Detecting proxy-based communications

• US 9,954,759 B2
• Filed: 07/29/2015
• Issued: 04/24/2018
• Est. Priority Date: 07/29/2015
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gilad, Yossi, Kohanim, Shahar
• Primary Examiner(s): Walsh, John B
• Application Number:
  US14/811,855
• Publication Number:
  US 20170034037A1
• Time in Patent Office: 1,000 Days
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

Evaluating communications via a computer network for the presence of proxy-based communications, by sending to a computer via a computer network multiple data packets followed by an out-of-sequence data packet that is out-of-sequence relative to any of the multiple data packets, receipt of the out-of-sequence data packet configured to cause the computer to send an acknowledgement via the computer network, and to cause the requestor to send a second data request via the computer and the computer network, detecting receipt of the acknowledgement at a first time, detecting receipt of the second data request at a second time, calculating a time delay between the first time and the second time, performing the sending, detecting and calculating steps multiple times for calculating multiple time delays, and determining whether the requestor is communicating via a proxy by evaluating the multiple time delays with respect to a predefined proxy evaluation criterion.

Claims

1. A system for detecting proxy-based communications via a computer network, the system comprising:

a communications manager configured to, in each of a plurality of iterations,

send to a computer via a computer network, a response to a first data request received from a requestor via the computer and the computer network, wherein the response includes a plurality of data packets followed by an out-of-sequence data packet that is out-of-sequence relative to any of the plurality of data packets,

wherein the communications manager is configured to designate, prior to sending any of the data packets to the computer, the out-of-sequence data packet to be sent to the computer after the plurality of data packets are sent to the computer,

wherein the out-of-sequence data packet is configured to cause the computer, responsive to receipt of the out-of-sequence data packet by the computer after receipt of the plurality of data packets by the computer, to send an acknowledgement via the computer network, and

wherein the out-of-sequence data packet is configured to cause the requestor, responsive to receipt of the out-of-sequence data packet by the requestor, and after receipt of the plurality of data packets by the requestor, to send a second data request via the computer and the computer network; and

a proxy detector configured to,

for each of the plurality of iterations,

detect receipt of the acknowledgement at a first time,

detect receipt of the second data request at a second time, and

calculate a time delay between the first time and the second time,

thereby calculating a plurality of time delays, and

determine whether the requestor is communicating via a proxy by evaluating the plurality of time delays with respect to a predefined proxy evaluation criterion,

wherein the communications manager and the proxy detector are implemented in any of

a) computer hardware, and

b) computer software embodied in a non-transitory, computer-readable storage medium.

2. The system according to claim 1 wherein the response includes a reference specifying a location of a resource on the computer network.

3. The system according to claim 2 wherein the reference is configured to cause the requestor to send the second data request to retrieve the resource from the location.

4. The system according to claim 1 wherein the plurality of data packets are configured to cause the requestor to send the second data request only after receipt of the out-of-sequence data packet by the requestor.

5. The system according to claim 1 wherein the proxy detector is configured to

determine a representative time delay from the plurality of time delays, and

determine that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications.

6. The system according to claim 1 wherein the proxy detector is configured to

determine an average delay time delay from the plurality of time delays,

determine a variance of the average time delay relative to the plurality of time delays,

determine an estimated distribution of the average time delay,

determine a probability that given the estimated distribution, a requestor-proxy round-trip time is greater than a predefined minimum requestor-proxy round-trip time, and

determine that the requestor is communicating via a proxy if the probability is greater than a predefined minimum value associated with proxy-based communications.

7. The system according to claim 1 wherein the proxy detector is configured to

determine an average delay time delay from the plurality of time delays,

determine a variance of the average time delay relative to the plurality of time delays,

determine an estimated distribution of the average time delay,

determine a probability that given the estimated distribution, a requestor-proxy round-trip time is greater than a predefined minimum requestor-proxy round-trip time, and

determine that the requestor is not communicating via a proxy if the probability is less than a predefined maximum value associated with non-proxy-based communications.

8. The system according to claim 1 and further comprising subjecting an activity involving the requestor to a security measure responsive to determining that the requestor is communicating via a proxy.

9. A computer program product for detecting proxy-based communications via a computer network, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the storage medium, wherein the computer-readable program code is configured to

a) send to a computer via a computer network, a response to a first data request received from a requestor via the computer and the computer network, wherein the response includes a plurality of data packets followed by an out-of-sequence data packet that is out-of-sequence relative to any of the plurality of data packets,

1) wherein the computer-readable program code is configured to designate, prior to sending any of the data packets to the computer, the out-of-sequence data packet to be sent to the computer after the plurality of data packets are sent to the computer,

2) wherein the out-of-sequence data packet is configured to cause the computer, responsive to receipt of the out-of-sequence data packet by the computer after receipt of the plurality of data packets by the computer, to send an acknowledgement via the computer network, and

3) wherein the out-of-sequence data packet is configured to cause the requestor, responsive to receipt of the out-of-sequence data packet by the requestor, and after receipt of the plurality of data packets by the requestor, to send a second data request via the computer and the computer network, and

b) for each of the plurality of iterations,

1) detect receipt of the acknowledgement at a first time,

2) detect receipt of the second data request at a second time, and

3) calculate a time delay between the first time and the second time,

thereby calculating a plurality of time delays, and

c) determine whether the requestor is communicating via a proxy by evaluating the plurality of time delays with respect to a predefined proxy evaluation criterion.

10. The computer program product according to claim 9 wherein the plurality of data packets are configured to cause the requestor to send the second data request only after receipt of the out-of-sequence data packet by the requestor.