System, device, and method for detecting a proxy server

Description

FIELD

The present invention is related to the field of security of electronic devices and systems.

BACKGROUND

Millions of people utilize mobile and non-mobile electronic devices, such as smartphones, tablets, laptop computers and desktop computers, in order to perform various activities. Such activities may include, for example, browsing the Internet, sending and receiving electronic mail (email) messages, taking photographs and videos, engaging in a video conference or a chat session, playing games, or the like.

Some activities may be privileged, or may require authentication of the user in order to ensure that only an authorized user engages in the activity. For example, a user may be required to enter a username and a password in order to access an email account, or in order to access an online banking interface or website.

SUMMARY

The present invention may include devices, systems, and methods of detecting whether a user or an electronic device or computer, is accessing (or is attempting to access) a remote server or a remote computerized service, either: (I) directly, or (II) indirectly through a proxy server.

The present invention may further determine that a user or an electronic device, that is estimated to be accessing the remote service via a proxy server, is more-probably or is most-probably a cyber-attacker and not a legitimate user; based on the utilization of proxy server, by itself and/or in combination with other conditions or other analysis; and optionally by taking into account user-specific characteristics that may be extracted from user-gestures and other user interactions that are performed by the user via input-unit(s) of the electronic device; and further, optionally, by injecting or introducing an input-output aberration or interference or irregularity which may require a human user to perform certain manual corrective actions.

Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

The present invention may provide other and/or additional benefits or advantages.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic block-diagram illustration of a system, in accordance with some demonstrative embodiments of the present invention.

FIGS. 2A-2D are schematic block-diagram illustrations of a proxy detector and its components, in accordance with some demonstrative embodiments of the present invention.

DETAILED DESCRIPTION OF THE PRESENT INVENTION

The present invention comprises devices, systems, and methods of detecting whether a user or an electronic device or computer, is accessing (or is attempting to access) a remote server or a remote computerized service, either: (I) directly, or (II) indirectly through a proxy server.

The Applicants have realized that some cyber-attackers and other illegitimate users of a computerized service, may access a remote server indirectly, by utilizing a Proxy Server or other similar interim node or relay-node or relay-point, or by using a Virtual Private Network (VPN), or by using a tunneling server or tunneling mechanism, or other interim mechanism.

The Applicants have realized that it may be beneficial to detect or to determine, or to estimate, that a user and/or an electronic device is accessing (or, is attempting to access) a remote server or a computerized service, indirectly via a Proxy Server, rather than directly; and that such detection or estimation may be taken into account when determining or estimating whether the user is a legitimate human user, or is an illegitimate cyber-attacker or “fraudster”.

The term “Proxy Server” as used herein may comprise, for example, any suitable (e.g., hardware-based and/or software-based) node or computer or server or network element (e.g., router, switch, hub, gateway, relay unit, repeater, forwarding unit, tunneling unit, encapsulator, encapsulating unit, or the like), which is able to act as an intermediary for requests from clients (e.g., end-user devices) seeking responses from a server. For example, the end-user device may request a file, a connection, a web-page, a web-hosted content-item, a data-item accessible over TCP/IP, a response to a query, or the like; but instead of submitting or sending the request directly from the end-user device to the destination server that is able to respond or to serve the requested resource or content, the end-user device may send the request to the proxy server. Then, the proxy server may forward the request to the destination server, optionally after modifying some portions of the request, and optionally such that the destination server does not know the identity (e.g., the Internet Protocol (IP) address, the User Agent string, and/or other identifying data-items) of the end-user device. Then, the destination server responds to the request, by sending to the proxy server the requested information or resource (e.g., response to the query; file; data-item; content hosted on web-server). Then, the proxy server forwards or transmits the received response, to the end-user device, which may consume it, display it (e.g., via a web browser), store it, and/or otherwise process it or utilize it.

Some embodiments of the present invention may detect a proxy server, or a malicious proxy server or a fraud-related proxy server, or a proxy server that is known to the end-user, or a proxy server or proxy mechanism that is unknown to the end-user (e.g., if a local malware module is installed on the end-user device and tunnels traffic through a malicious proxy server), or a proxy mechanism that is utilized or that may be utilized for fraudulent activity or for unauthorized access to a computerized service or for illegitimate access or for illegitimate online actions. Some demonstrative embodiments of the present invention may utilize any suitable combination(s) of one or more of the following implementations and/or examples.

Reference is made to FIG. 1, which is a schematic block-diagram illustration of a system 100 in accordance with some demonstrative embodiments of the present invention. The components of system 100 may be implemented by using suitable hardware units and/or software units; and may be co-located within a single computer device or a single computing system, or may be scattered or distributed across two or more computing devices and/or computing systems. In some embodiments, client-server architecture may be used; such that some of the components and units may be implemented locally at the end-user device, whereas other components and units may be implemented remotely or by using a remote server or a “cloud computing” server or repository or computer. In some embodiments, some modules and functionality may be implemented by utilizing a web-browser, a plug-in or extension or add-on to a web-browser or to an Operating System (OS), by using a native application or a mobile-web application, by using JavaScript and/or CSS and/or HTML5, and/or by using other suitable technologies. Components of system 100 may interact or communicate over one or more wireless communication links, wired communication links, cellular communication, client/server communication, peer-to-peer communication, or the like.

System 100 may enable an end-user device 101 to interact with a computerized service 102. The end-user device 101 may be, for example, a smartphone, a tablet, a laptop computer, a fitness bracelet (e.g., similar to FitBit or JawBone wearable devices), a wearable device, a portable device, an Augmented Reality (AR) device or glasses or helmet or headgear (e.g., similar to Google Glass), a Virtual Reality (VR) device or glasses or helmet or headgear (e.g., similar to Oculus Rift), or the like. In some embodiments, the end-use device 101 may be a stand-alone machine or interface; a digital kiosk or kiosk-type machine, a vending machine, an Automated Teller Machine (ATM), a point-of-sale (POS) terminal or machine, or the like. In some embodiments, the end-user device 101 may be a point-of-entry terminal, or a user-identification terminal, such as a terminal or scanner or dashboard or touch-screen which may be used for secure physical entry or entrance or passage through a gate or door or lobby or turnstiles or room or corridor, or as part of (or replacement of) a physical entry monitoring system. In yet other embodiments, the end-user device 101 may be or may comprise, or may be comprised in, a vehicle, a vehicular device, a dashboard, a vehicular dashboard, a vehicular computing system, a vehicular computing device, a vehicular ignition unit or system, a vehicular component that is operable in conjunction with a vehicular ignition system, a vehicular immobilizer unit, a vehicular component that is operable in conjunction with a vehicular immobilizer unit, or the like.

The computerized service 102 may be a local and/or a remote computerized platform or service or application or web-site or web-page. The computerized service may be installed locally and entirely on the end-user device 101; or may be installed remotely and entirely on a remote server or a remote computer which is then accessed by the end-user device 101 either via one or more wired and/or wireless communication link(s); or may be a hybrid implementation which utilizes one or more remote components (e.g., a remote Application Server) and one or more local components (e.g., a local native application; a local mobile-web application; a local web-browser).

Some demonstrative and non-limiting examples, of suitable computerizes service(s) which may be used in conjunction with the present invention, may include: banking service, online banking services, retail banking services (e.g., performed within or at an ATM or a branch of a bank); brokerage or online brokerage services; usage and/or access to electronic mail, email, SMS accounts, instant messaging (IM) accounts and services, social networks; an enterprise network or corporate network or organizational network which is available only to employees or authorized users of an organization or enterprise; a members-only network or service, or a paying-members-only service or network, or a premium service, which are available only to certain users and/or to members and/or to paying users; applications and/or websites and/or services that enable or perform payment, electronic payment, utilization of credit card and/or debit card and/or wire transfer and/or electronic funds transfer; applications that access or utilize a secure database storing confidential or non-public information; and/or any suitable electronic service which may be accessed locally and/or remotely by end-user device 101.

In some embodiments, the computerized service 102 need not be external to the end-user device 101, and may be entirely internal to the end-user device 101, or may be the end-user device 101, or may be a particular functionality or a general functionality of the end-user device 101. For example, the end-user device may be a smartphone or tablet; and the computerized service 102 may be one or more features or functionalities or applications of that smartphone or tablets. In some embodiments, the present invention may be used as part of a locking or unlocking mechanism of a smartphone or tablet or other end-user device 101; or as part of a process in which a user unlocks or “wakes up” a hibernating device, or takes the device from reduced-power mode (or from “sleep mode”) to fully-operational mode.

End-user device comprises an input unit 111, for example, mouse, keyboard, stylus, touch-screen, multi-touch-screen, trackball, joystick, or the like. End-user device further comprises an output unit 112, for example, monitor, screen, touch-screen, multi-touch-screen, or the like. In some embodiments, the input unit and the output unit may be implemented as the same single unit, for example, as a touch-screen or multi-touch screen.

A user interactions monitoring/sampling module 113 may monitor some or all of the user interactions and/or user gestures; and may record, capture, or otherwise sample such interactions and/or gestures. Optionally, an interactions database 114 may log and/or may store data reflecting the monitored user interactions, for a single user or for multiple users.

User-specific features extractor 115 may extract or estimate user-specific features or traits or characteristics or attributes, that characterize an interaction (or a set or batch or group or flow of interactions, or a session of interactions) of a user with the computerized service 102. Optionally, an extracted features database 116 may store data or records which reflects users and their respective values of extracted (or estimated) user-specific features.

Optionally, a comparator/matching module 117 may compare or match, between (or among): (a) values of user-specific features that are extracted in a current user session (or user interaction), and (b) values of respective previously-captured or previously-extracted user-specific features (of the current user, and/or of other users, and/or of pre-defined sets of values that correspond to known automated scripts or “bots” or known attackers).

The user-specific features, whose values may be compared or matched across usage-sessions, may include, for example, curvature (or curvature radius) of mouse movement or mouse strokes; acceleration and/or speed of mouse movement in one or more directions; smoothness of movement; velocity or speed of gestures; acceleration or deceleration of gestures; rate or frequency of mouse clicks; accuracy or inaccuracy of gestures or clicks, or their relative location (e.g., whether the user typically clicks correctly an on-screen button, or sometimes misses the button and clicks nearby); the particular type of manner that the user chose to convey input (e.g., whether the user clicked on “submit” button, or pressed the “enter” key; or, whether the use moved between form fields by using the “tab” key or by using the mouse cursor); particular sequences of keys or characters that the user enters more rapidly (or more slowly) relative to other characters or sequences; particular manner or pattern in which the user navigates within fields or within a page or an application; and/or other suitable features, for example: device movements or input-unit movement during interaction, movement and/or orientation and/or acceleration of the entire device (e.g., a smartphone or tablet) during the interaction, whether one single finger or multiple particular fingers are used for interacting, the relations between fingers while interacting, the relation to other body parts while interacting, and/or other suitable gesture parameters. Optionally a deep learning algorithm and/or a machine learning algorithm or other suitable Artificial Intelligence (A.I.) algorithm may be utilized, in order to learn and to define a user-specific profile based on the data that is monitored or produced during the interaction (and optionally, immediately prior to the interaction and/or immediately after the interaction); optionally, without necessarily using any specific pre-define features or characteristics or features, and optionally using a heuristic approach or holistic approach or “fuzzy logic” algorithm that attempts to find a unique identifier or a unique digital footprint without necessarily being tied to a specific biometric parameter or to a set of pre-defined biometric parameters. Some embodiments may thus generate a user-specific biometric profile or biometric signature, without pre-defining a set of biometric characteristics or parameters that are then used to calculate the signature or profile; but rather, by utilizing deep learning which utilizes mathematical generation of a unique profile or signature without necessarily defining or pre-defining the set of physical parameters that would be used for differentiating among users.

