Patent ID: 9210135
Filing Date: 2015-12-08
Classification: H04L

Abstract:
1. A method for improving monitoring packets of data over a network, wherein at least one network device that includes a hardware processor that executes software code that performs actions, comprising: passively monitoring at least one flow of packets for a session between at least two endpoints; when the at least one monitored flow is encrypted, employing a block decryption key to decrypt the encrypted monitored flow; determining an initialization vector based on a complete block of the at least one encrypted monitored flow after detecting a hole; employing the initialization vector to continue decryption of the encrypted monitored flow after detecting the complete block; and when generating information from the at least one monitored flow is desynchronized based on at least detection of the hole, re-synchronizing the generating of information based at least on resuming generating information at a downstream position that is based on at least one aspect of the hole; and wherein resuming generating information includes employing heuristics to provide a probability estimate that one or more known protocol sequences is uniquely identified in the monitored flow and employing a machine learning probability to determine data patterns of a communication boundary that provides for resynchronization of the one or more known protocol sequences in the monitored flow.