Patent ID: 7979533

Claim:
A method, comprising: capturing messages in a message stream traversing a security boundary defining at least two sides with messages being captured in the message stream on each side of the security boundary, the at least two sides including an encrypted side and a plaintext side, the messages captured on the encrypted side being encrypted and the messages captured on the plaintext side having a plaintext format; extracting at least one message in an extensible markup language from the captured messages from at least the encrypted and plaintext sides of the security boundary to obtain a version of the extracted message from each side of the security boundary, wherein the messages are extracted by reassembling packets captured from the message stream into application level messages and identifying those application level messages that comprise top-level extensible markup language messages; applying a timestamp to each version of the extracted message in the extensible markup language; storing all timestamped versions of the extracted message with at least a first timestamped version of the message stored as a first set of data and at least a second timestamped version of the message stored as a second set of data; and correlating the first and second timestamped versions of the extracted message to detect changes between the two versions of the extracted message, wherein a detected change between the versions of the extracted message indicates that one of the versions has been tampered, wherein the first and second timestamped versions of the extract message are correlated by matching socket connections between the encrypted side version of the message to the plaintext side version of the message, wherein the encrypted side version of the message remains encrypted during the correlating.