Optionally, an interference injector 118 may operate to introduce, add, inject, generate and/or otherwise cause an interference (or anomaly, or aberration, or inconsistency, or deviation, or input-output interference, or input/output anomaly) to the input and/or the output as they are reflected to the user who utilizes the end-user device. Such intentionally-introduced input/output interference may be, for example: temporarily hiding or removing the on-screen mouse-pointer or on-screen pointer, in order to elicit the user to react and to make gestures in an attempt to revive the hidden on-screen pointer; intentional deviations or “jumps” in the movement of the on-screen pointer, relative to the actual manual gesture that is performed by the human user (e.g., the human user drags the mouse eastbound, but the on-screen pointer deviates and moves north-east, thereby eliciting a corrective movement or corrective gestures by the user); intentionally moving or re-locating an on-screen interface component (e.g., a “submit” button or a “next” button) while the user is dragging an on-screen pointer; and/or other suitable interferences or anomalies, whose goal is to elicit the user to react and/or to perform corrective steps or corrective gestures; thereby enabling the user-specific features extractor 115 to further extract user-specific attributes or features that characterizes such corrective gestures or such reactions to anomalies; e.g., the time period that it takes the user to notice the anomaly and/or to correct it; the manner in which the user corrects the anomaly (e.g., whether the user tries to locate a disappeared on-screen pointer, by shaking his mouse, or by moving the mouse sideways, or by moving the mouse clockwise, or by moving the mouse counter-clockwise, or by clicking the mouse-button once, or by clicking the mouse-button multiple times, or by typing on the keyboard.

In some embodiments, a corrective gestures analyzer unit 119 may monitor, track, analyze and/or characterize such corrective actions or gestures of the user in response to such interference or anomaly or aberration. In some embodiments, a user reaction analyzer unit 120 may monitor, track, analyze and/or characterize such gestures or reactions of the user in response to such interference (which may not necessarily involve a corrective action). In some embodiments, these functionalities, of the corrective gestures analyzer unit 119 and/or the user reaction analyzer unit 120 may be part of the functionality of the user-specific features extractor 115.

It is noted that in some embodiments, interferences may be injected or used continuously; or may be used only in particular portions or regions of the computerized service (e.g., only on certain pages of a website, or only when certain functionalities of the application are requested, such as high-risk or higher-risk functions); or may be injected pseudo-randomly, or at pre-defined time intervals; or may be injected if one or more other conditions are true (e.g., if there are other indicators of fraudulent activity or irregular activity); or may not be injected at all, for a particular user or for a particular usage-session, or for all users or for a group of users. In some embodiments, optionally, an interference selector module 121 may select or may determine, based on one or more criteria or conditions, whether or not to introduce an interference, or whether (or when exactly, or where exactly) to trigger or to command the interference generator 118 to generate an interference; optionally by selecting a suitable interference from a pre-defined interferences pool 122. For example, the interference selection may be based on user characteristics, and/or based on attributes of the computerized service, and/or based on pseudo-random selection; or by selecting interferences of a type that was not yet used for a particular user, or conversely by selecting interferences of a type that had been already used for a particular user, or by taking into account the level of risk associated with a user-requested functionality of the computerizes service, or the like. The injection of interferences, and/or the analysis of user reactions to interference, and/or the analysis of corrective gestures, may be optional.

If the comparator/matching module 117 determines that one or more features, or a set of features, that characterize the current interaction session of the current user, does not match those features as extracted in previous interaction session(s) of that user, then, a possible-fraud signal may be generated or sent or transmitted to other units of system 100 and/or to pre-defined recipients.

For example, combined factors and data may be taken into account by a user identity determination module 131, which may determine or estimate whether or not the current user is a “fraudster” or an attacker or an imposter. The user identity determination module 131 may trigger or activate a fraud mitigation module 132 able to perform one or more fraud mitigating steps based on that determination or estimation; for example, by requiring the current user to respond to a challenge, to answer security question(s), to contact customer service by phone, to perform two-step authentication or two-factor authentication, or the like.

System 100 may comprise a user authentication module 125 which may enable system 100 and/or computerized service 102 and/or end-user device 101 to perform user authentication, or to authenticate or verify or confirm the identity of a user of end-user device 101 (or of computerized service 102), and/or to utilize the unique behavior and/or gestures and/or reactions of the user as a user-identifying feature (e.g., which may be used by the system to authorize a log-in, or may authorize access, or may authorize a password recovery or a password reset process). The user authentication module 125 may be able to distinguish between (i) a legitimate user, or genuine user, or authorized user, or genuine account-owner; and (ii) an illegitimate user or attacker or cyber-attacker or impostor or imposter, a human attacker, a non-human attacker (e.g., a malware or automatic script or automated script or “bot”) or other illegitimate user.

In some embodiments, system 100 may comprise a fraud estimation module 126, able to estimate or detect or determine a fraud or a fraudulent transaction or a fraudulent user or an attacker or a fraudulent set-of-operations, or an attempted fraud or an attempted fraudulent transaction (which may be concurrently occurring, or which had already occurred and is now detected or estimated in retrospective review of previous operations or prior data).

System 100 may further comprise a Bot/Malware/Script Identifier 127, able to estimate or detect or determine that an electronic device or computer, or computing device, or a computerized service, is being controlled (or, is being attempted to be controlled, or attacked, or accessed, or utilized) by a “Bot” or malware or automated script or other automatic cyber-attack unit or module, rather than by a legitimate human user (or, rather than by a human user).

System 100 may further comprise a Proxy Detector 150, able to detect or determine or estimate, that a proxy server or other intermediary device or intermediary network-element is utilized by the end-user (intentionally, or even unknowingly) for accessing a remote server or a computerized service; or able to detect or estimate that a user or an end-user device is accessing (or is attempting to access) a server or a remote server, through a proxy server or through other intermediary network element or relay element.

System 100 may further comprise one or more of the other modules, units and/or components that are described herein.

Reference is made to FIG. 2A, which is a schematic block-diagram illustration of Proxy Detector 150 and its associated components, in accordance with some demonstrative embodiments of the present invention. In order not to over-crowed the drawings, the components and/or units and/or modules which may be comprised in Proxy Detector 150, have been divided into several groups of components: Proxy Detection Modules 150B of FIG. 2B; Proxy Detection Modules 150C of FIG. 2C; and Proxy Detection Modules 150D of FIG. 2D. It is clarified that some or all of the modules or units that are shown in FIG. 2B and/or FIGS. 2C and/or FIG. 2D, may be implemented together and may be co-located with the same proxy server detector 150. Furthermore, proxy detector 150 may be configured such that a proxy detection or proxy estimation may be based on two or more aggregate conditions or alternate conditions, or two or more aggregate outputs or alternate outputs of the various units of FIG. 2B and/or FIGS. 2C and/or FIG. 2D. Accordingly, all the modules and units that appear in FIG. 2B and/or FIGS. 2C and/or FIG. 2D may be regarded as optionally being comprised in the same proxy detector, and as being able to interact with each other, and being able to transfer their output or their detection results to the proxy detector 150 which may take into account one or on more, or two or more, or some, detection results in the aggregate or in the alternate, or may use a weighted formula or a lookup table to assign different weights to the detection results of each such participating module in order to reach a weighted determination regarding existence of a proxy server.

A first set of demonstrative embodiments may detect a proxy server by utilizing application layer challenges, and/or by resource timing utilizing synthesized channel failures. This may include synthesizing failures (e.g., NACK, RST) in the transport channel, that would cause the proxy server to respond with retransmissions, channel-closing, or other operations, allowing the system to measure round-trip times (RTTs) between the system's servers and the (suspected) proxy. At the same time, or in parallel, or simultaneously, making a simple request from the client device to a non-cached resource, may be used to measure RTT between the client device and the system's servers. Measuring these and additional channel timings may enable to reach a determination of probable proxy usage.

For example, a Transport Channel Failure Injector 151 may generate, introduce, insert, add and/or inject a failure, such as a Negative Acknowledgement (NACK) and/or a Reset flag or Reset packet (RST), into a data-stream (e.g., into a TCP/IP stream of packets). In response to such injected failures, the intermediate proxy server may generate a retransmission request, may perform channel closing, or may perform other operations which may indicate that a proxy server exists and operates as intermediary. An RTT Measurer 152 may measure the RTT between (i) a trusted server (e.g., owned or controlled by a trusted party, such as by the owner or administrator of system 100), and (ii) the suspected proxy server. Meanwhile, the end-user device may be triggered to request a non-cached resource or non-cached data-item directly from the trusted server, and the RTT Measurer 152 may measure the RTT between (i) the trusted server, and (ii) the end-user device.

Then, an RTT Comparator 153 may compare between: (I) the first RTT value (between the trusted server and a suspected proxy server), and (II) the second RTT value (between the trusted server and a the end-user device). If the two RTT values are identical, or are sufficiently close to each other (e.g., the first RTT is in a range of 0.80 to 1.20 times the second RTT), then more-probably a proxy server does not exist or does not operate between the end-user device and the trusted server. Conversely, if the RTT values are different (or, are apart) by at least a pre-defined difference (e.g., if the first RTT value is at least 1.20 greater than the second RTT value; or, if the first RTT value is at most 0.80 of the second RTT value), then more-probably a proxy server exists and operates between the end-user device and the trusted server. The threshold values of 0.80 and 1.20 are only non-limiting examples, and other suitable threshold values, ranges, ratios, comparison conditions, or matching conditions, may be used.

A second set of embodiments may utilize TCP source port entropy, in order to detect a proxy server. For example, a Requests Generator 154 may generate or may issue a batch of small or very-small requests (e.g., each request having a small size, smaller than a pre-defined threshold value; for example, smaller than 512 bytes, or smaller than 256 bytes). Then, a TCP source-port identifier 155 may detect or identify the TCP source-port for each such request; and a Distribution Analyzer may sample and/or analyzer the distribution of the TCP source-ports. Particularly, a TCP source-ports entropy analyzer 156 may analyze the entropy of the distribution of source-port (e.g., such that entropy that is greater than a pre-defined threshold, indicates a proxy server; or such that entropy that is smaller than a pre-defined threshold, indicates a proxy server), or may compare the entropy to pre-known values and/or to expected values, in order to determine that a proxy server exists and operates.

Additionally or alternatively, a TCP source-ports ordering analyzer 157 may analyze the ordering of the distribution of source-port (e.g., such that a detected ordering which matches a particular pre-defined pattern or sequence, indicates a proxy server), or may compare the ordering to pre-known values and/or to expected values, in order to determine that a proxy server exists and operates.

A third set of embodiments may utilize Secure Socket Layer (SSL) header ciphers (e.g., supported and/or suggested SSL header ciphers), and/or their order of appearance, as indication(s) for presence of a proxy server or for detection of a proxy server. For example, each browser or client application may utilize a different SSL header cipher; and an SSL Header Cipher Collector 158 may track or log or collect the SSL header cipher, or the various multiple SSL header ciphers, that are used in conjunction with a particular end-user device. Then, an SSL Header Cipher Matcher 159 may check whether there is a discrepancy or mismatch between: (I) the actually-collected SSL header ciphers, and (II) the SSL header cipher(s) that are declared by a given browser (or application) of the end-user device. Such discrepancy or mismatch in the SSL header cipher(s), may lead the system to determine that a proxy server exists and operates, and/or that (illegitimate) spoofing of data is performed (e.g., by the end-user device, or by a network element on behalf of the end-user device).

