Traffic Classification for the Detection of Anonymous Web Proxy Routing

Abstract

There is an increasing need to be able to classify whether an incoming packet is from a legitimate originating IP address or has been modified through an intermediate proxy or node. Being able to verify the originating IP address allows a business (e.g. bank) to use geolocation services in order to then ascertain which geographical location that packet was sent from. This can then feed into the system intrusion system or backend fraud alert mechanisms. The web however is going 'dark'. There is a noticeable uptake in the amount of encrypted data and third party anonymous traffic proxies which aim to mask the try location and IP address of a web request. We present here a system which identifies the characteristics or signatures whenever a user is using a web proxy by developing a Detection System that records packets and analyses them looking for identifying patterns of web proxies.

NoPASARAN: a Novel Platform for Analysing Semi-Active elements in Routes Across a Network

“…In [13] the authors present a detection system that identifies web proxies. Their system records and analyses incoming packets to match them with wellknown proxy patterns.…”

<i>Inmap-t</i>: Leveraging TTCN-3 to Test the Security Impact of Intra Network Elements

“…A notable exception exists with the body of knowledge accumulated to detect proxies on the Internet [34] [35] [36]. These works have highlighted the existence of the "active observers" by using techniques specifically designed for this specific threat.…”

Identifying the Use of Anonymising Proxies to Conceal Source IP Addresses

“…Due to an increasing awareness of what is shared and collected online, Internet users are growing more concerned with their privacy and are turning to the use of technologies such as anonymous proxies (Edman & Yener, 2009;Miller et al, 2015a). Anonymous Proxies are one of the easier to deploy technologies for anonymity on the Internet and are generally access through a web browser (Miller et al, 2015b). They are proxy servers that are based on the open Internet and are accessible to the general userbase of the Internet.…”