IDS, IPS and encrypted traffic

[Daniel Hamburg <daniel.hamburg () iis rub de>]

Hello everybody,

I’ve been looking around the net for a while, trying to find some theoretical and practical approaches to solve the 
problem of analyzing encrypted traffic.

I know, that there is a need to decrypt the traffic before analyzing it, but I haven’t found any concrete solutions 
neither for NIDS nor for HIDS yet. Some HIDS vendors announced that their products are capable of analyzing encrypted 
traffic, but I didn’t succeed to find any details about that.

Does anybody know some products or papers which deal with the problem of analyzing encrypted traffic?

Thanks in advance,
 Daniel Hamburg


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------