System, device, and method for detection of proxy server

• US 10,834,090 B2
• Filed: 11/06/2019
• Issued: 11/10/2020
• Est. Priority Date: 07/09/2015
• Status: Active Grant

• Current Assignee: Biocatch Ltd.
• Original Assignee: Biocatch Ltd.
• Inventors: Turgeman, Avi, Lehmann, Yaron, Azizi, Yaron, Novick, Itai
• Primary Examiner(s): Gracia, Gary S
• Application Number:
  US16/675,238
• Publication Number:
  US 20200076816A1
• Time in Patent Office: 370 Days
• CPC Class Codes: H04L 1/1664 the supervisory signal being transmitted together with payload signals; piggybacking
• CPC Class Codes: H04L 2001/0097 Relays
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/283 in response to processing delays, e.g. caused by jitter or round trip time [RTT]
• CPC Class Codes: H04L 5/0055 Physical resource allocation for ACK/NACK for physical mapping arrangements in ARQ protocols H04L1/1861
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/61 Time-dependent

Abstract

Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Claims

1. A system comprising:

a proxy server detector apparatus, able to determine that a proxy server is utilized by an end-user using an end-user device over a communication network for accessing a trusted server;

wherein the proxy server detector apparatus is configured to determine whether;

(I) the end-user device is communicating indirectly with the trusted server via the proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;

wherein the proxy server detector apparatus comprises;

a preferred-language extractor to extract, locally at the end-user device, an identifier of a preferred natural language that is reported locally at the end-user device;

a geo-location mismatch detector, to detect that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) a geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device;

wherein the proxy server detector apparatus determines that said proxy server exists, between the end-user device and the trusted server, based on a determination that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) the geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device.

2. A system comprising:

a proxy server detector apparatus, able to determine that a proxy server is utilized by an end-user using an end-user device over a communication network for accessing a trusted server;

wherein the proxy server detector apparatus is configured to determine whether;

(I) the end-user device is communicating indirectly with the trusted server via the proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;

wherein the proxy server detector apparatus comprises;

an HTTP-header duplicator to modify an original HTTP header, that is intended for transmission to the end-user device, into a duplicate HTTP header that comprises two or more duplicate copies of said original HTTP header;

wherein the proxy server detector apparatus perform an evaluation of a response of the end-user device to said duplicate HTTP header, and to determine whether or not a the proxy server exists, between the end-user device and the trusted server, based on said evaluation results;

wherein, if the proxy server detector apparatus evaluates that no error signal was received back from the end-user device in response to the duplicate

HTTP header, then the proxy server detector apparatus is to determine that a proxy server exists;

wherein, if the proxy server detector apparatus evaluates that an error signal was received back from the end-user device in response to the duplicate HTTP header, then the proxy server detector apparatus is to determine that a proxy server does not exist.