IP Library › Granted Patent US 9,838,356

Granted Patent B2

US 9,838,356 · App. 15/421,013 · Granted Dec 5, 2017

Encrypted peer-to-peer detection

Inventors: Shadi Rostami-Hesarsorkh (Los Altos, CA); Huagang Xie (Pleasanton, CA)

Assignee: Palo Alto Networks, Inc.

H04L63/0227 H04L43/08 H04L63/0428 H04L67/104

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 9,838,356
App. No.: 15/421,013
Granted: Dec 5, 2017
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Encrypted peer-to-peer detection is provided. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a first client to determine whether the first client is executing a peer-to-peer application; and generating network traffic that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting unknown network traffic sent from the first client to the second client. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a client to determine that the client is sending a request for information for a peer-to-peer application executing on the client; and generating a network traffic response to the client that emulates peer-to-peer network traffic.

Claims (57)

1. A system, comprising:

a processor configured to:

monitor a network traffic sent from a first client to determine whether the first client is executing a peer-to-peer application; and

generate a network traffic emulating peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client, wherein generating the network traffic emulating the peer-to-peer network traffic comprises:

send, to the second client, the emulated peer-to-peer network traffic identifying non-existent peers or spoofed peers, wherein the emulated peer-to-peer network traffic identifying the non-existent peers or the spoofed peers indicates that the emulated peer-to-peer network traffic originated from a non-existent peer; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the monitored network traffic is unencrypted, wherein the first client is determined to be executing the peer-to-peer application using a protocol based signature, and wherein the peer-to-peer application matches a firewall policy.

3. The system recited in claim 1 , wherein the unknown network traffic is encrypted network traffic.

4. The system recited in claim 1 , wherein the peer-to-peer application is used for file sharing and communicates data using encrypted communications.

5. The system recited in claim 1 , wherein the peer-to-peer application is used for voice over Internet protocol (VOIP) calls and communicates data using encrypted communications.

6. The system recited in claim 1 , wherein the generated network traffic is sent from a security appliance including a firewall function, wherein the first client is located within a network perimeter protected by the security appliance, wherein the peer-to-peer application violates a firewall policy stored on the security appliance, and wherein the generated network traffic is sent using an IP address associated with the security appliance and a port number selected by the security appliance for communicating with the second client to poison traffic associated with the peer-to-peer application executing on the first client.

7. The system recited in claim 1 , wherein a monitored session between the first client and the second client is classified as being associated with the peer-to-peer application, and wherein the processor is further configured to:

cache in a peer-to-peer mapping store a determination that the monitored session between the first client and the second client is associated with the peer-to-peer application.

8. The system recited in claim 1 , wherein the processor is further configured to:

monitor responses from the second client to the generated network traffic emulating the peer-to-peer network traffic.

9. The system recited in claim 1 , wherein the processor is further configured to:

monitor responses from the second client to the generated network traffic emulating the peer-to-peer network traffic; and

determine whether the second client is executing the peer-to-peer application based on the monitored responses from the second client.

10. The system recited in claim 1 , wherein the processor is further configured to:

monitor responses from the second client to the generated network traffic emulating the peer-to-peer network traffic;

determine whether the second client is executing the peer-to-peer application based on the monitored responses from the second client; and

classify a monitored session between the first client and the second client as associated with the peer-to-peer application.

11. The system recited in claim 1 , wherein the processor is further configured to:

monitor responses from the second client to the generated network traffic emulating the peer-to-peer network traffic;

determine whether the second client is executing the peer-to-peer application based on the monitored responses from the second client; and

classify a monitored session between the first client and the second client as associated with the peer-to-peer application, wherein the monitored session is identified using a 3-tuple, including an identifier of the first client, a protocol type, and a port number.

12. The system recited in claim 1 , wherein the processor is further configured to:

report that the first client was determined to be executing the peer-to-peer application, wherein the report includes associated session information, including an identifier for the first client, a protocol type, and a port number.

13. The system recited in claim 1 , wherein the processor is further configured to:

notify a security cloud service that the second client was determined to be executing the peer-to-peer application.

14. The system recited in claim 1 , wherein the processor is further configured to:

notify a security cloud service that the first client was determined to be executing the peer-to-peer application.

15. The system recited in claim 1 , wherein the processor is further configured to:

notify a host-based security function executing on the first client that the first client was determined to be executing the peer-to-peer application.

16. The system recited in claim 1 , wherein the processor is further configured to:

send a notification message to a host-based security function executing on the first client that the first client was determined to be executing the peer-to-peer application, wherein the notification message includes a port number associated with a current session determined to be associated with the peer-to-peer application.

17. The system recited in claim 1 , wherein the processor is further configured to:

18. The system recited in claim 1 , wherein the processor is further configured to:

19. The system recited in claim 1 , wherein the processor is further configured to:

20. The system recited in claim 1 , wherein the processor is further configured to:

send a notification message to a user of the first client, wherein the notification message includes information regarding a policy related to using the peer-to-peer application.

21. The system recited in claim 1 , wherein the processor is further configured to:

send a notification message to a network administrator or a security administrator that the first client was determined to be executing the peer-to-peer application.

22. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the first client is executing the peer-to-peer application; and

block traffic sent from the peer-to-peer application.

23. A method, comprising:

monitoring a network traffic sent from a first client to determine whether the first client is executing a peer-to-peer application; and

generating a network traffic, using a processor, emulating peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client, wherein generating the network traffic emulating the peer-to-peer network traffic comprises:

sending, to the second client, the emulated peer-to-peer network traffic identifying non-existent peers or spoofed peers, wherein the emulated peer-to-peer network traffic identifying the non-existent peers or the spoofed peers indicates that the emulated peer-to-peer network traffic originated from a non-existent peer.

24. A computer program being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

monitoring a network traffic sent from a first client to determine whether the first client is executing a peer-to-peer application; and

generating a network traffic emulating peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting an unknown network traffic sent from the first client to the second client, wherein generating the network traffic emulating the peer-to-peer network traffic comprises:

Continuity (3)

Continuation 14513055 · Oct 13, 2014

Continuation 13115025 · May 24, 2011

Related Publication 20170208034A1 · Jul 20, 2017