Methods and systems for non-intrusive analysis of secure communications

• US 10,193,870 B2
• Filed: 08/10/2015
• Issued: 01/29/2019
• Est. Priority Date: 05/28/2003
• Status: Expired due to Fees

• Current Assignee: Borland Software Corporation (Open Text Corporation)
• Original Assignee: Borland Software Corporation (Open Text Corporation)
• Inventors: Greifeneder, Bernd, Reichl, Bernhard, Spiegl, Helmut, Schwarzbauer, Gunter
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US14/822,430
• Publication Number:
  US 20160036787A1
• Time in Patent Office: 1,268 Days
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Method and system, comprising: capturing a plurality of secure communications between the first application and the second application; grouping the plurality of communications into one or more streams, each stream representing a network connection; and processing the one or more streams in parallel to create a plurality of transactions.

Claims

1. A method, comprising:

capturing a plurality of secure communications between a first application and a second application;

grouping the plurality of communications into one or more streams, each stream representing a different network connection between the first application and the second application; and

processing the one or more streams in parallel to create a plurality of transactions with each transaction representing a pair of information comprising a request and a response to that request, and wherein processing further includes hierarchically reconstructing a session representing the transactions and creating a script for recreating the session for analysis by looking for references to a particular transaction of a particular stream within another transaction of another stream, wherein the session representing a set of all transactions between the first application and the second application.