Cisco Technology, Inc.

Scott William Dunlop

Blake Harrell Anderson

David A McGrew

Martin Rehak

Andrew Chi

David Mcgrew

In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.

Endpoint-assisted inspection of encrypted network traffic

In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Passive decryption of encrypted traffic to generate more accurate machine learning training data

Passive decryption on encrypted traffic to generate more accurate machine learning training data

Growing community of inventors

Des Moines, WA, United States of America

Scott William Dunlop