Detecting relayed communications

• US 8,966,088 B2
• Filed: 01/09/2005
• Issued: 02/24/2015
• Est. Priority Date: 01/09/2004
• Status: Active Grant

• Current Assignee: Paypal Israel Ltd. (PayPal Holdings, Inc.)
• Original Assignee: Paypal Israel Ltd. (PayPal Holdings, Inc.)
• Inventors: Wilf, Saar, Shaked, Shvat
• Primary Examiner(s): MACILWINEN, JOHN MOORE JAIN
• Application Number:
  US10/585,517
• Publication Number:
  US 20090144408A1
• Time in Patent Office: 3,698 Days
• Field of Search: 709/227
• US Class Current: 709/227
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Methods, apparatus and computer readable code for determining whether a potential relay device is a relay device are provided herein. In some embodiments, first and second information elements are received from a potential relay device, which is an original source of the second information element. In order to determine whether the potential relay device is a relay device, it is determined whether a feature of an original source of the first information element and a feature of the potential relay device are features unlikely to relate to a single device, wherein a positive result of the determining is indicative that the potential relay device is a relay device. In an exemplary embodiment, a disclosed system includes an information element receiver and a feature incompatibility analyzer. Optionally, the disclosed system includes a feature discovery module, a parameter obtainer and a feature database.

Claims

1. A method of determining whether a potential relay device is a relay device, the method comprising:

receiving a communication from the potential relay device, the communication comprising a first information element and a second information element, wherein the potential relay device is an original source of said second information element;

identifying a feature of an original source of said first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element;

identifying a feature of the potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

determining, using a relay detection system implemented at least in part in hardware, that the feature of the original source of said first information element of said first information element and the feature of the potential relay device are features unlikely to relate to a single device, said determining being indicative that the potential relay device is a relay device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

2. The method of claim 1 wherein said second information element is of a type that a relay device of a class of relay devices is unlikely to relay.

3. The method of claim 2 wherein said class of relay devices is selected from the group consisting of a SOCKS proxy, an HTTP proxy using the GET method, an HTTP proxy using the CONNECT method, an IP router and a NAT device.

4. The method of claim 1 wherein said second information element is part of a communication, wherein the communication is of a type selected from the group consisting of IP, TCP, ICMP, DNS, HTTP, SMTP, TLS, and SSL.

5. The method of claim 1 wherein said first information element is part of a communication, wherein the communication is of a type selected from the group consisting of IP, TCP, ICMP, DNS, HTTP, SMTP, TLS, and SSL.

6. The method of claim 1 wherein said first and said second information elements are sent in two different layers of a protocol stack.

7. The method of claim 1 wherein said stage of determining further comprises:

comparing said feature of an original source of said first information element with said feature of the potential relay device.

8. The method of claim 1 further comprising:

obtaining a parameter indicative of said feature of an original source of said first information element; and

obtaining a parameter indicative of said feature of the potential relay device.

9. The method of claim 1 wherein said stage of determining further comprises:

considering a time at which at least one of said feature of an original source of said first information element and said feature of the potential relay device, was discovered.

10. The method of claim 1 further comprising:

obtaining a parameter indicative of a relationship between said feature of said original source of said first information element and said feature of the potential relay device.

11. The method of claim 10, wherein said stage of determining includes analyzing said parameter indicative of a relationship between said feature of said original source of said first information element and said feature of the potential relay device.

12. The method of claim 10 wherein said parameter is obtained from at least one of said first information element and said second information element.

13. The method of claim 1 further comprising:

sending an outgoing communication to at least one of said original source of said first information element and the potential relay device; and

receiving a third information element from said at least one of said original source of said first information element and the potential relay device.

14. The method of claim 13, further comprising:

deriving from said third information element information related to a feature of said at least one of said original source of said first information element and the potential relay device.

15. The method of claim 13 further comprising:

verifying that an original source of said third information element is said original source of said first information element.

