Detecting proxy-based communications

• US 9,985,865 B2
• Filed: 11/23/2015
• Issued: 05/29/2018
• Est. Priority Date: 07/29/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gilad, Yossi, Kohanim, Shahar
• Primary Examiner(s): Walsh, John B
• Application Number:
  US14/948,427
• Publication Number:
  US 20170034029A1
• Time in Patent Office: 918 Days
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

Evaluating communications via a computer network for the presence of proxy-based communications, by sending to a computer via a computer network multiple data packets followed by an out-of-sequence data packet that is out-of-sequence relative to any of the multiple data packets, receipt of the out-of-sequence data packet configured to cause the computer to send an acknowledgement via the computer network, and to cause the requestor to send a second data request via the computer and the computer network, detecting receipt of the acknowledgement at a first time, detecting receipt of the second data request at a second time, calculating a time delay between the first time and the second time, performing the sending, detecting and calculating steps multiple times for calculating multiple time delays, and determining whether the requestor is communicating via a proxy by evaluating the multiple time delays with respect to a predefined proxy evaluation criterion.

Claims

1. A computer-implemented method for evaluating communications via a computer network for the presence of proxy-based communications, the method comprising:

sending to a computer via a computer network, a response to a first data request received from a requestor via the computer and the computer network, wherein the response includes a plurality of data packets followed by an out-of-sequence data packet that is out-of-sequence relative to any of the plurality of data packets,

wherein prior to sending any of the data packets to the computer, designation is made of the out-of-sequence data packet to be sent to the computer after the plurality of data packets are sent to the computer,

wherein the out-of-sequence data packet is configured to cause the computer, responsive to receipt of the out-of-sequence data packet by the computer after receipt of the plurality of data packets by the computer, to send an acknowledgement via the computer network, and

wherein the out-of-sequence data packet is configured to cause the requestor, responsive to receipt of the out-of-sequence data packet by the requestor, and after receipt of the plurality of data packets by the requestor, to send a second data request via the computer and the computer network;

detecting receipt of the acknowledgement at a first time;

detecting receipt of the second data request at a second time;

calculating a time delay between the first time and the second time;

performing the sending, detecting and calculating steps a plurality of times, thereby calculating a plurality of time delays; and

determining whether the requestor is communicating via a proxy by evaluating the plurality of time delays with respect to a predefined proxy evaluation criterion.

2. The computer-implemented method according to claim 1 wherein the sending comprises sending the response including a reference specifying a location of a resource on the computer network.

3. The computer-implemented method according to claim 2 wherein the sending comprises sending wherein the reference is configured to cause the requestor to send the second data request to retrieve the resource from the location.

4. The computer-implemented method according to claim 1 wherein the sending comprises sending wherein the plurality of data packets are configured to cause the requestor to send the second data request only after receipt of the out-of-sequence data packet by the requestor.

5. The computer-implemented method according to claim 1 wherein the determining comprises:

determining a representative time delay from the plurality of time delays; and

determining that the representative time delay is consistent with a predefined time delay that is associated with proxy-based communications.

6. The computer-implemented method according to claim 1 wherein the determining comprises:

determining an average delay time delay from the plurality of time delays;

determining a variance of the average time delay relative to the plurality of time delays;

determining an estimated distribution of the average time delay;

determining a probability that given the estimated distribution, a requestor-proxy round-trip time is greater than a predefined minimum requestor-proxy round-trip time; and

determining that the requestor is communicating via a proxy if the probability is greater than a predefined minimum value associated with proxy-based communications.

7. The computer-implemented method according to claim 1 wherein the determining comprises:

determining an average delay time delay from the plurality of time delays;

determining a variance of the average time delay relative to the plurality of time delays;

determining an estimated distribution of the average time delay;

determining a probability that given the estimated distribution, a requestor-proxy round-trip time is greater than a predefined minimum requestor-proxy round-trip time; and

determining that the requestor is not communicating via a proxy if the probability is less than a predefined maximum value associated with non-proxy-based communications.

8. The computer-implemented method according to claim 1 and further comprising subjecting an activity involving the requestor to a security measure responsive to determining that the requestor is communicating via a proxy.