A fourth set of embodiments may check Domain Name Server (DNS) blacklist(s) (DNSBL) data, in order to detect or estimate that a proxy server is utilized. For example, an Originating IP Address Detector 161 may detect the originating IP address; a Reverse Lookup module 162 may perform reverse lookup of the originating IP address to a corresponding domain name (or, other methods may be used to convert the originating IP address to an originating domain name); then, a DNS BlackList Checker 163 may check whether the originating IP address and/or the originating domain name, appear on one or more DNS blacklist(s) (e.g., locally-stored DNS blacklists; or remotely-stored DNS blacklists), for example, which list IP addresses and/or domains that are known to be associated with “spamming” or sending junk emails. If the checking result is positive, then the proxy detector may determine that a proxy server is utilized, or that more-probably than not is a proxy server utilized.

In a fifth set of embodiments, a Geo-Location Mismatch Detector 164 may operate to detect a geo-location mismatch or inconsistency or discrepancy, between (I) geo-location or geo-spatial data as associated with the alleged or the exhibited originating IP address of the end-user device, and (II) geo-location or geo-spatial data as exhibited by one or more components of the end-user device or content-items submitted by the end-user device, or other locality parameters which may be collected or extracted on the end-user device side.

For example, a Local Time Extractor 165 may operate (e.g., by injecting or adding a JavaScript code into an HTML page that is served to the end-user device from a trusted server), and may extract or determine the actual local time of the actual end-user device; and the Geo-Location Mismatch Detector 164 may determine that such actual local time differs from an estimated local time that is currently associated with the geo-located IP address; for example, the local time or local time-zone as extracted by JavaScript at the end-user device may indicate GMT-5 (e.g., extracted using JavaScript, based on the local time as managed by the local processor or CPU of the end-user device), whereas the originating IP address may be reversed-search to indicate geo-location in Italy which is GMT+1, thereby indicating that an end-user device in America is utilizing a proxy server in Italy. Applicants have realized that this method of proxy server detection may be useful, particularly since many end-user devices, smartphones, tablets and computers are typically connected to the Internet and often have their local time updated periodically from a remote server or by a time-updating module of their Operating System (OS), such as automatic setting of daylight saving time changes.

Similarly, a Preferred-Language Extractor 166 may operate to extract a preferred language of a client device (e.g., from or by using HTTP headers); and the Geo-Location Mismatch Detector 164 may detect a discrepancy or mismatch between such locally-extracted preferred language, and the geo-located country or region of the originating IP address. For example, HTTP headers or other device-parameters of the end-user device may indicate Russian as the preferred language; but a reverse lookup of the originating IP address may indicate geo-location in America; thereby supporting a determination that an end-user device is physically located in Russia and is utilizing a proxy server in America. Optionally, a lookup table or other list may be utilized, in which each geographical region or country is associated with one or more official natural language(s) or with highly-popular languages; such as, indicating that the United Kingdom is associated with English, and that the United States of America is associated with English and with Spanish (as a highly-popular language), whereas Russia is associated with the Russian language; thereby enabling the proxy detector to detect a mismatch between a preferred natural language (e.g., as extracted locally at an end-user device), and the natural language(s) that are officially used or are typically used at the geographical region that corresponds to the IP address as allegedly reported.

The above-mentioned examples of utilizing locally-extracted preferred language or time zone, are only non-limiting examples; and other suitable locality parameters may be extracted (e.g., locally at the end-user device; or remotely at a trusted server based on data or queries or headers or metadata received from or sent by the end-user device), such as, a Locality-Related Parameters Extractor 167; and such parameters may then be utilized by the Geo-Location Mismatch Detector 164 in order to detect a mismatch between (I) extracted locality-parameter(s) value(s), and (II) the estimated geo-location based on originating IP address as reported by an intermediate server or relay node or network element; thereby enabling the system to determine that a proxy server is operational, based on such mismatch or discrepancy.

A fifth set of embodiments may perform manipulation or modification of HTTP Headers, to create application-layer challenges which may be used for proxy server detection. For example, the system may intentional violate or breach the HTTP protocol (e.g., to specifically trigger some responses from a trusted server), in order to differentiate between proxy servers client-browsers and non-proxy client-browsers. For example, intentionally duplicating one or more of the HTTP response headers, may be ignored by a proxy server, but may be regarded as an error by a non-proxy client (end-user device) browser.

In a demonstrative example, an HTTP Header Modifier 168 may intentionally modify HTTP response header(s) that are sent by a trusted server to the end-user device in a manner that violates HTTP protocol (e.g., by using an HTTP response header duplicator 169 to duplicate the HTTP header); and the proxy detector may check the response or the reaction of the end-user device to such intentional violation or to such non-HTTP-compliant header. For example, if the end-user device appears to ignore the violating (e.g., duplicate) HTTP header, then it is more probable that a proxy server exists and operates; whereas, if the end-user device regards the violating or non-HTTP-compliant or duplicate header(s) as violating (e.g., reports an error, transmits a signal indicating an erroneous incoming transmission) then it is more probable that the end-user device does not utilize a proxy server to access the remote server.

A sixth set of embodiments may utilize a reverse DNS query. For example, the system may issue a DNS query about the source (or the originating) IP address; a proxy server is more-likely to have a reverse-IP record registered, compared to a non-proxy source. Additionally or alternatively, the response to the DNS query may provide other information which may be utilized for proxy detection or proxy estimation (e.g., even if only the subnet is registered). These operations may be performed by a Reverse DNS Query module 171, which may perform the reverse DNS query and may further evaluate or analyze the results of such reverse DNS query.

A seventh set of embodiments may analyze HTTP headers in order to detect or estimate proxy existence. For example, some proxy servers add or modify HTTP headers or the content of HTTP headers; such as, the content of the Via field in HTTP header(s), or the XFF (X-Forwarded For) field in HTTP header(s); and such modification may trigger the proxy server detector to determine or to estimate that a proxy server exists and operates. These operations may be performed by an HTTP Header Analyzer 172, or other suitable module or unit.

A seventh set of embodiments may perform passive fingerprinting: for example, the system may collect various channel parameters, and may use them to estimate the originating Operating System (OS) and browser software. The estimations may then be matched against the declared client OS and/or browser (e.g., obtained from the user-agent HTTP header); and a mismatch may indicate that a proxy server is being utilized. These operations may be performed by an OS & Browser Detector 173, which may perform the actual (e.g., non-reported) detection of the OS and browser based on examination of channel parameters; and which may compare them to the reported OS and/or browser identity (e.g., as reported by the User Agent record), to detect a possible proxy server. For example, even though the User Agent field as reported by the browser may report Internet Explorer browser running on Microsoft Windows operating system, an analysis of the actual transmission channel parameters and/or the actual behavior of the end-user device may indicate that it is actually running a Linux operating system and utilizing a Firefox browser; thereby triggering a detection of a proxy server.

An eighth set of embodiments may perform active fingerprinting: for example, the system utilizes a trusted server that attempts to connect to the originating IP address in one or more particular ports (e.g., port 80, port 8080, port 443, port 8888). If any of these ports replies to the trusted server, the system may determine it to be a proxy server, since end-user devices typically do not respond to connection-attempts to these particular ports. These operations may be performed by a Port(s) Connector and Analyzer 174.

A ninth set of embodiments may utilize of DNS failed requests: for example, the system utilizes a server that requests a resource under a one-time subdomain of a domain that is controlled or owned or operated by the system's administrator. Then, the system does not respond to queries from domain-name servers. When the resolvers fail, common Proxy software will try to resolve directly (e.g., the “Squid” web-proxy may utilize a built-in DNS). If the system observes that a DNS query is incoming from the same IP address as the HTTP data, then this may indicate that a proxy server is being used. These operations may be performed by a DNS Failed Requests Manager 175.

A tenth set of embodiments may perform “scraping” of websites having proxy-lists: for example, the system may continuously or periodically “scrap”, download, read or review websites or web-pages that publish list(s) of known web proxies; and may collect and store proxy-identifying data from such published lists, for subsequent detection of proxy servers. A Proxy Lists Scarper and Analyzer 176 may perform such operations.

An eleventh set of embodiments may transmit data in a non-HTTP protocol, or as Active Content (e.g., using Flash to stream video), and this may causes such data not to go through proxy servers. For example, a non-HTTP protocol sender 177 or an Active Content sender 178 may send such data, and may check whether or not the end-client device received such data, in order to detect whether a proxy server exists. For example, the proxy server detector may send data which is typically dropped or not-relayed by a proxy server, and may then check locally on the end-user device whether such data was indeed received or not; such that, absence of such data at the end-user device indicates that a proxy server exists and drops (or, does not relay) such data. These operations may be performed by a Non-Relayed Data Sender 179.

A twelfth set of embodiments may utilize a WIMIA test (“What Is My IP Address” test): for example, the system may continuously gather IP-level statistics; and when multiple or numerous different-clients' sessions (e.g., more than 10, or more than 50, or more than K sessions) originate from the same IP address, that IP address may be regarded as a proxy server. These operations may be performed by a WIMIA Test Manager 181, which may collect IP address and may detect that numerous sessions of different clients originate from the same IP address, which is more-probably a web proxy or a proxy server.

A thirteenth set of embodiments may analyze or may take into account TOR (“The Onion Router”) exit nodes, as the TOR network may be regarded as a specific case of proxy usage. A the list of IP addresses of TOR exit nodes may be obtained from one or more sources or publicly-available records or website, and thus system may determine whether the end-user device is using TOR as proxy for connecting to the system's server. These operations may be performed by a TOR Detector 182.

A fourteenth set of embodiments may implant data or metadata inside cacheable resources, in order to later check whether fresh versions or cached versions of such data was actually received by an end-user device. For example, the system's server may serve a dynamically-generated image, where the image-bytes are a serialization of some metadata, including generation date-and-time and originating IP address. Then, a request for this image is made on every session on the client side. The encoded data or metadata is extracted and decoded, and thus it is determined if the image was cached by a proxy. For example, if the image was generated in the past (e.g., at least 1 or 2 or 12 or 24 hours ago, or at least K seconds ago or K hours ago), and was not cached by the browser, then it must have been cached by a proxy server that exists in between the trusted server and the end-user device. These operations may be performed by a metadata-inserter into cacheable resources module(s) 183, which may insert or inject such data on the trusted server side; and then, a metadata-extractor from cacheable resources module 184 may check locally on the client side whether fresh or cached data was actually received.

A fifteenth set of embodiments may attempt to upgrade or to modify or HTTP to WebSockets, in order to detect proxy server existence. WebSockets (or similar protocols) may require active participation by proxies, and will often fail when a non-supporting proxy is involved. Accordingly, failure to upgrade an HTTP connection to a WebSocket in a supporting browser, may be used as a strong indication of a proxy server. These operations may be performed by an HTTP to WebSockets Upgrader/Inspector module 185.

A fifteenth set of embodiments may utilize new HTML5 content types and protocols: the Applicants have realized that new content types, HTML tags (e.g., the <video> tag), and/or supported protocols (e.g., WebSockets, RTC, WebRTC) are continuously being implemented by browsers; and/or that often, such additional or new features become supported on end-user device browsers earlier than they become supported (or relayed) by proxy server(s). The system's server may continuously test to find small differences between how proxy servers handle such new content, compared to how client-browsers handle such new content. A suitable unit or module may thus inject or insert such content, which is already supported on one or more end-user device browser(s), but is typically not yet supported (or relayed) by web proxies or proxy servers; and may check if such content was properly received and/or rendered by the end-user device, as a condition for determining whether a proxy server exists.

Some embodiments may utilize queries to external services: for example, the system may be integrated with external IP-based fraud services; which may be utilized for every session, or only for suspicious sessions (e.g., offline, manually triggered from an analysis portal or interface).

It is noted that in accordance with the present invention, monitoring and/or analyzing of “user interactions” and/or “user gestures”, may further comprise the monitoring and/or analyzing of interactions, gestures, and/or sensed data that is collected shortly before or immediately before the actual interaction, and/or interactions, gestures, and/or sensed data that is collected shortly after or immediately after the actual interaction; in addition to the data collected or sensed or monitored during the interaction itself.

