System and method for passively identifying encrypted and interactive network sessions

• US 8,707,440 B2
• Filed: 03/22/2010
• Issued: 04/22/2014
• Est. Priority Date: 03/22/2010
• Status: Active Grant

• Current Assignee: Tenable, Inc. (Tenable Holdings, Inc.)
• Original Assignee: Tenable Network Security Incorporated (Tenable Holdings, Inc.)
• Inventors: Gula, Ron, Deraison, Renaud, Hayton, Matthew T.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US12/729,036
• Publication Number:
  US 20110231935A1
• Time in Patent Office: 1,492 Days
• Field of Search: 726 22- 25, 713151-154, 713/188
• US Class Current: 726/25
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The system and method for passively identifying encrypted and interactive network sessions described herein may distribute a passive vulnerability scanner in a network, wherein the passive vulnerability scanner may observe traffic travelling across the network and reconstruct a network session from the observed traffic. The passive vulnerability scanner may then analyze the reconstructed network session to determine whether the session was encrypted or interactive (e.g., based on randomization, packet timing characteristics, or other qualities measured for the session). Thus, the passive vulnerability scanner may monitor the network in real-time to detect any devices in the network that run encrypted or interactive services or otherwise participate in encrypted or interactive sessions, wherein detecting encrypted and interactive sessions in the network may be used to manage changes and potential vulnerabilities in the network.

Claims

1. A method for passively identifying encrypted and interactive network sessions, comprising:

observing, by a passive vulnerability scanner, activity on a network, wherein the activity includes a plurality of packets that travel across the network during one or more sessions on the network;

sniffing, by the passive vulnerability scanner, the plurality of packets that travel across the network during the one or more sessions on the network;

determining, by the passive vulnerability scanner, whether the one or more sessions communicate interactive or encrypted data based on a comparison of one or more characteristics of at least a first packet and a second packet of the plurality of packets;

reconstructing the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein reconstructing the one or more sessions includes identifying an originating host and a receiving host for the interactive or encrypted data;

identifying, by the passive vulnerability scanner, one or more potential vulnerabilities associated with the one or more reconstructed sessions; and

preparing, by the passive vulnerability scanner, a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities;

wherein the passive vulnerability scanner determines that the one or more sessions communicate encrypted data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise;

a randomization measure that satisfies a predetermined threshold, a compressed file type, or identification of a service that communicates encrypted data.

2. The method of claim 1, wherein reconstructing the one or more sessions further includes identifying a port or a service on the originating host that communicates the interactive or encrypted data between the originating host and the receiving host.

3. The method of claim 1, wherein reconstructing the one or more sessions further includes identifying a port or a service on the receiving host that communicates the interactive or encrypted data between the originating host and the receiving host.

4. The method of claim 1, wherein the passive vulnerability scanner determines that the one or more sessions communicate interactive data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise:

a size, frequency, inter-packet arrival time, or timing characteristic indicating that the one or more packets include data typed on a keyboard.

5. The method of claim 1, wherein the passive vulnerability scanner determines that the one or more sessions communicate interactive data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise:

identification of a Telnet service, identification of a chat service, identification of a Secure Shell service, or identification of another service that communicates data typed on a keyboard.

6. The method of claim 1, wherein the report indicates whether the one or more reconstructed sessions include internal sessions, outbound sessions, or inbound sessions.

7. The method of claim 6, wherein the report indicates that the reconstructed sessions include internal sessions in response to determining that the originating host and the receiving host have locations within the network.

8. The method of claim 6, wherein the report indicates that the reconstructed sessions include outbound sessions in response to determining that the originating host has a location within the network and that the receiving host has a location remote from the network.

9. The method of claim 6, wherein the report indicates that the reconstructed sessions include inbound sessions in response to determining that the originating host has a location remote from the network and that the receiving host has a location within the network.

10. The method of claim 1, wherein the report further describes one or more ports and one or more services that communicate the interactive or encrypted data between the originating host and the receiving host.

11. A system for passively identifying encrypted and interactive network sessions, comprising:

a network that includes a plurality of hosts; and

a passive vulnerability scanner that observes a plurality of packets travelling across the network during one or more sessions on the network, wherein the passive vulnerability scanner is configured to;

sniff the plurality of packets that travel across the network during the one or more sessions on the network,

determine whether the one or more sessions communicate interactive or encrypted data based on a comparison of one or more characteristics of at least a first packet and a second packet of the plurality of packets;

reconstruct the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein the one or more reconstructed sessions identify an originating host and a receiving host for the interactive or encrypted data;

identify one or more potential vulnerabilities associated with the one or more reconstructed sessions; and

prepare a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities, wherein the report further identifies one or more ports and one or more services that communicate the interactive or encrypted data between the originating host and the receiving host;

wherein the passive vulnerability scanner determines that the one or more sessions communicate encrypted data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise;

a randomization measure that satisfies a predetermined threshold, a compressed file type, or identification of a service that communicates encrypted data.

12. The system of claim 11, wherein the one or more reconstructed sessions further identify a port or a service on the originating host that communicates the interactive or encrypted data between the originating host and the receiving host.

13. The system of claim 11, wherein the one or more reconstructed sessions further identify a port or a service on the receiving host that communicates the interactive or encrypted data between the originating host and the receiving host.

14. The system of claim 11, wherein the passive vulnerability scanner determines that the one or more sessions communicate interactive based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise:

a size, frequency, inter-packet arrival time, or timing characteristic indicating that the one or more packets include data typed on a keyboard.

15. The system of claim 11, wherein the passive vulnerability scanner determines that the one or more sessions communicate interactive data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise:

identification of a Telnet service, identification of a chat service, identification of a Secure Shell service, or identification of another service that communicates data typed on a keyboard.

16. The system of claim 11, wherein the passive vulnerability scanner is further configured to determine that the reconstructed sessions include internal sessions in response to the originating host and the receiving host having locations within the network.

17. The system of claim 11, wherein the passive vulnerability scanner is further configured to determine that the reconstructed sessions include outbound sessions in response to the originating host having a location within the network and the receiving host having a location remote from the network.

18. The system of claim 11, wherein the passive vulnerability scanner is further configured to determine that the reconstructed sessions include inbound sessions in response to the originating host having a location remote from the network and the receiving host having a location within the network.