Discovery of the use of anonymizing proxies by analysis of HTTP cookies

• US 8,266,687 B2
• Filed: 03/27/2009
• Issued: 09/11/2012
• Est. Priority Date: 03/27/2009
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Baldry, Richard J.
• Primary Examiner(s): Cervetti, David García
• Assistant Examiner(s): Abedin, Shanto M
• Application Number:
  US12/412,415
• Publication Number:
  US 20100251366A1
• Time in Patent Office: 1,264 Days
• Field of Search: 713/154, 713/161, 713/168, 713/182, 713/185, 726/1, 726/2, 726/3, 726/12, 726/14, 726/21, 726/22, 726/23, 726/24, 726/25, 709/227, 709/224
• US Class Current: 726/12
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00

Abstract

In embodiments of the present invention improved capabilities are described for systems, methods, and devices that determine whether a website request is from a proxy website or an anonymizer. Embodiments intercept a website request from an end point; identify at least one cookie present in said website request; analyze a predetermined characteristic of said website request, where the predetermined characteristic associated with the cookie; and apply a rule corresponding to said predetermined characteristic to make the determination as to whether the request is from a proxy website or anonymizer.

Claims

1. A computer program product stored in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:

a. intercepting a website request from an end point;

b. identifying at least one cookie present in said website request;

c. analyzing a predetermined characteristic of said website request, said predetermined characteristic associated with said at least one cookie, wherein the step of analyzing includes detecting a monotonic growth in said at least one cookie;

d. applying a rule corresponding to said predetermined characteristic of said cookie; and

e. determining whether the website request is an anonymizing proxy website request based on an application of said rule.

2. The computer program product of claim 1, wherein said step of analyzing a predetermined characteristic comprises at least one of:

a. determining a number of characters in said at least one cookie'"'"'s name;

b. determining a number of characters in said at least one cookie'"'"'s data values;

c. determining a number of cookies;

d. determining the type of growth of at least one of (i) said number of characters in said at least one cookie'"'"'s name, (ii) said number of characters in said at least one cookie'"'"'s data values, and (iii) said number of cookies present in said website request across multiple website requests from the same end point; and

e. determining encoding properties associated with said at least one cookie.

3. The computer program product of claim 2, wherein said step of analyzing a predetermined characteristic comprises determining whether said predetermined characteristic exceeds a predetermined threshold.

4. The computer program product of claim 3, wherein said predetermined threshold is maintained in a central policy and is disseminated to a plurality of end points.

5. The computer program product of claim 4, wherein said step of intercepting is performed on a gateway.

6. The computer program product of claim 4, wherein said step of intercepting is performed on a network appliance.

7. The computer program product of claim 4, wherein said step of intercepting is performed on a firewall.

8. The computer program product of claim 4, wherein said step of intercepting is performed on said end point.

9. The computer program product of claim 8, wherein said end point is a client computer.

10. The computer program product of claim 1, wherein said website request is in a form of a HTTP request.

11. The computer program product of claim 1, wherein said website request is in a form of a URL request.

12. The computer program product of claim 1, wherein said step of analyzing a predetermined characteristic further comprises comparing said predetermined characteristic with a predetermined value.

13. The computer program product of claim 1, wherein the step of analyzing a predetermined characteristic includes detecting an increase in a number of the at least one cookie.