The terms “mobile device” or “mobile electronic device” as used herein may include, for example, a smartphone, a cellular phone, a mobile phone, a smart-watch, a tablet, a handheld device, a portable electronic device, a portable gaming device, a portable audio/video player, an Augmented Reality (AR) device or headset or gear, a Virtual Reality (VR) device or headset or gear, or the like.

The term “pointing device” as used herein may include, for example, a mouse, a trackball, a pointing stick, a stylus, a joystick, a motion-sensing input device, a touch screen, a touch-pad, or the like.

The terms “device” or “electronic device” as used herein may include, for example, a mobile device, a non-mobile device, a non-portable device, a desktop computer, a workstation, a computing terminal, a laptop computer, a notebook computer, a netbook computer, a computing device associated with a mouse or a similar pointing accessory, a smartphone, a tablet, a smart-watch, and/or other suitable machines or devices.

The term “genuine user” as used herein may include, for example, an owner of a device; a legal or lawful user of a device; an authorized user of a device; a person who has legal authorization and/or legal right to utilize a device, for general purpose(s) and/or for one or more particular purpose(s); or the person who had originally defined user credentials (e.g., username and password) for performing an activity through the device.

The term “fraudulent user” as used herein may include, for example, any person who is not the “genuine user” of the device; an attacker; an intruder; a man-in-the-middle attacker; a man-in-the-browser attacker; an unauthorized user; an impersonator; a hacker; a cracker; a person attempting to hack or crack or compromise a security measure utilized by the device or by a system or a service or a website, or utilized by an activity or service accessible through the device; a fraudster; a human fraudster; a “bot” or a malware or an automated computerized process (e.g., implemented by using software modules and/or hardware components) which attempts to imitate human behavior or which attempts to act as if such “bot” or malware or process was the genuine user; or the like.

The present invention may be used in conjunction with various suitable devices and systems, for example, various devices that have a touch-screen; an ATM; a kiosk machine or vending machine that has a touch-screen; a touch-keyboard; a system that utilizes Augmented Reality (AR) components or AR glasses (e.g., Google Glass RTM); a device or system that may detect hovering gestures that do not necessarily touch on the screen or touch-screen; a hovering screen; a system or device that utilize brainwave analysis or brainwave control in which the user's brainwaves are captured or read and the user's brain may directly control an application on the mobile device; and/or other suitable devices or systems.

Some embodiments may identify multiple (different) users that utilize the same device, or the same account, before or after a typical user profile is built, or even during a training period in which the system learns the behavioral patterns. This may be used for detection of “friendly fraud” incidents, or identification of users for accountability purposes, or identification of the user that utilized a particular function in an Administrator account (e.g., optionally used in conjunction with a requirement that certain users, or users with certain privileges, may not share their password or credentials with any other person); or identification of a licensee in order to detect or prevent software piracy or unauthorized usage by non-licensee user(s), for software or products that are sold or licensed on a per-user basis or a per-seat basis.

Some embodiments may be utilized to identify or detect a remote access attacker, or an attacker or a user that utilizes a remote access channel to access (or to attack, or to compromise) a computerized service, or an attacker or cyber-attacker or hacker or impostor or imposter or “fraudster” that poses as a genuine user or as a true owner of an account, or an automatic script or “bot” or malware. Some embodiments may be used to differentiate or distinguish among, for example, an authorized or legitimate or genuine or human user, as opposed to an illegitimate and/or unauthorized and/or impostor human attacker or human user, and/or as opposed to a “bot” or automatic script or automated script or automated program or malware.

Some embodiments may be utilized for authenticating, or confirming the identity of, a user who is already logged-in or signed-in; or conversely, a user that did not perform (or did not yet perform, or did not complete) a log-in or sign-in process; or a user that did not successfully perform a log-in or sign-in process; or a user who is interacting with a computerized service prior to signing-in or logging in (e.g., filling-out fields in an electronic commerce website as part of checking-out as a guest), or during a log-in process, or after a log-in process; or to confirm the identity of a user who is already-logged-in, or who is not-yet logged-in, or who operates a system or service that does not necessarily require or utilize a log-in process.

The terms “service” or “computerized service”, as used herein, may be or may comprise any suitable service, or system, or device, which may require user authentication in order to authorize user access to it, or in order to authorize performance of one or more particular actions; including, but not limited to, for example, user authentication for accessing or operating or unlocking an electronic device (e.g., smartphone, tablet, smart-watch, laptop computer, desktop computer, smart-home device or appliance, Internet of Things (IoT) device) or service (e.g., banking service or website, brokerage service or website, email account, web-mail, social network, online vendor, online merchant, electronic commerce website or application or “app”), or other system or platform that requires user authentication (e.g., entry into, or exit from, or passage through a gate or card-reader or turnstile; to unlock or open a device or a vehicle; to start or ignite a vehicle; to drive a vehicle).

Although portions of the discussion herein relate, for demonstrative purposes, to wired links and/or wired communications, some embodiments of the present invention are not limited in this regard, and may include one or more wired or wireless links, may utilize one or more components of wireless communication, may utilize one or more methods or protocols of wireless communication, or the like. Some embodiments may utilize wired communication and/or wireless communication.

The system(s) and/or device(s) of the present invention may optionally comprise, or may be implemented by utilizing suitable hardware components and/or software components; for example, processors, processor cores, Central Processing Units (CPUs), Digital Signal Processors (DSPs), circuits, Integrated Circuits (ICs), controllers, memory units, registers, accumulators, storage units, input units (e.g., touch-screen, keyboard, keypad, stylus, mouse, touchpad, joystick, trackball, microphones), output units (e.g., screen, touch-screen, monitor, display unit, audio speakers), acoustic microphone(s) and/or sensor(s), optical microphone(s) and/or sensor(s), laser or laser-based microphone(s) and/or sensor(s), wired or wireless modems or transceivers or transmitters or receivers, GPS receiver or GPS element or other location-based or location-determining unit or system, network elements (e.g., routers, switches, hubs, antennas), and/or other suitable components and/or modules.

The system(s) and/or devices of the present invention may optionally be implemented by utilizing co-located components, remote components or modules, “cloud computing” servers or devices or storage, client/server architecture, peer-to-peer architecture, distributed architecture, and/or other suitable architectures or system topologies or network topologies.

In accordance with embodiments of the present invention, calculations, operations and/or determinations may be performed locally within a single device, or may be performed by or across multiple devices, or may be performed partially locally and partially remotely (e.g., at a remote server) by optionally utilizing a communication channel to exchange raw data and/or processed data and/or processing results.

Some embodiments may be implemented by using a special-purpose machine or a specific-purpose device that is not a generic computer, or by using a non-generic computer or a non-general computer or machine. Such system or device may utilize or may comprise one or more components or units or modules that are not part of a “generic computer” and that are not part of a “general purpose computer”, for example, cellular transceivers, cellular transmitter, cellular receiver, GPS unit, location-determining unit, accelerometer(s), gyroscope(s), device-orientation detectors or sensors, device-positioning detectors or sensors, or the like.

Some embodiments may be implemented as, or by utilizing, an automated method or automated process, or a machine-implemented method or process, or as a semi-automated or partially-automated method or process, or as a set of steps or operations which may be executed or performed by a computer or machine or system or other device.

Some embodiments may be implemented by using code or program code or machine-readable instructions or machine-readable code, which may be stored on a non-transitory storage medium or non-transitory storage article (e.g., a CD-ROM, a DVD-ROM, a physical memory unit, a physical storage unit), such that the program or code or instructions, when executed by a processor or a machine or a computer, cause such processor or machine or computer to perform a method or process as described herein. Such code or instructions may be or may comprise, for example, one or more of: software, a software module, an application, a program, a subroutine, instructions, an instruction set, computing code, words, values, symbols, strings, variables, source code, compiled code, interpreted code, executable code, static code, dynamic code; including (but not limited to) code or instructions in high-level programming language, low-level programming language, object-oriented programming language, visual programming language, compiled programming language, interpreted programming language, C, C++, C#, Java, JavaScript, SQL, Ruby on Rails, Go, Cobol, Fortran, ActionScript, AJAX, XML, JSON, Lisp, Eiffel, Verilog, Hardware Description Language (HDL, BASIC, Visual BASIC, Matlab, Pascal, HTML, HTML5, CSS, Perl, Python, PHP, machine language, machine code, assembly language, or the like.

Discussions herein utilizing terms such as, for example, “processing”, “computing”, “calculating”, “determining”, “establishing”, “analyzing”, “checking”, “detecting”, “measuring”, or the like, may refer to operation(s) and/or process(es) of a processor, a computer, a computing platform, a computing system, or other electronic device or computing device, that may automatically and/or autonomously manipulate and/or transform data represented as physical (e.g., electronic) quantities within registers and/or accumulators and/or memory units and/or storage units into other data or that may perform other suitable operations.

Some embodiments of the present invention may perform steps or operations such as, for example, “determining”, “identifying”, “comparing”, “checking”, “querying”, “searching”, “matching”, and/or “analyzing”, by utilizing, for example: a pre-defined threshold value to which one or more parameter values may be compared; a comparison between (i) sensed or measured or calculated value(s), and (ii) pre-defined or dynamically-generated threshold value(s) and/or range values and/or upper limit value and/or lower limit value and/or maximum value and/or minimum value; a comparison or matching between sensed or measured or calculated data, and one or more values as stored in a look-up table or a legend table or a legend list or a database of possible values or ranges; a comparison or matching or searching process which searches for matches and/or identical results and/or similar results among multiple values or limits that are stored in a database or look-up table; utilization of one or more equations, formula, weighted formula, and/or other calculation in order to determine similarity or a match between or among parameters or values; utilization of comparator units, lookup tables, threshold values, conditions, conditioning logic, Boolean operator(s) and/or other suitable components and/or operations.

The terms “plurality” and “a plurality”, as used herein, include, for example, “multiple” or “two or more”. For example, “a plurality of items” includes two or more items.

References to “one embodiment”, “an embodiment”, “demonstrative embodiment”, “various embodiments”, “some embodiments”, and/or similar terms, may indicate that the embodiment(s) so described may optionally include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, repeated use of the phrase “in one embodiment” does not necessarily refer to the same embodiment, although it may. Similarly, repeated use of the phrase “in some embodiments” does not necessarily refer to the same set or group of embodiments, although it may.

As used herein, and unless otherwise specified, the utilization of ordinal adjectives such as “first”, “second”, “third”, “fourth”, and so forth, to describe an item or an object, merely indicates that different instances of such like items or objects are being referred to; and does not intend to imply as if the items or objects so described must be in a particular given sequence, either temporally, spatially, in ranking, or in any other ordering manner.

Some embodiments may be used in, or in conjunction with, various devices and systems, for example, a Personal Computer (PC), a desktop computer, a mobile computer, a laptop computer, a notebook computer, a tablet computer, a server computer, a handheld computer, a handheld device, a Personal Digital Assistant (PDA) device, a handheld PDA device, a tablet, an on-board device, an off-board device, a hybrid device, a vehicular device, a non-vehicular device, a mobile or portable device, a consumer device, a non-mobile or non-portable device, an appliance, a wireless communication station, a wireless communication device, a wireless Access Point (AP), a wired or wireless router or gateway or switch or hub, a wired or wireless modem, a video device, an audio device, an audio-video (A/V) device, a wired or wireless network, a wireless area network, a Wireless Video Area Network (WVAN), a Local Area Network (LAN), a Wireless LAN (WLAN), a Personal Area Network (PAN), a Wireless PAN (WPAN), or the like.

