System and method for identifying exchanges of encrypted communication traffic

1. A system, comprising:

a peripheral device; and

a processor, configured to:

compute a measure of similarity between (i) a first estimated size of a first encrypted file content transferred over a network, via a first application on a first user device, over a first connection between the first user device and a first application server servicing the first application, and (ii) a second estimated size of a second encrypted file transferred over the network, via a second application on a second user device, over a second connection between the second user device and a second application server servicing the second application,

based on the measure of similarity, posit that the first encrypted file content and the second encrypted file content represent the same file, and

in response to the positing, generate an output to the peripheral device.

2. The system according to claim 1 , wherein the first estimated size and the second estimated size are expressed as respective probability distributions.

3. The system according to claim 1 ,

wherein the first encrypted file content was uploaded by the first user device at a first time,

wherein the second encrypted file content was downloaded by the second user device at a second time subsequent to the first time,

wherein the processor is further configured to compute a difference between the second time and the first time, and

wherein the processor is configured to generate the output responsively to the difference being less than a predefined threshold.

4. The system according to claim 3 , wherein the processor is configured to generate the output by increasing a relatedness score between a first user of the first user device and a second user of the second user device.

5. The system according to claim 1 ,

wherein the first encrypted file content was downloaded by the first user device at a first time,

wherein the second encrypted file content was downloaded by the second user at a second time subsequent to the first time,

wherein the processor is configured to generate the output in response to a metadata link having been communicated by the first user device between the first time and the second time, and

wherein the output indicates that the metadata link pointed to the file and was communicated to the second user device.

6. The system according to claim 1 , wherein the output indicates that a first user communicated the file to a second user, and wherein the processor is configured to generate the output in response to a relatedness score between the first user and the second user.

7. The system according to claim 1 , wherein the processor is further configured to identify a frequency with which files having the first estimated size are communicated over the network, and wherein the processor is configured to posit that the first encrypted file content and the second encrypted file content represent the same file with a likelihood that decreases with the frequency.

8. The system according to claim 1 ,

wherein the first encrypted file content was downloaded by the first user device at a first time,

wherein the second encrypted file content was downloaded by the second user device at a second time,

wherein the processor is further configured to compute a difference between the first time and the second time, and

wherein the processor is configured to generate the output responsively to the difference being less than a predefined threshold.

9. The system according to claim 1 , wherein the processor is further configured to:

receive a query specifying a second-file-content transfer of the second encrypted file content, and

identify a first-file-content transfer of the first encrypted file content in response to the query,

wherein the processor is configured to compute the measure of similarity in response to identifying the first-file-content transfer, and

wherein the output includes parameters of the first-file-content transfer.

10. The system according to claim 9 ,

wherein the second-file-content transfer was performed using a class of applications, and

wherein the processor is configured to identify the first-file-content transfer of the first encrypted file content by:

retrieving, from a database, multiple other-file-content transfers of other encrypted file content, which were performed using the class of applications, and

identifying the first-file-content transfer from among the other-file-content transfers.

11. The system according to claim 9 , wherein the processor is further configured to:

identify multiple other-file-content transfers of other encrypted file content in response to the query, and

posit that the file was transferred in each of the other-file-content transfers,

wherein the processor is configured to generate the output by outputting a timeline of the other-file-content transfers and the first-file-content transfer.

12. A system, comprising:

at least one network tap;

a data storage; and

a processor, configured to:

receive, through the at least one network tap, encrypted communication traffic passed over multiple connections, each of the connections being between a) one of a plurality of user devices and b) one of one or more servers, each server servicing an application on the user device connected thereto;

by analyzing the encrypted communication traffic, without decrypting the traffic, posit that at least one file was transferred over one connection of the connections,

in response to the positing, group encrypted packets belonging to the connection into at least one sequence,

compute an estimated size of the file, based on respective sizes of those of the packets belonging to the sequence, and

store the estimated size in the data storage.

13. The system according to claim 12 , wherein the processor is configured to posit that the file was transferred over the connection in response to identifying, in one of the packets, an identifier of a server known to service file exchanges.

14. The system according to claim 12 , wherein the processor is configured to posit that the file was transferred over the connection in response to an indication in one of the packets or in another packet that the connection was made by an application used for file transfers.

15. The system according to claim 14 , wherein the indication includes a specification of a protocol used by a class of applications used for file transfers.

16. The system according to claim 12 , wherein the processor is configured to group the packets by demarcating between the sequence and others of the packets that were communicated in the same direction as was the sequence.

17. The system according to claim 16 , wherein the processor is configured to demarcate between the sequence and the others of the packets based on a time gap between the sequence and a closest one of the others of the packets.

18. The system according to claim 16 , wherein the processor is configured to demarcate between the sequence and the others of the packets based on a decrease in throughput at an end of the sequence.

19. The system according to claim 12 , wherein the processor is configured to compute the estimated size of the file by:

computing a sum of the respective sizes, and

computing the estimated size of the file by dividing the computed sum by a predefined packet-size inflation divisor that is greater than one.

20. The system according to claim 19 , wherein the predefined packet-size inflation divisor is expressed as a probability distribution, such that the processor is configured to compute the estimated size as another probability distribution.

21. The system according to claim 19 ,

wherein the sequence was downloaded by one of the user devices, and

wherein the processor is further configured to, prior to computing the estimated size of the file:

identify another sequence of other packets downloaded by the user device,

compute another sum of respective sizes of the other packets,

posit that the other sequence carried another file having a known size, and

in response to the positing, compute the packet-size inflation divisor by dividing the other sum by the known size.

22. The system according to claim 19 , wherein the sequence was exchanged between one of the servers and the user device connected thereto, and wherein the processor is further configured to, prior to computing the estimated size of the file:

infer one or more parameters from one or more of the connections belonging to the user device, and

select the packet-size inflation divisor from multiple predefined inflation divisors, based on a predefined association between the packet-size inflation divisor and the parameters.

23. The system according to claim 19 ,

wherein the sequence was uploaded by one of the user devices, and

wherein the processor is further configured to, prior to computing the estimated size of the file:

identify, with respective levels of confidence, instances in which respective other files were communicated from the user device to respective other user devices, and

based on the identified instances and on a predefined distribution of another packet-size inflation divisor for downloads, compute the packet-size inflation divisor.

24. A method, comprising:

computing a measure of similarity between (i) a first estimated size of first encrypted file content transferred over a network, via a first connection between a first user device and a first application server servicing an application on the first user device, and (ii) a second estimated size of second encrypted file content transferred over the network, via a second connection between a second user device and a second application server servicing an application on the second user device;

based on the measure of similarity, positing that the first encrypted file content and the second encrypted file content represent the same file; and

in response to the positing, generating an output.