1. A method for rapid filtering of opaque data traffic, the method comprising:

receiving a packet containing a payload;

analyzing a portion of the payload for determining whether the packet contains compressed or encrypted data; and

performing, in response to determining that the packet contains compressed or encrypted data, at least one of sending the packet to an opaque traffic analysis engine for analysis, discarding the packet, logging the packet, or marking the packet.

2. The method of claim 1 wherein receiving the packet includes observing and copying the packet from a plurality of packets traversing a link or node.

3. The method of claim 1 wherein the portion of the payload analyzed is less than or equal to the entire payload.

4. The method of claim 1 wherein the portion of the payload analyzed includes about 16 bytes or less than 16 bytes.

5. The method of claim 1 wherein analyzing the portion of the payload for determining whether the packet contains compressed or encrypted data includes analyzing a bit value distribution, a byte value distribution, or an sample entropy distribution of the portion of the payload for determining whether the payload includes uniformly distributed bit, byte, or sample entropy values.

6. The method of claim 5 wherein determining that the payload includes uniformly distributed bit, byte, or sample entropy values indicates that the packet contains compressed or encrypted data.

7. The method of claim 1 wherein determining whether the payload packet contains compressed or encrypted data includes using at least one of a sequential hypothesis test, a fixed sample-size hypothesis test, or an autocorrelation function.

8. The method of claim 6 wherein at least one of the sequential hypothesis test, the fixed sample-size hypothesis test, or the autocorrelation function is used in differentiating an encrypted packet and a compressed packet.

9. The method of claim 1 wherein the receiving, the analyzing, and the performing steps are performed by a data acquisition and generation card (DAG), a graphics processing unit (GPU), or a general-purpose processor.

10. The method of claim 9 wherein the DAG, the GPU, or the general-purpose processor is configured to perform statistical hypothesis tests and/or statistical fingerprinting in parallel.

21. The method of claim 9 wherein the processor is configured to perform statistical hypothesis tests and/or statistical fingerprinting in parallel with other processors in the system.

11. A system for rapid filtering of opaque data traffic, the system comprising:

a processor; and

an opaque traffic filter (OTF) module executable by the processor, the OTF module configured to analyze a portion of the payload for determining whether the packet contains compressed or encrypted data and to perform, in response to determining that the packet contains compressed or encrypted data, at least one of sending the packet to an opaque traffic analysis engine for analysis, discarding the packet, logging the packet, or marking the packet.

12. The system of claim 11 wherein the system comprises a communications interface is configured to observe and copy the packet from a plurality of packets traversing a link or node.

13. The system of claim 11 wherein the portion of the payload analyzed is less than or equal to the entire payload.

14. The system of claim 11 wherein the portion of the payload analyzed includes about 16 bytes or less than 16 bytes.

15. The system of claim 11 wherein the OTF module is configured to analyze a bit value distribution, byte value distribution or the sample entropy distribution of the portion of the payload for determining whether the payload includes uniformly distributed bit, byte, or sample entropy values.

16. The system of claim 15 wherein determining that the payload includes uniformly distributed bit, byte, or sample entropy values indicates that the packet contains compressed or encrypted data.

17. The system of claim 15 wherein the OTF module is configured to determine whether the payload includes uniformly distributed bit, byte or block values using at least one of a sequential hypothesis test, a fixed sample-size hypothesis test, or an autocorrelation function.

18. The system of claim 17 wherein the OTF module is configured to use at least one of the sequential hypothesis test, the fixed sample-size hypothesis test, or the autocorrelation function in differentiating an encrypted packet and a compressed packet.

19. The system of claim 11 wherein the OTF module is configured to inform a packet inspection analysis engine when a session becomes opaque or transparent and/or when a packet of the session is examined that does not match an expected type for the session.

20. The system of claim 11 wherein the processor includes a data acquisition and generation card (DAG), a graphics processing unit (GPU), or a general-purpose processor.

22. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

receiving a packet containing a payload;

analyzing a portion of the payload for determining whether the packet contains compressed or encrypted data; and

performing, in response to determining that the packet contains compressed or encrypted data, at least one of sending the packet to an opaque traffic analysis engine for analysis, discarding the packet, logging the packet, or marking the packet.