16. The method of claim 13 further comprising:

verifying that an original source of said third information element is the potential relay device.

17. The method of claim 13 wherein said third information element is selected from the group consisting of an ICMP message, an ICMP Echo Reply message, a DNS query, an HTTP request, an HTTP response, an HTTP ‘

Server’

header, an IP address, a TCP port, a TCP Initial Sequence number, a TCP Initial Window, a WHOIS record, and a reverse DNS record.

18. The method of claim 1 wherein at least one of said feature of an original source of said first information element and said feature of the potential relay device is a feature related to a device configuration status including an indication of a type of hardware of the original source of said first information element or the potential relay device.

19. The method of claim 18 wherein said feature related to a device configuration status is selected from the group consisting of an operating system type, an operating system version, a software type, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting and a time zone setting.

20. The method of claim 19 wherein said determining includes examining a parameter indicative of said feature related to a device configuration status.

21. The method of claim 20 wherein said parameter is selected from the group consisting of an HTTP ‘

User-Agent’

header, an RFC 822 ‘

X-Mailer’

header, an RFC 822 ‘

Received’

header, an RFC 822 ‘

Date’

header, a protocol implementation manner, a TCP/IP stack fingerprint, an IP address, a TCP port, a TCP initial sequence number, a TCP initial window, a WHOIS record, and a reverse DNS record.

22. The method of claim 1 wherein at least one of said feature of a source of said first information element and said feature of the potential relay device is a feature related to communication performance.

23. The method of claim 22 wherein said feature related to communication performance is selected from the group consisting of a measured communication performance, a measured relative communication performance, and an estimated communication performance.

24. The method of claim 22 wherein said feature related to communication performance is selected from the group consisting of a latency of communication, a latency of an incoming communication, a latency of an outgoing communication, a round trip time of a communication, a communication rate, an incoming communication rate, an outgoing communication rate, a maximum communication rate, an incoming maximum communication rate, and an outgoing maximum communication rate.

25. The method of claim 22 wherein said determining includes examining a parameter indicative of said feature related to communication performance.

26. The method of claim 25 wherein said parameter is selected from the group consisting of time of receipt of an information element, time of sending of an information element, a round trip time, a round trip time gap, an IP address, a Who is record, a reverse DNS record, and a rate of acknowledged information.

27. The method of claim 26 wherein a higher round trip time gap is indicative of a higher likelihood that a relay device is being used for malicious purposes.

28. The method of claim 22, wherein said feature related to communication performance is estimated from information about at least one of said original source of said first communication and the potential relay device.

29. The method of claim 28, wherein said information about at least one of said original source of said first communication and the potential relay device is selected from the group consisting of a location of a device, a reverse DNS record of a device'"'"'s IP address, and an administrator of a device.

30. The method of claim 1 wherein at least one of said feature of an original source of said first information element and said feature of the potential relay device is selected from the group consisting of a subnetwork, an administrator, and a location.

31. The method of claim 30 wherein said determining includes examining a parameter indicative of at least one of said feature of a source of said first communication and said feature of a source of said second communication, and said parameter is selected from the group consisting of an HTTP ‘

User-Agent’

header, an RFC 822 ‘

X-Mailer’

header, an RFC 822 ‘

Received’

header, an RFC 822 ‘

Date’

Header, an IP address, a WHOIS record, and a reverse DNS record.