Some embodiments may be used in conjunction with one way and/or two-way radio communication systems, cellular radio-telephone communication systems, a mobile phone, a cellular telephone, a wireless telephone, a Personal Communication Systems (PCS) device, a PDA or handheld device which incorporates wireless communication capabilities, a mobile or portable Global Positioning System (GPS) device, a device which incorporates a GPS receiver or transceiver or chip, a device which incorporates an RFID element or chip, a Multiple Input Multiple Output (MIMO) transceiver or device, a Single Input Multiple Output (SIMO) transceiver or device, a Multiple Input Single Output (MISO) transceiver or device, a device having one or more internal antennas and/or external antennas, Digital Video Broadcast (DVB) devices or systems, multi-standard radio devices or systems, a wired or wireless handheld device, e.g., a Smartphone, a Wireless Application Protocol (WAP) device, or the like.

Some embodiments may comprise, or may be implemented by using, an “app” or application which may be downloaded or obtained from an “app store” or “applications store”, for free or for a fee, or which may be pre-installed on a computing device or electronic device, or which may be otherwise transported to and/or installed on such computing device or electronic device.

In accordance with some embodiments of the present invention, a system may comprise: a proxy server detector to determine whether: (I) an end-user device is more-probably communicating indirectly with a trusted server via a proxy server, or (II) the end-user device is more-probably communicating directly with the trusted server via a proxy-less communication route.

In some embodiments, the system may comprise: a transport channel failure injector to inject a Negative Acknowledgment (NACK) into a transport channel that connects the trusted server and the end-user device; a Round-Trip Time (RTT) measurer, to measure a first RTT value that corresponds to a first RTT between the end-user device and the trusted server when a cached resource is requested, and to further measure a second RTT value that corresponds to a first RTT between the end-user device and the trusted server when a non-cached resource is requested; an RTT comparator to compare the first RTT value and the second RTT value; wherein the proxy server detector is to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on comparison of the first RTT value and the second RTT value.

In some embodiments, the system may comprise: a transport channel failure injector to inject a Negative Acknowledgment (NACK) into a transport channel that connects the trusted server and the end-user device; a Round-Trip Time (RTT) measurer, to measure a first RTT value that corresponds to a first RTT between the end-user device and the trusted server when a cached resource is requested, and to further measure a second RTT value that corresponds to a first RTT between the end-user device and the trusted server when a non-cached resource is requested; an RTT comparator to compare the first RTT value and the second RTT value; a proxy detector to determine that a proxy server more-probably exists, between the end-user device and the trusted server, if the first RTT value differs from the second RTT value by at least a pre-defined threshold difference.

In some embodiments, the system may comprise: a transport channel failure injector to inject a Reset (RST) packet into a transport channel that connects the trusted server and the end-user device; a Round-Trip Time (RTT) measurer, to measure a first RTT value that corresponds to a first RTT between the end-user device and the trusted server when a cached resource is requested, and to further measure a second RTT value that corresponds to a first RTT between the end-user device and the trusted server when a non-cached resource is requested; an RTT comparator to compare the first RTT value and the second RTT value; wherein the proxy server detector to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on comparison of the first RTT value and the second RTT value.

In some embodiments, the system may comprise: a transport channel failure injector to inject a Reset (RST) packet into a transport channel that connects a trusted server and an end-user device; a Round-Trip Time (RTT) measurer, to measure a first RTT value that corresponds to a first RTT between the end-user device and the trusted server when a cached resource is requested, and to further measure a second RTT value that corresponds to a first RTT between the end-user device and the trusted server when a non-cached resource is requested; an RTT comparator to compare the first RTT value and the second RTT value; wherein the proxy server detector to determine that a proxy server more-probably exists, between the end-user device and the trusted server, if the first RTT value differs from the second RTT value by at least a pre-defined threshold difference.

In some embodiments, the system may comprise: a Secure Socket Layer (SSL) header cipher collector, to collect SSL header ciphers that are actually used by the end-user device communicating with the trusted server; an SSL header cipher matcher, to detect a discrepancy between: (I) collected SSL header ciphers that are actually used by the end-user device, and (II) a set of SSL cipher headers that are declared by a browser of said end-user device; wherein the proxy server detector is to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on said discrepancy between: (I) collected SSL header ciphers that are actually used by the end-user device, and (II) the set of SSL cipher headers that are declared by a browser of said end-user device.

In some embodiments, the system may comprise: a Secure Socket Layer (SSL) header cipher collector, to collect SSL header ciphers that are actually used by the end-user device communicating with the trusted server; an SSL header cipher matcher, to detect a discrepancy between: (I) collected SSL header ciphers that are actually used by the end-user device, and (II) a set of SSL cipher headers that are declared by a browser of said end-user device; a spoofing detector to determine that identity spoofing is performed relative to said end-user device, based on said discrepancy between: (I) collected SSL header ciphers that are actually used by the end-user device, and (II) the set of SSL cipher headers that are declared by a browser of said end-user device.

In some embodiments, the system may comprise: a requests generator to generate a batch of TCP/IP requests; a TCP source-port identifier to identify a TCP source-port for each of the TCP/IP; a TCP source-port entropy analyzer to analyze a distribution of TCP source-ports associated with said batch; wherein the proxy server detector is to determine, based on entropy analysis of the distribution of TCP source-ports associated with said batch, that a proxy server more-probably exists, between the end-user device and the trusted server.

In some embodiments, the system may comprise: a requests generator to generate a batch of TCP/IP requests; a TCP source-port identifier to identify a TCP source-port for each of the TCP/IP; a TCP source-port sequencing analyzer to analyze a sequencing of TCP source-ports associated with said batch; wherein the proxy server detector to determine, based on sequencing analysis of the sequencing of TCP source-ports associated with said batch, that a proxy server more-probably exists, between the end-user device and the trusted server.

In some embodiments, the system may comprise: a local-time extractor to extract, locally at the end-user device, a local time zone that is reported locally at the end-user device; a geo-location mismatch detector, to detect a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) an alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device; wherein the proxy server detector to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) the alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device.

In some embodiments, the system may comprise: a preferred-language extractor to extract, locally at the end-user device, an identifier of a preferred natural language that is reported locally at the end-user device; a geo-location mismatch detector, to detect that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) a geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device; wherein the proxy server detector is to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on a determination that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) the geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device.

In some embodiments, the system may comprise: an HTTP-header modifier to modify an HTTP header, that is intended for transmission to the end-user device, to be an HTTP-violating non-HTTP-compliant header; wherein the proxy server detector to perform an evaluation of a response of the end-user device to said HTTP-violating non-HTTP-compliant header, and to determine whether or not a proxy server more-probably exists, between the end-user device and the trusted server, based on said evaluation results.

In some embodiments, the system may comprise: an HTTP-header duplicator to modify an original HTTP header, that is intended for transmission to the end-user device, into a duplicate HTTP header that comprises two or more duplicate copies of said original HTTP header; wherein the proxy server detector is to perform an evaluation of a response of the end-user device to said duplicate HTTP header, and to determine whether or not a proxy server more-probably exists, between the end-user device and the trusted server, based on said evaluation results; wherein, if the proxy server detector evaluates that no error signal was received back from the end-user device in response to the duplicate HTTP header, then the proxy server detector is to determine that a proxy server more probably exists; wherein, if the proxy server detector evaluates that an error signal was received back from the end-user device in response to the duplicate HTTP header, then the proxy server detector is to determine that a proxy server more probably does not exist.

In some embodiments, the system may comprise: a reverse Domain Name Server (DNS) query module, (a) to perform a reverse DNS query on an Internet Protocol (IP) address of the end-user device, (b) to determine whether or not a reverse IP record exists for said IP address, (c) to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on determining that a reverse IP record exists for said IP address.

In some embodiments, the system may comprise: an HTTP header analyzer, (a) to perform analysis of an incoming HTTP header that is received from said end-user device; (b) to determine that said incoming HTTP header was modified relative to an expected HTTP header; (c) to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

In some embodiments, the system may comprise: an HTTP header analyzer, (a) to perform analysis of an incoming HTTP header that is received from said end-user device; (b) to determine that said incoming HTTP header was modified relative to an expected HTTP header, by detecting a particular content-item in a Via field of said incoming HTTP header; (c) to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

In some embodiments, the system may comprise: an HTTP header analyzer, (a) to perform analysis of an incoming HTTP header that is received from said end-user device; (b) to determine that said incoming HTTP header was modified relative to an expected HTTP header, by detecting a particular content-item in a X-Forwarded For (XFF) field of said incoming HTTP header; (c) to determine that a proxy server more-probably exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

In some embodiments, the system may comprise: a browser identity detector, (a) to analyze transmission channel parameters, that exclude a User Agent field reported by the end-user device; (b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, to determine an actual browser identity of the end-user device; (c) to determine a mismatch between: (I) a reported browser identity as reported by the User Agent field of the end-user device, and (II) the actual browser identity of the end-user device as determined by the browser identity detector without relying on the User Agent field reported by the end-user device; (d) based on said mismatch, to determine that a proxy server more-probably exists between the end-user device and the trusted server.

In some embodiments, the system may comprise: an Operating System detector, (a) to analyze transmission channel parameters, that exclude a User Agent field reported by the end-user device; (b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, to determine an actual Operating System identity of the end-user device; (c) to determine a mismatch between: (I) a reported Operating System identity as reported by the User Agent field of the end-user device, and (II) the actual Operating System identity of the end-user device as determined by the Operating System detector without relying on the User Agent field reported by the end-user device; (d) based on said mismatch, to determine that a proxy server more-probably exists between the end-user device and the trusted server.

In some embodiments, the system may comprise: a ports connector and analyzer, (a) to attempt to connect through a particular port to an originating Internet Protocol (IP) address) of the end-user device; (b) to determine that a proxy server exists and is utilized, if a response is received to said attempt to connect through said particular port to said originating IP address of the end-user device.

In some embodiments, the system may comprise: a ports connector and analyzer, (a) to attempt to connect through a particular port to an originating Internet Protocol (IP) address) of the end-user device, wherein said particular port comprises a port selected from the group consisting of: port 80, port 8080, port 443, port 8888; and (b) to determine that a proxy server exists and is utilized, if a response is received to said attempt to connect through said particular port to said originating IP address of the end-user device.

In some embodiments, the system may comprise: a Domain Name Server (DNS) failed requests manager, (a) to send to the end-user device an outgoing request for a resource, wherein the outgoing request is sent from a one-time subdomain of a domain that is controlled by a trusted server; (b) to ignore incoming queries to resolve said one-time subdomain, that are received from Domain Name Servers; (c) to detect an incoming attempt to resolve directly said one-time subdomain; (d) based on detecting said incoming attempt to resolve directly said one-time subdomain, to determine that a proxy server exists and is utilized.

In some embodiments, the system may comprise: a proxy lists scraper and analyzer, (a) to scrape a list of proxy servers and their characteristics, and (b) to analyze incoming traffic from an end-user device, and (c) and to determine that a proxy server exists by identifying a proxy server characteristic in said incoming traffic.

In some embodiments, the system may comprise: a non-relayed-data sender, (a) to send to said end-user device a data-item that is not relayed by proxy servers; and (b) based on a local determination in said end-user device, that said data-item was not received at the end-user device, to determine that a proxy server exists.

In some embodiments, the system may comprise: an Internet Protocol (IP) addresses manager, (a) to determine IP addresses of multiple sessions that originate from different end-user devices; (b) to detect a particular IP address which is reported as originating IP address for at least K different end-user devices, wherein K is a pre-defined positive threshold value; (c) to determine that said particular IP address belongs to a proxy server.

In some embodiments, the proxy server detector is to determine that traffic from the end-user device is incoming to a trusted server from an exit node of The Onion Router (TOR) network; and to determine that the end-user device utilizes TOR network as web proxy.

