Patent ID: 8341724

Claim:
A method comprising: receiving a network packet; determining whether the packet represents a key exchange, identifying a key exchange for a communication session for the packet, making a record of the key exchange for the communication session after identifying the key exchange, using an application-layer header of the packet, determining whether the packet is associated with an identifiable network application; when the packet is not determined to be associated with an identifiable network application, determining whether data in the packet is encrypted by calculating a randomness value of the packet from a payload of the packet that includes the application-layer header and an application-layer payload and determining that the packet is encrypted when the randomness value exceeds a randomness threshold; and when the data in the packet is determined to be encrypted, executing a programmed response, wherein executing a programmed response comprises: determining whether a key exchange has been recorded for the communication session associated with the packet; and when a key exchange has not been recorded, dropping the packet, and when a key exchange has been recorded, forwarding the packet.