Methods and systems for non-intrusive analysis of secure communications
View Patent ↗Methods and Systems for non-intrusive real-time analysis of secure communications between a first application and a second application, wherein the first and second applications communicate through a communication channel. A plurality of secure communications between the first application and the second application is non-intrusively and securely captured. The plurality of communications is processed to process communications from a physical layer to a network layer. The plurality of communications is grouped into a plurality of streams and connection meta information is added to each stream, wherein each stream represents a single network connection. A plurality of transactions is created from the communications included in the plurality of streams, wherein a stream within the plurality of streams is encrypted, and the encrypted stream is decrypted.
1. A method for non-intrusive real-time analysis of secure communications between at least one first application and at least one second application, wherein the first and second applications communicate through a communication channel, comprising:
non-intrusively and securely capturing a plurality of secure communications between the at least one first application and the at least one second application;
processing the plurality of communications to process communications from at least one physical layer to at least one network layer;
grouping the plurality of communications into a plurality of streams and adding connection meta information to each stream, wherein each stream represents a single network connection;
creating a plurality of transactions from the communications included in the plurality of streams, wherein at least one stream within the plurality of streams is encrypted; and
decrypting the at least one encrypted stream.
2. The method of claim 1 , wherein processing the plurality of communications further comprises forming a first plurality of information units, wherein each information unit comprises application level information, identification data, and monitoring data.
3. The method of claim 2 , wherein each information unit comprises a transaction.
4. The method of claim 1 , wherein the analyzing comprises performing processing associated with parsing the application level information of at least one of a second plurality of information units.
5. The method of claim 1 , wherein the decrypting further comprises performing processing associated with generating a session key from a previously provided pre-master secret.
6. The method of claim 1 , further comprising performing processing associated with using the hierarchical data structure with a plug-in monitoring application selected from: a session visualization application, a statistics module, a monitoring and alerting module, test script generation module, a service level validation module, a click path analysis module, or a customer support assistance application, or any combination thereof.
7. A system for non-intrusive real-time analysis of secure communications between a first application and a second application, wherein the first and second applications communicate through a communication channel, comprising:
a processor configured for:
non-intrusively and securely capturing a plurality of secure communications between at least one first application and at least one second application;
processing the plurality of communications to process communications from at least one physical layer to at least one network layer;
grouping the plurality of communications into a plurality of streams and adding connection meta information to each stream, wherein each stream represents a single network connection;
creating a plurality of transactions from the communications included in the plurality of streams, wherein at least one stream within the plurality of streams is encrypted; and
decrypting the at least one encrypted stream.
8. The system of claim 7 , wherein processing the plurality of communications further comprises forming a first plurality of information units, wherein each information unit comprises application level information, identification data, and monitoring data.
9. The system of claim 8 , wherein each information unit comprises a transaction.
10. The system of claim 7 , wherein the analyzing comprises performing processing associated with parsing the application level information of at least one of a second plurality of information units.
11. The system of claim 7 , wherein the decrypting further comprises performing processing associated with generating a session key from a previously provided pre-master secret.
12. The system of claim 7 , further comprising performing processing associated with using the hierarchical data structure with a plug-in monitoring application selected from: a session visualization application, a statistics module, a monitoring and alerting module, test script generation module, a service level validation module, a click path analysis module, or a customer support assistance application, or any combination thereof.