In some embodiments, the system may comprise: an HTTP to WebSockets upgrader and inspector module, (a) to attempt to upgrade an HTTP connection to a WebSockets connection, (b) to detect that said attempt fails even though end-user device parameters indicate support for WebSockets, and (c) to determine that more probably a proxy server exists between the end-user device and the trusted server.

Functions, operations, components and/or features described herein with reference to one or more embodiments of the present invention, may be combined with, or may be utilized in combination with, one or more other functions, operations, components and/or features described herein with reference to one or more other embodiments of the present invention. The present invention may comprise any possible combinations, re-arrangements, assembly, re-assembly, or other utilization of some or all of the modules or functions or components that are described herein, even if they are discussed in different locations or different chapters of the above discussion, or even if they are shown across different drawings or multiple drawings.

While certain features of some demonstrative embodiments of the present invention have been illustrated and described herein, various modifications, substitutions, changes, and equivalents may occur to those skilled in the art. Accordingly, the claims are intended to cover all such modifications, substitutions, changes, and equivalents.

Claims

1. A system comprising: a proxy server detector device able to determine that a proxy server is utilized by an end-user using a computer device over a communication network for accessing a trusted server,wherein the proxy server detector device is configured to determine whether: (I) the end-user device is communicating indirectly with the trusted server via a proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;wherein the proxy server detector device comprises:a transport channel failure injector to inject a Negative Acknowledgment (NACK) into a transport channel that connects the trusted server and the end-user device;a Round-Trip Time (RTT) measurer, to measure a first RTT value that corresponds to a first RTT between the end-user device and the trusted server when a cached resource is requested, and to further measure a second RTT value that corresponds to a second RTT between the end-user device and the trusted server when a non-cached resource is requested;an RTT comparator to compare the first RTT value and the second RTT value; wherein the proxy server detector device is to determine that a proxy server exists, between the end-user device and the trusted server, based on comparison of the first RTT value and the second RTT value.
2. The system of claim 1, wherein the proxy server detector device is to determine that a proxy server exists, between the end-user device and the trusted server, if the first RTT value differs from the second RTT value by at least a pre-defined threshold difference.
3. The system of claim 1, wherein the transport channel failure injector is to inject a Reset (RST) packet into the transport channel that connects the trusted server and the end-user device.
4. The system of claim 1, wherein the transport channel failure injector is to inject a Reset (RST) packet into transport channel that connects a trusted server and an end-user device.
5. The system of claim 1, comprising: a proxy lists scraper and analyzer, (a) to scrape a list of proxy servers and their characteristics, and (b) to analyze incoming traffic from an end-user device, and (c) and to determine that a proxy server exists by identifying a proxy server characteristic in said incoming traffic.
6. The system of claim 1, comprising: a non-relayed-data sender, (a) to send to said end-user device a data-item that is not relayed by proxy servers; and (b) based on a local determination in said end-user device, that said data-item was not received at the end-user device, to determine that a proxy server exists.
7. The system of claim 1, comprising: a requests generator to generate a batch of TCP/IP requests;a TCP source-port identifier to identify a TCP source-port for each of the TCP/IP;a TCP source-port entropy analyzer to analyze a distribution of TCP source-ports associated with said batch;wherein the proxy server detector device is to determine, based on entropy analysis of the distribution of TCP source-ports associated with said batch, that a proxy server exists, between the end-user device and the trusted server.
8. The system of claim 1, comprising: a requests generator to generate a batch of TCP/IP requests;a TCP source-port identifier to identify a TCP source-port for each of the TCP/IP;a TCP source-port sequencing analyzer to analyze a sequencing of TCP source-ports associated with said batch;wherein the proxy server detector device is to determine, based on sequencing analysis of the sequencing of TCP source-ports associated with said batch, that a proxy server exists, between the end-user device and the trusted server.
9. The system of claim 1, comprising: a local-time extractor to extract, locally at the end-user device, a local time zone that is reported locally at the end-user device;a geo-location mismatch detector, to detect a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) an alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device;wherein the proxy server detector device is to determine that a proxy server exists, between the end-user device and the trusted server, based on a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) the alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device.
10. The system of claim 1, comprising: a preferred-language extractor to extract, locally at the end-user device, an identifier of a preferred natural language that is reported locally at the end-user device; a geo-location mismatch detector, to detect that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) a geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device;wherein the proxy server detector device is to determine that a proxy server exists, between the end-user device and the trusted server, based on a determination that (I) the preferred natural language as extracted locally at the end-user device, is not an official language of (II) the geographical region associated with an originating Internet Protocol (IP) address associated with the end-user device.
11. The system of claim 1, comprising: an HTTP-header modifier to modify an HTTP header, that is intended for transmission to the end-user device, to be an HTTP-violating non-HTTP-compliant header;wherein the proxy server detector device is to perform an evaluation of a response of the end-user device to said HTTP-violating non-HTTP-compliant header, and to determine whether or not a proxy server exists, between the end-user device and the trusted server, based on said evaluation results.
12. The system of claim 1, comprising: an HTTP-header duplicator to modify an original HTTP header, that is intended for transmission to the end-user device, into a duplicate HTTP header that comprises two or more duplicate copies of said original HTTP header;wherein the proxy server detector device is to perform an evaluation of a response of the end-user device to said duplicate HTTP header, and to determine whether or not a proxy server exists, between the end-user device and the trusted server, based on said evaluation results;wherein, if the proxy server detector device evaluates that no error signal was received back from the end-user device in response to the duplicate HTTP header, then the proxy server detector device is to determine that a proxy server exists;wherein, if the proxy server detector device evaluates that an error signal was received back from the end-user device in response to the duplicate HTTP header, then the proxy server detector device is to determine that a proxy server does not exist.
13. The system of claim 1, comprising: a reverse Domain Name Server (DNS) query module,
14. The system of claim 1, comprising: an HTTP header analyzer,
15. The system of claim 1, comprising: an HTTP header analyzer,
16. The system of claim 1, comprising: an HTTP header analyzer,
17. The system of claim 1, comprising: a browser identity detector,
18. The system of claim 1, comprising: an Operating System detector,
19. The system of claim 1, comprising: a ports connector and analyzer,
20. The system of claim 1, comprising: a ports connector and analyzer,
21. The system of claim 1, comprising: a Domain Name Server (DNS) failed requests manager,
22. The system of claim 1, comprising: an Internet Protocol (IP) addresses manager,
23. The system of claim 1, wherein the proxy server detector device is to determine that traffic from the end-user device is incoming to a trusted server from an exit node of The Onion Router (TOR) network; and to determine that the end-user device utilizes TOR network as web proxy.
24. The system of claim 1, comprising: an HTTP to WebSockets upgrader and inspector module,

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation of U.S. patent application Ser. No. 15/203,817, filed on Jul. 7, 2016, which is hereby incorporated by reference in its entirety; which claimed priority and benefit from U.S. provisional patent application Ser. No. 62/190,264, filed on Jul. 9, 2015, which is hereby incorporated by reference in its entirety.

US Referenced Citations (416)

