DETECTING PROXY-BASED COMMUNICATIONS

• US 20150281261A1
• Filed: 03/26/2014
• Published: 10/01/2015
• Est. Priority Date: 03/26/2014
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Regev, Shmulik, Kohanim, Shahar T.
• Application Number:
  US14/225,945
• Publication Number:
  US 20150281261A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Detecting proxy-based communications by determining a plurality of time delays, determining a representative time delay from the plurality of time delays, and identifying the sender as a proxy by determining that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications.

Claims

1. A method for detecting proxy-based communications, the method comprising:

determining a plurality of time delays, wherein determining the plurality of time delays comprises, for each of the plurality of time delays;

detecting, by one or more processors, receipt of an acknowledgement at a first time, wherein the acknowledgement is responsive to a communication sent to a sender of the acknowledgement;

detecting, by one or more processors, receipt of a data request at a second time, wherein the data request is sent by the sender of the acknowledgement following the acknowledgement;

determining, by one or more processors, a time delay between the first time and the second time;

determining, by one or more processors, a representative time delay from the plurality of time delays; and

determining, by one or more processors, that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications, thereby identifying the sender as a proxy.

2. The method of claim 1, further comprising, prior to performing the detecting, a computer is configured with executable computer software instructions configured to send the data requests.

3. The method of claim 2, further comprising providing the executable computer software instructions to the computer.

4. The method of claim 3, wherein the providing comprises providing the executable computer software instructions within a web page.

5. The method of claim 1, further comprising providing a notification identifying the sender as a proxy.

6. The method of claim 5, further comprising subjecting an activity involving the sender to a security measure responsive to the notification.

7. A computer system for detecting proxy-based communications, the computer system comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising;

program instructions to determine a plurality of time delays, wherein the program instructions to determine the plurality of time delays comprise, for each of the plurality of time delays;

program instructions to detect receipt of an acknowledgement at a first time, wherein the acknowledgement is responsive to a communication sent to a sender of the acknowledgement;

program instructions to detect receipt of a data request at a second time, wherein the data request is sent by the sender of the acknowledgement following the acknowledgement;

program instructions to determine a time delay between the first time and the second time;

program instructions to determine a representative time delay from the plurality of time delays; and

program instructions to determine that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications, thereby identifying the sender as a proxy.

8. The computer system of claim 7, further comprising program instructions, stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, to, prior to performing the detecting, to configure a computer with executable computer software instructions configured to send the data requests.

9. The computer system of claim 8, further comprising program instructions, stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, to provide the executable computer software instructions to the computer.

10. The computer system of claim 9, wherein the program instructions to provide comprise program instructions to provide the executable computer software instructions within a web page.

11. The computer system of claim 7, further comprising program instructions, stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, to provide a notification identifying the sender as a proxy.

12. The computer system of claim 11, further comprising program instructions, stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, to subject an activity involving the sender to a security measure responsive to the notification.

13. A computer program product for detecting proxy-based communications, the computer program product comprising:

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media, the program instructions comprising;

program instructions to determine a plurality of time delays, wherein the program instructions to determine the plurality of time delays comprise, for each of the plurality of time delays;

program instructions to detect receipt of an acknowledgement at a first time, wherein the acknowledgement is responsive to a communication sent to a sender of the acknowledgement;

program instructions to detect receipt of a data request at a second time, wherein the data request is sent by the sender of the acknowledgement following the acknowledgement;

program instructions to determine a time delay between the first time and the second time;

program instructions to determine a representative time delay from the plurality of time delays; and

program instructions to determine that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications, thereby identifying the sender as a proxy.

14. The computer program product of claim 13, further comprising program instructions, stored on the one or more computer readable storage media, to, prior to performing the detecting, to configure a computer with executable computer software instructions configured to send the data requests.

15. The computer program product of claim 14, further comprising program instructions, stored on the one or more computer readable storage media, to provide the executable computer software instructions to the computer.

16. The computer program product of claim 15, wherein the program instructions to provide comprise program instructions to provide the executable computer software instructions within a web page.

17. The computer program product of claim 13, further comprising program instructions, stored on the one or more computer readable storage media, to provide a notification identifying the sender as a proxy.

18. The computer program product of claim 17, further comprising program instructions, stored on the one or more computer readable storage media, to subject an activity involving the sender to a security measure responsive to the notification.