METHODS AND SYSTEMS FOR DETERMINING DOMAIN NAMES AND ORGANIZATION NAMES ASSOCIATED WITH PARTICIPANTS INVOLVED IN SECURED SESSIONS

摘要

An apparatus is provided for determining at least one of a domain name and an organization name associated with a server. The apparatus can include a traffic processor configured to acquire one or more handshake messages associated with establishing or resuming a secure session with the server. The apparatus can also include a site detector configured to determine whether the one or more handshake messages include one or more site textual identifiers. If the one or more handshake messages does not include one or more site textual identifiers, the site detector is configured to acquire the at least one of a domain name and an organization name based on querying a historical identification database using at least one of a session identifier and an IP address associated with the server.