Number	Name	Date	Kind
3618019	Nemirovsky	Nov 1971	A
3699517	Dyche	Oct 1972	A
3983535	Herbst	Sep 1976	A
4128829	Herbst	Dec 1978	A
4621334	Garcia	Nov 1986	A
4760386	Heath	Jul 1988	A
4805222	Young	Feb 1989	A
5305238	Starr	Apr 1994	A
5442342	Kung	Aug 1995	A
5485171	Copper	Jan 1996	A
5557686	Brown	Sep 1996	A
5565657	Merz	Oct 1996	A
5581261	Hickman	Dec 1996	A
5838306	O'Connor	Nov 1998	A
5874941	Yamada	Feb 1999	A
5999162	Takahashi	Dec 1999	A
6202023	Hancock	Mar 2001	B1
6337686	Wong	Jan 2002	B2
6337919	Dunton	Jan 2002	B1
6442692	Zilberman	Aug 2002	B1
6572014	Lambert	Jun 2003	B1
6819219	Bolle	Nov 2004	B1
6836554	Bolle	Dec 2004	B1
6895514	Kermani	May 2005	B1
6931131	Becker	Aug 2005	B1
6938061	Rumynin	Aug 2005	B1
6938159	O'Connor	Aug 2005	B1
6957185	Labaton	Oct 2005	B1
6957186	Guheen	Oct 2005	B1
6983061	Ikegami	Jan 2006	B2
7092926	Cerrato	Aug 2006	B2
7130452	Bolle	Oct 2006	B2
7133792	Murakami	Nov 2006	B2
7139916	Billingsley	Nov 2006	B2
7158118	Liberty	Jan 2007	B2
7236156	Liberty	Jun 2007	B2
7245218	Ikehara	Jul 2007	B2
7366919	Sobel	Apr 2008	B1
7395436	Nemovicher	Jul 2008	B1
7494061	Reinhold	Feb 2009	B2
7523191	Thomas	Apr 2009	B1
7535456	Liberty	May 2009	B2
7606915	Calinov	Oct 2009	B1
7796013	Murakami	Sep 2010	B2
7818290	Davis	Oct 2010	B2
7860870	Sadagopan	Dec 2010	B2
8031175	Rigazio	Oct 2011	B2
8065624	Morin	Nov 2011	B2
8125312	Orr	Feb 2012	B2
8156324	Shnowske	Apr 2012	B1
8201222	Inoue	Jun 2012	B2
8285658	Kellas-Dicks	Oct 2012	B1
8417960	Takahashi	Apr 2013	B2
8433785	Awadallah	Apr 2013	B2
8449393	Sobel	May 2013	B2
8499245	Froment	Jul 2013	B1
8510113	Conkie	Aug 2013	B1
8548208	Schultz	Oct 2013	B2
8549629	Mccreesh	Oct 2013	B1
8555077	Davis	Oct 2013	B2
8745729	Poluri	Jun 2014	B2
8788838	Fadell	Aug 2014	B1
8803797	Scott	Aug 2014	B2
8819812	Weber	Aug 2014	B1
8832823	Boss	Sep 2014	B2
8838060	Walley	Sep 2014	B2
8880441	Chen	Nov 2014	B1
8898787	Thompson	Nov 2014	B2
8938787	Turgeman	Jan 2015	B2
8941466	Bayram	Jan 2015	B2
8990959	Zhu	Mar 2015	B2
9069942	Turgeman	Jun 2015	B2
9071969	Turgeman	Jun 2015	B2
9154534	Gayles	Oct 2015	B1
9174123	Nasiri	Nov 2015	B2
9195351	Rosenberg	Nov 2015	B1
9275337	Turgeman	Mar 2016	B2
9282112	Filatov	Mar 2016	B2
9301140	Costigan	Mar 2016	B1
9304915	Adams	Apr 2016	B2
9418221	Turgeman	Aug 2016	B2
9450971	Turgeman	Sep 2016	B2
9477826	Turgeman	Oct 2016	B2
9483292	Turgeman	Nov 2016	B2
9526006	Turgeman	Dec 2016	B2
9529987	Deutschmann	Dec 2016	B2
9531701	Turgeman	Dec 2016	B2
9531733	Turgeman	Dec 2016	B2
9536071	Turgeman	Jan 2017	B2
9541995	Turgeman	Jan 2017	B2
9547766	Turgeman	Jan 2017	B2
9552470	Turgeman	Jan 2017	B2
9558339	Turgeman	Jan 2017	B2
9589120	Samuel	Mar 2017	B2
9621567	Turgeman	Apr 2017	B2
9626677	Turgeman	Apr 2017	B2
9665703	Turgeman	May 2017	B2
9674218	Turgeman	Jun 2017	B2
9690915	Turgeman	Jun 2017	B2
9703953	Turgeman	Jul 2017	B2
9710316	Chheda	Jul 2017	B1
9712558	Turgeman	Jul 2017	B2
9747436	Turgeman	Aug 2017	B2
9779423	Turgeman	Oct 2017	B2
9838373	Turgeman	Dec 2017	B2
9848009	Turgeman	Dec 2017	B2
9927883	Lin	Mar 2018	B1
10032010	Turgeman	Jul 2018	B2
10037421	Turgeman	Jul 2018	B2
10049209	Turgeman	Aug 2018	B2
10055560	Turgeman	Aug 2018	B2
10069837	Turgeman	Sep 2018	B2
10069852	Turgeman	Sep 2018	B2
10079853	Turgeman	Sep 2018	B2
10083439	Turgeman	Sep 2018	B2
10164985	Turgeman	Dec 2018	B2
10198122	Turgeman	Feb 2019	B2
10262324	Turgeman	Apr 2019	B2
10298614	Turgeman	May 2019	B2
20010004733	Eldering	Jun 2001	A1
20020023229	Hangai	Feb 2002	A1
20020089412	Heger	Jul 2002	A1
20030033526	French	Feb 2003	A1
20030074201	Grashey	Apr 2003	A1
20030137494	Tulbert	Jul 2003	A1
20030212811	Thornton	Nov 2003	A1
20040015714	Abraham	Jan 2004	A1
20040017355	Shim	Jan 2004	A1
20040021643	Hoshino	Feb 2004	A1
20040034784	Fedronic	Feb 2004	A1
20040062423	Doi	Apr 2004	A1
20040111523	Hall	Jun 2004	A1
20040123156	Hammond, II	Jun 2004	A1
20040143737	Teicher	Jul 2004	A1
20040186882	Ting	Sep 2004	A1
20040221171	Ahmed	Nov 2004	A1
20050008148	Jacobson	Jan 2005	A1
20050060138	Wang	Mar 2005	A1
20050179657	Russo	Aug 2005	A1
20050289264	Illowsky	Dec 2005	A1
20060006803	Huang	Jan 2006	A1
20060080263	Willis	Apr 2006	A1
20060090073	Steinberg	Apr 2006	A1
20060123101	Buccella	Jun 2006	A1
20060143454	Walmsley	Jun 2006	A1
20060195328	Abraham	Aug 2006	A1
20060215886	Black	Sep 2006	A1
20060224898	Ahmed	Oct 2006	A1
20060282660	Varghese	Dec 2006	A1
20060284969	Kim	Dec 2006	A1
20070118804	Raciborski	May 2007	A1
20070156443	Gurvey	Jul 2007	A1
20070174082	Singh	Jul 2007	A1
20070183633	Hoffmann	Aug 2007	A1
20070214426	Ruelle	Sep 2007	A1
20070226797	Thompson	Sep 2007	A1
20070236330	Cho	Oct 2007	A1
20070240230	O'Connell	Oct 2007	A1
20070250920	Lindsay	Oct 2007	A1
20070255821	Ge	Nov 2007	A1
20070266305	Cong	Nov 2007	A1
20070271466	Mak	Nov 2007	A1
20070283416	Renaud	Dec 2007	A1
20080046982	Parkinson	Feb 2008	A1
20080059474	Lim	Mar 2008	A1
20080068343	Hoshino	Mar 2008	A1
20080084972	Burke	Apr 2008	A1
20080091639	Davis	Apr 2008	A1
20080092209	Davis	Apr 2008	A1
20080092245	Alward	Apr 2008	A1
20080097851	Bemmel	Apr 2008	A1
20080098456	Alward	Apr 2008	A1
20080120717	Shakkarwar	May 2008	A1
20080136790	Hio	Jun 2008	A1
20080162449	Chao-Yu	Jul 2008	A1
20080183745	Cancel	Jul 2008	A1
20080192005	Elgoyhen	Aug 2008	A1
20080200310	Tagliabue	Aug 2008	A1
20080211766	Westerman	Sep 2008	A1
20080215576	Zhao	Sep 2008	A1
20080263636	Gusler	Oct 2008	A1
20080298588	Shakkarwar	Dec 2008	A1
20080301808	Calo	Dec 2008	A1
20080306897	Liu	Dec 2008	A1
20090037983	Chiruvolu	Feb 2009	A1
20090038010	Ma	Feb 2009	A1
20090089879	Wang	Apr 2009	A1
20090094311	Awadallah	Apr 2009	A1
20090132395	Lam	May 2009	A1
20090157792	Fiatal	Jun 2009	A1
20090172551	Kane	Jul 2009	A1
20090189736	Hayashi	Jul 2009	A1
20090199296	Xie	Aug 2009	A1
20090227232	Matas	Sep 2009	A1
20090241188	Komura	Sep 2009	A1
20090254336	Dumais	Oct 2009	A1
20090281979	Tysowski	Nov 2009	A1
20090293119	Jonsson	Nov 2009	A1
20090320123	Yu	Dec 2009	A1
20100007632	Yamazaki	Jan 2010	A1
20100040293	Hermann	Feb 2010	A1
20100042387	Gibbon	Feb 2010	A1
20100042403	Chandrasekar	Feb 2010	A1
20100046806	Baughman	Feb 2010	A1
20100070405	Joa	Mar 2010	A1
20100077470	Kozat	Mar 2010	A1
20100082747	Yue	Apr 2010	A1
20100082998	Kohavi	Apr 2010	A1
20100115610	Tredoux	May 2010	A1
20100122082	Deng	May 2010	A1
20100125816	Bezos	May 2010	A1
20100138370	Wu	Jun 2010	A1
20100164897	Morin	Jul 2010	A1
20100171753	Kwon	Jul 2010	A1
20100197352	Runstedler	Aug 2010	A1
20100269165	Chen	Oct 2010	A1
20100281539	Burns	Nov 2010	A1
20100284532	Burnett	Nov 2010	A1
20100287229	Hauser	Nov 2010	A1
20100321304	Rofougaran	Dec 2010	A1
20100328074	Johnson	Dec 2010	A1
20110010209	McNally	Jan 2011	A1
20110012829	Yao	Jan 2011	A1
20110016320	Bergsten	Jan 2011	A1
20110016534	Jakobsson	Jan 2011	A1
20110018828	Wu	Jan 2011	A1
20110023115	Wright	Jan 2011	A1
20110029902	Bailey	Feb 2011	A1
20110039529	Kim	Feb 2011	A1
20110039602	McNamara	Feb 2011	A1
20110043475	Rigazio	Feb 2011	A1
20110050394	Zhang	Mar 2011	A1
20110063211	Hoerl	Mar 2011	A1
20110065504	Dugan	Mar 2011	A1
20110102570	Wilf	May 2011	A1
20110105859	Popovic	May 2011	A1
20110113388	Eisen	May 2011	A1
20110119370	Huang	May 2011	A1
20110154273	Aburada	Jun 2011	A1
20110159650	Shiraishi	Jun 2011	A1
20110159850	Faith	Jun 2011	A1
20110162076	Song	Jun 2011	A1
20110191820	Ivey	Aug 2011	A1
20110193737	Chiueh	Aug 2011	A1
20110202453	Issa	Aug 2011	A1
20110221684	Rydenhag	Sep 2011	A1
20110223888	Esaki	Sep 2011	A1
20110225644	Pullikottil	Sep 2011	A1
20110246902	Tsai	Oct 2011	A1
20110248941	Abdo	Oct 2011	A1
20110251823	Davis et al.	Oct 2011	A1
20110271342	Chung	Nov 2011	A1
20110276414	Subbarao	Nov 2011	A1
20110304531	Brooks	Dec 2011	A1
20110320822	Lind	Dec 2011	A1
20120005483	Patvarczki	Jan 2012	A1
20120005719	McDougal	Jan 2012	A1
20120007821	Zaliva	Jan 2012	A1
20120054834	King	Mar 2012	A1
20120096555	Mahaffey	Apr 2012	A1
20120102551	Bidare	Apr 2012	A1
20120113061	Ikeda	May 2012	A1
20120124662	Baca	May 2012	A1
20120133055	Machida	May 2012	A1
20120151044	Luna	Jun 2012	A1
20120151559	Koudys	Jun 2012	A1
20120154173	Chang	Jun 2012	A1
20120154273	McDade, Sr.	Jun 2012	A1
20120154823	Sakamoto	Jun 2012	A1
20120158503	Mardikar	Jun 2012	A1
20120159599	Szoke	Jun 2012	A1
20120164978	Conti	Jun 2012	A1
20120167170	Shi	Jun 2012	A1
20120167204	Akka	Jun 2012	A1
20120174213	Geiger	Jul 2012	A1
20120188198	Jeong	Jul 2012	A1
20120204257	O'Connell	Aug 2012	A1
20120218193	Weber	Aug 2012	A1
20120246737	Paxton	Sep 2012	A1
20120252410	Williams	Oct 2012	A1
20120278804	Narayanasamy	Nov 2012	A1
20120284380	Anderson, III	Nov 2012	A1
20130024239	Baker	Jan 2013	A1
20130036416	Raju	Feb 2013	A1
20130076650	Vik	Mar 2013	A1
20130088434	Masuda	Apr 2013	A1
20130097682	Zeljkovic	Apr 2013	A1
20130097706	Titonis	Apr 2013	A1
20130111586	Jackson	May 2013	A1
20130133055	Ali	May 2013	A1
20130135218	Jain	May 2013	A1
20130139248	Rhee	May 2013	A1
20130154999	Guard	Jun 2013	A1
20130162603	Peng	Jun 2013	A1
20130167212	Azar	Jun 2013	A1
20130173737	Liu	Jul 2013	A1
20130212674	Boger	Aug 2013	A1
20130226992	Bapst	Aug 2013	A1
20130239195	Turgeman	Sep 2013	A1
20130239206	Draluk	Sep 2013	A1
20130282637	Costigan	Oct 2013	A1
20130288647	Turgeman	Oct 2013	A1
20130305357	Ayyagari	Nov 2013	A1
20130312097	Turnbull	Nov 2013	A1
20130335349	Ferren	Dec 2013	A1
20140033317	Barber	Jan 2014	A1
20140041020	Zhao	Feb 2014	A1
20140078061	Simons	Mar 2014	A1
20140078193	Barnhoefer	Mar 2014	A1
20140082369	Waclawsky	Mar 2014	A1
20140111451	Park	Apr 2014	A1
20140118520	Slaby	May 2014	A1
20140143304	Hegarty	May 2014	A1
20140168093	Lawrence	Jun 2014	A1
20140196119	Hill	Jul 2014	A1
20140200953	Mun	Jul 2014	A1
20140250538	Rapaport	Sep 2014	A1
20140259130	Li	Sep 2014	A1
20140270571	Dwan	Sep 2014	A1
20140283059	Sambamurthy	Sep 2014	A1
20140317028	Turgeman	Oct 2014	A1
20140317726	Turgeman	Oct 2014	A1
20140317734	Valencia	Oct 2014	A1
20140317744	Turgeman	Oct 2014	A1
20140325223	Turgeman	Oct 2014	A1
20140325645	Turgeman	Oct 2014	A1
20140325646	Turgeman	Oct 2014	A1
20140325682	Turgeman	Oct 2014	A1
20140337786	Luo	Nov 2014	A1
20140344927	Turgeman	Nov 2014	A1
20150002479	Kawamura	Jan 2015	A1
20150012920	De Santis	Jan 2015	A1
20150062078	Christman	Mar 2015	A1
20150091858	Rosenberg	Apr 2015	A1
20150094030	Turgeman	Apr 2015	A1
20150101031	Harjanto	Apr 2015	A1
20150146945	Han	May 2015	A1
20150205944	Turgeman	Jul 2015	A1
20150205955	Turgeman	Jul 2015	A1
20150205957	Turgeman	Jul 2015	A1
20150205958	Turgeman	Jul 2015	A1
20150212843	Turgeman	Jul 2015	A1
20150213244	Lymberopoulos	Jul 2015	A1
20150213246	Turgeman	Jul 2015	A1
20150213251	Turgeman	Jul 2015	A1
20150256528	Turgeman	Sep 2015	A1
20150256556	Kaminsky	Sep 2015	A1
20150264572	Turgeman	Sep 2015	A1
20150268768	Woodhull	Sep 2015	A1
20150310196	Turgeman et al.	Oct 2015	A1
20160006800	Summers	Jan 2016	A1
20160034673	Chandra	Feb 2016	A1
20160042164	Goldsmith et al.	Feb 2016	A1
20160077620	Choi	Mar 2016	A1
20160109969	Keating	Apr 2016	A1
20160132105	Turgeman	May 2016	A1
20160164905	Pinney Wood et al.	Jun 2016	A1
20160164906	Pinney Wood et al.	Jun 2016	A1
20160174044	Jones	Jun 2016	A1
20160179245	Johansson	Jun 2016	A1
20160191237	Roth	Jun 2016	A1
20160196414	Stuntebeck	Jul 2016	A1
20160197918	Turgeman	Jul 2016	A1
20160209948	Tulbert	Jul 2016	A1
20160226865	Chen	Aug 2016	A1
20160294837	Turgeman	Oct 2016	A1
20160300054	Turgeman	Oct 2016	A1
20160306974	Turgeman	Oct 2016	A1
20160307191	Turgeman	Oct 2016	A1
20160307201	Turgeman	Oct 2016	A1
20160321445	Turgeman	Nov 2016	A1
20160321689	Turgeman	Nov 2016	A1
20160342826	Apostolos	Nov 2016	A1
20160344783	Kushimoto	Nov 2016	A1
20160364138	Luo	Dec 2016	A1
20160366177	Turgeman	Dec 2016	A1
20160371476	Turgeman	Dec 2016	A1
20170011217	Turgeman	Jan 2017	A1
20170012988	Turgeman	Jan 2017	A1
20170017781	Turgeman	Jan 2017	A1
20170032114	Turgeman	Feb 2017	A1
20170034210	Talmor	Feb 2017	A1
20170048272	Yamamura et al.	Feb 2017	A1
20170054702	Turgeman	Feb 2017	A1
20170076089	Turgeman	Mar 2017	A1
20170085587	Turgeman	Mar 2017	A1
20170090418	Tsang	Mar 2017	A1
20170091450	Turgeman	Mar 2017	A1
20170126735	Turgeman	May 2017	A1
20170140279	Turgeman	May 2017	A1
20170149958	Xian	May 2017	A1
20170154366	Turgeman	Jun 2017	A1
20170193526	Turgeman	Jul 2017	A1
20170195354	Kesin	Jul 2017	A1
20170195356	Turgeman	Jul 2017	A1
20170221064	Turgeman	Aug 2017	A1
20170302340	Berlin	Oct 2017	A1
20170364919	Ranganath	Dec 2017	A1
20180012227	Tunnell	Jan 2018	A1
20180034850	Turgeman	Feb 2018	A1
20180095596	Turgeman	Apr 2018	A1
20180103047	Turgeman	Apr 2018	A1
20180107836	Boger	Apr 2018	A1
20180115899	Kedem	Apr 2018	A1
20180121640	Turgeman	May 2018	A1
20180160309	Turgeman	Jun 2018	A1
20180314816	Turgeman	Nov 2018	A1
20180349583	Turgeman	Dec 2018	A1
20180350144	Rathod	Dec 2018	A1
20180351959	Turgeman	Dec 2018	A1
20190028497	Karabchevsky	Jan 2019	A1
20190057200	Sabag	Feb 2019	A1
20190121956	Turgeman	Apr 2019	A1
20190156034	Kedem	May 2019	A1
20190158535	Kedem	May 2019	A1
20190220863	Novick	Jul 2019	A1

