Securing the internet through the detection of anonymous proxy usage

Abstract

Many businesses and educational facilities employ some form of filtering to control what internet sites their users may browse. This is done to help protect network assets, to protect data from being stolen and to comply with company policies on internet usage. Anonymous proxies (or web proxies) can be used by the end users to bypass most filtering systems put in place by businesses and this can remove the protection that the filtering systems provide for the network. For instance, unless the web proxy being used is being hosted by the end user or someone they know, then the identity of whoever is hosting the proxy is unknown and they potentially cannot be trusted. The proxy website could also have been set up to eavesdrop on the data flow between the end user's machine and the internet. Sites set up to do this would normally log information for later inspection and data sent from a business user's machine could contain potentially confidential information about the company or the user themselves. This research aims to identify the characteristics or signatures whenever a user is using a web proxy by developing a Detection System that records packets and analyses them looking for identifying patterns of web proxies. One of the main focuses of the research will be in detecting the usage of proxy websites that make use of SSL to encrypt the contents of their packets.

Identifying the Use of Anonymising Proxies to Conceal Source IP Addresses

“…Anonymity technologies allow Internet users to maintain their privacy by preventing the collection of identifying information such as IP addresses. Due to an increasing awareness of what is shared and collected online, Internet users are growing more concerned with their privacy and are turning to the use of technologies such as anonymous proxies (Edman & Yener, 2009;Miller et al, 2015a). Anonymous Proxies are one of the easier to deploy technologies for anonymity on the Internet and are generally access through a web browser (Miller et al, 2015b).…”

Two-layer detection framework with a high accuracy and efficiency for a malware family over the TLS protocol

“…This plaintext access behavior has been marked as unsafe by Google Chrome. In this context, the transport layer security (TLS) protocol has been widely adopted for its ability to encrypt plaintext and to prevent general man-inthe-middle attacks as mentioned in [1]. According to Sandvine's latest report [2], encrypted traffic accounts for 50% of global web traffic.…”