32. A method of determining whether a potential relay device is a relay device, the method comprising:

receiving, from the potential relay device, a first information element and a second information element, wherein the potential relay device is an original source of said second information element;

analyzing a configuration status of an original source of at least one of said first and said second information elements, said configuration status selected from the group consisting of an operating system type, an operating system version, a software type, an HTTP client type, an HTTP server type, an SMTP client type, an SMTP server type, a time setting, a clock setting, and a time zone setting;

identifying a feature of an original source of said first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element;

identifying a feature of the potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

determining, using a relay detection system, whether the feature of the original source of said first information element and the feature of the potential relay device are features unlikely to relate to a single device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

33. A method of determining whether a potential relay device is a relay device, the method comprising:

receiving, from the potential relay device, a first information element and a second information element, wherein the potential relay device is an original source of said second information element;

analyzing, using a relay detection system, a feature related to communication performance of an original source of at least one of said first and said second information elements;

identifying a feature of an original source of said first information element, the feature of the original source of said first information element including communication performance of the original source of said first information element, the feature of the original source of said first information element also including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element;

identifying a feature of the potential relay device, the feature of the potential relay device including communication performance of the potential relay device, the feature of the potential relay device also including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

determining, using a relay detection system, whether the feature of the original source of said first information element of said first information element and the feature of the potential relay device are features unlikely to relate to a single device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

34. The method of claim 33, wherein said feature related to communication performance is selected from the group consisting of a latency of communication, a latency of an incoming communication, a latency of an outgoing communication, a round trip time of a communication, a communication rate, an incoming communication rate, an outgoing communication rate, a maximum communication rate, an incoming maximum communication rate, and an outgoing maximum communication rate.

35. A method of determining whether a potential relay device is a relay device, the method comprising:

receiving, from the potential relay device, a first information element and a second information element;

identifying a feature of an original source of said first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of the first information element;

identifying a feature of an original source of said second information element, the feature of the original source of said second information element including a device configuration status of the original source of said second information element, the device configuration status including an indication of a type of software installed on the original source of said second information element and an HTTP device type of the original source of the second information element; and

determining, using a relay detection system, that the feature of the original source of said first information element and the feature of the original source of said second information element are features unlikely to relate to a single device, said determining being indicative that the potential relay device is a relay device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

36. A method of determining whether a potential relay device is a relay device, the method comprising:

identifying a feature of an original source of a first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element;

identifying a feature of the potential relay device that transmitted the first information element and a second information element, the potential relay device being the original source of the second information element, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

determining, using a relay detection system, whether a feature of an original source of a first information element and a feature of the potential relay device are features unlikely to relate to a single device, wherein a positive result of said determining is indicative that the potential relay device is a relay device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

37. A system, implemented at least in part in hardware, to determine whether a potential relay device is a relay device, the system comprising:

a processor;

a feature database in data communication with the processor;

an information element receiver, executable by the processor, to receive information elements from a plurality of devices including an information source device and the potential relay device;

a feature discovery module, executable by the processor, to identify at least one of a feature of the information source device and a feature of the potential relay device, the feature of the information source device including a device configuration status of the information source device, the device configuration status including an indication of a type of software installed on the information source device and an HTTP device type of the information source device, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

a feature incompatibility analyzer, executable by the processor and in data communication with the feature database, to determine whether the feature of said information source device and the feature of the potential relay device are features unlikely to relate to a single device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.

38. The system of claim 37, wherein the information element receiver is further configured to receive information elements from a monitored host.

39. The system of claim 37, further comprising:

an outgoing information element sender executable by the processor.

40. The system of claim 37, further comprising:

a parameter obtainer, executable by the processor, to obtain at least one parameter selected from the group consisting of a parameter indicative of a feature of an information source device, a parameter indicative of a feature of the potential relay device, and a parameter indicative of whether a feature of said information source device and a feature of said potential relay device are features unlikely to relate to a single device.

41. The system of claim 37, wherein the feature database for storing a map between pairs of features and data indicative of whether said pairs of features are incompatible features.

42. A computer-readable non-transitory storage medium comprising instructions, which when executed by a computer cause the computer to:

receive, from the potential relay device, a first information element and a second information element, wherein the potential relay device is an original source of said second information element;

identify a feature of an original source of said first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element;

identify a feature of said potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and

determine whether the feature of the original source of said first information element and the feature of said potential relay device are features unlikely to relate to a single device, wherein a positive result of said determining is indicative that said potential relay device is a relay device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.