Patent ID: 8707440

Claim:
A method for passively identifying encrypted and interactive network sessions, comprising: observing, by a passive vulnerability scanner, activity on a network, wherein the activity includes a plurality of packets that travel across the network during one or more sessions on the network; sniffing, by the passive vulnerability scanner, the plurality of packets that travel across the network during the one or more sessions on the network; determining, by the passive vulnerability scanner, whether the one or more sessions communicate interactive or encrypted data based on a comparison of one or more characteristics of at least a first packet and a second packet of the plurality of packets; reconstructing the one or more sessions in response to the passive vulnerability scanner determining that the one or more sessions communicate interactive or encrypted data, wherein reconstructing the one or more sessions includes identifying an originating host and a receiving host for the interactive or encrypted data; identifying, by the passive vulnerability scanner, one or more potential vulnerabilities associated with the one or more reconstructed sessions; and preparing, by the passive vulnerability scanner, a report describing the one or more reconstructed sessions and the one or more potential vulnerabilities; wherein the passive vulnerability scanner determines that the one or more sessions communicate encrypted data based on one or more similarities of one or more characteristics of at least the first packet and the second packet, wherein the one or more characteristics comprise: a randomization measure that satisfies a predetermined threshold, a compressed file type, or identification of a service that communicates encrypted data.