Patent ID: 8782794

Claim:
A computer assisted method for detecting encrypted tunneling comprising: electronically receiving information from a proxy server; extracting information regarding a CONNECT function of Hyper Text Transport Protocol (HTTP) from the electronically received information; determining at least one destination to which the extracted information regarding the CONNECT function of HTTP corresponds; attempting to negotiate a standard Hyper Text Transport Protocol Secure (HTTPS) session with each of the at least one destination; for each of the at least one destination, determining if a Secure Socket Layer (SSL) certificate associated with the destination has been issued by a trusted certificate authority; determining whether the destination is hosting an encrypted tunneling application, wherein the determining whether the destination is hosting an encrypted tunneling application includes: identifying a plurality of characteristics of the SSL certificate; comparing the plurality of characteristics of the SSL certificate with a list of authentic characteristics to determine whether the SSL certificate is authentic; wherein identifying the plurality of characteristics includes determining at least a name of at least one of: to whom the SSL certificate was issued and who issued the SSL certificate; and identifying, based on the identified plurality of characteristics of the SSL certificate, a type of encrypted tunneling application associated with the at least one destination.