Foreign Referenced Citations (16)

Number	Date	Country
2410450	Jan 2012	EP
2410450	Jan 2012	EP
2477136	Jul 2012	EP
2477136	Jul 2012	EP
2610776	Jul 2013	EP
2610776	Jul 2013	EP
2646904	Aug 2018	EP
3019991	Feb 2019	EP
2338092	May 2010	ES
2338092	May 2010	ES
2005009166	Oct 2005	WO
2005099166	Oct 2005	WO
2007146437	Dec 2007	WO
2007146437	Dec 2007	WO
2012073233	Jun 2012	WO
2012073233	Jun 2012	WO

Non-Patent Literature Citations (41)

Entry
International Search Report for PCT international application PCT/IL2018/051246, dated Mar. 11, 2019.
Written Opinion of the International Searching Authority for PCT international application PCT/IL2018/051246, dated Mar. 11, 2019.
Written Opinion of the International Searching Authority for PCT international application PCT/IL2011/000907, dated Apr. 19, 2012.
Written Opinion of the International Searching Authority for PCT international application PCT/IB2014/062293, dated Oct. 1, 2014.
Written Opinion of the International Searching Authority for PCT international application PCT/IB2014/062941, dated Dec. 17, 2014.
Written Opinion of the International Searching Authority for PCT international application PCT/IB2016/054064, dated Jul. 9, 2015.
Syed Ahsan Abbas et al., “What is the difference between a rooted and unrooted Android?” Quora.com, dated Jul. 22, 2016, printed on Aug. 12, 2019 from: www.Quora.com/What-is-the-difference-between-a-rooted-and-unrooted-Android.
Sebastian Lindstrom, “Getting to know asynchronous JavaScript: Callbacks, Promises and Async / Await”, Medium.com, dated Jul. 2, 2017, printed on Aug. 12, 2019 from: Medium.com/codebuddies/getting-to-know-asynchronous-javascript-callbacks-promises-and-async-await-17e0673281ee.
Ahmed et al., “A New Biometric Technology Based on Mouse Dynamics”, Jul.-Sep. 2007, IEEE Transactions on Dependable and Secure Computing, vol. 4, No. 3, pp. 165-179.
Bailey, Kyle O., “Computer Based Behavioral Biometric Authentication Via Multi-Modal Fusion”, Thesis, 2013, Air Force Insitute of Technology.
Elizabeth Stinson and John C. Mitchell, “Characterizing the Remote Control Behavior of Bots”, Detection of Intrusions and Malware, and Vulnerability Assessment. Springer Benin Heidelberg, p. 89-108. Dec. 31, 2007.
Todorov, “Optimality Principles in Sensorimotor Control (Review)”, Sep. 2004, Nature Neuroscience 7, pp. 907-915.
Cleeff et al., “Security Implications of Virtualization: A Literature Study”, Science and Engineering, 2009.
Hibbeln et al., “Detecting Deception in Online Environments: Measuring Fraud Through Mouse Cursor Movements”, Jun. 7, 2014, Gmunden Retreat on NeuroIS 2014 Gmunden Austria, p. 38.
Ferrie Peter, “Attack on Virtual Machine Emulators”, Symantec Technology Exchange, 2007.
Yampolskiy et al., “Behavioural Biometrics: a survey and classification”, 2008, International Journal of Biometrics, vol. 1, No. 1, pp. 81-113.
Provos et al., 2007, “The Ghost in the Browser: Analysis of Web-based Malware”.
Huang Yao-Wen et al., “Web application security assessment by fault injection and behavior monitoring”, 2003, Proceedings of the 12th international conference on World Wide Web, ACM.
Ben Hansen, “The Blur Busters Mouse Guide”, dated Feb. 1, 2014; printed from the Internet on Aug. 5, 2019 from: https://www.blurbusters.com/faq/mouse-guide/.
Chris Cain, “Analyzing Man-in-the-Browser (MITB) Attacks”, dated Dec. 2014; downloaded from the Internet on Aug. 5, 2019 from: https://www.sans.org/reading-room/whitepapers/forensics/analyzing-man-in-the-browser-mitb-attacks-35687.
Stinson et al., “Characterizing Bots' Remote Control Behavior”. Detection of Intrusions and Malware, and Vulnerability Assessment. Springer Berlin Heidelberg, p. 89-108. Dec. 31, 2007.
Emmanouil Vasilomanolakis, “A honeypot-driven cyber incident monitor: Lessons learned and steps ahead”; Sep. 2015; SIN '15: Proceedings of the 8th International Conference on Security of Information and Networks; Publisher: ACM; pp. 1-7.
Franklin et al., “Remote Detection of Virtual Machine Monitors with Fuzzy benchmarking”, ACM SIGOPS Operating Systems Review, V42, Issue 3, Apr. 2008.
Georgia Frantzeskou et al., “Identifying Authorship by Byte-Level N-Grams: The source Code Author Profile (SCAP) Method”, Spring 2007, International Journal of Digital Evidence, vol. 6, issue 1.
Liston et al., “On the Cutting Edge: Thwarting Virtual Machine Detection”; retrieved from the Internet on May 3, 2017, from: http://docplayer.net/9791309-On-the-cutting-edge-thwarting-virtual-machine-detection.html.
Zheng et al., “An Efficient User Verification System via Mouse Movements”, Oct. 17-21, 2011, CCS' 11, Chicago, Illinois.
Tavis Ormandy, “An Empirical Study into the Security Exposure to Hosts of Hostile Virtualized Environments”, retrieved from the Internet on May 3, 2017, from: http://taviso.decsystem.org/virtsec.pdf.
Spafford et al., “Software Forensics: Can We Track Code to its Authors48 ”, Feb. 1992, Computer Science Technical Report, Purdue e-Pubs, Report No. CSD-TR-92-010.
Garfinkel and Rosenblum, “A virtual Machine Introspection-Based Architecture for Intrusion Detection”, 2003, Proc. Network and Distributed Systems Security Symp., The Internet Society, pp. 191-206.
Nance et al., “Virtual Machine Introspection”, IEEE Security & Privacy, 2008.
Nakkabi et al., “Improving Mouse Dynamics Biometric Performance Using Variance Reduction via Extractors with Separate Features”, Nov. 2010, IEEE Transactions on System, Man, and Cybernetics; vol. 40, No. 6.
International Search Report for application PCT/IL2011/000907 dated Apr. 19, 2012.
International Search Report for application PCT/IB2014/062293 dated Oct. 1, 2014.
International Search Report for application PCT/IB2014/062941 dated Dec. 17, 2014.
International Search Report for application PCT/IB2016/054064 dated Nov. 21, 2016.
Supplementary European Search Report for application 11844440 dated Nov. 17, 2017.
Faisal Alkhateeb et al., “Bank Web Sites Phishing Detection and Notification System Based on Semantic Web technologies”, International Journal of Security and its Applications 6(4):53-66, Oct. 2012.
Sungzoon Cho et al., “Artificial Rhythms and Cues for Keystroke Dynamics Based Authentication”, International Conference on Biometrics (ICB)—Advances in Biometrics, pp. 626-632, year 2006.
International Search Report for PCT/IB2017/055995, dated Feb. 15, 2018.
Written Opinion of the International Search Authority for PCT/IB2017/055995, dated Feb. 15, 2018.
Spafford et al., “Software Forensics: Can We Track Code to its Authors?”, Feb. 1992, Computer Science Technical Report, Purdue e-Pubs, Report No. CSD-TR-92-010.

Related Publications (1)

	Number	Date	Country
	20180351959 A1	Dec 2018	US

Provisional Applications (1)

	Number	Date	Country
	62190264	Jul 2015	US

Continuations (1)

	Number	Date	Country
Parent	15203817	Jul 2016	US
Child	16057825		US

System, device, and method for detecting a proxy server

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

US

CPC

International Classifications

Disclaimer

Term Extension

Abstract