Detecting Anonymized Traffic via HTTP 302 Redirects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current URL filtering methods fail to detect and block anonymized data traffic, especially when users employ unknown or encoded anonymizer services, allowing malicious content to bypass web filters.
Innovation Solution
Monitoring for 'HTTP 302 Moved' messages and IP address lookups in a rating database to identify and flag potential anonymized traffic, enabling content filtering and blocking of prohibited content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL filtering blocks all data from known anonymizer sites, then access to prohibited content via known anonymizers is prevented, but data from unknown or user-hosted anonymizers cannot be detected and blocked
Solution Approach 1:
The system performs preliminary actions by monitoring for HTTP 302 Moved messages before content is fully transmitted. By detecting the redirect message that contains the original URL, the system can identify anonymized traffic patterns early in the communication process, enabling blocking before the actual prohibited content is delivered to the user.
Solution Approach 2:
The invention uses HTTP 302 Moved messages as an intermediary indicator to detect anonymized traffic. Instead of directly analyzing the final content or relying on known anonymizer databases, the system uses the redirect message as a mediator that reveals the original destination URL, allowing detection of both known and unknown anonymizer services.
2Reliability
If the system monitors for HTTP 302 Moved messages and extracts embedded URLs, then unknown anonymizer services can be detected, but processing complexity increases
Solution Approach 1:
The system extracts only the critical information needed for detection - the embedded URL from the HTTP 302 Moved message. By taking out only the URL component rather than processing the entire message payload or all HTTP headers, the system reduces processing complexity while maintaining effective detection capability.
Solution Approach 2:
The invention applies partial action by monitoring only for the specific HTTP 302 Moved message type and extracting only the embedded URL, rather than analyzing all HTTP traffic comprehensively. This selective approach reduces processing overhead while maintaining sufficient detection accuracy for anonymized traffic.
3Reliability
If the system blocks all traffic from suspicious IP addresses, then anonymized traffic can be blocked, but legitimate traffic may be incorrectly blocked
Solution Approach 1:
The system applies local quality by analyzing specific characteristics of the HTTP 302 Moved message (such as the presence of an embedded URL pointing to prohibited content) rather than blocking based on IP address alone. This localized analysis of message content allows for more precise identification of anonymized traffic while preserving legitimate traffic.
Solution Approach 2:
The system uses feedback from analyzing the embedded URL in the HTTP 302 Moved message to determine whether traffic should be blocked. By feedback-based decision making - checking whether the extracted URL points to prohibited content - the system can accurately distinguish between anonymized traffic to prohibited sites and legitimate traffic, reducing false positives.
Data Source
AI summary
Computer implemented methods and apparatuses for detecting and/or blocking anonymized data even if the user employs a web server that is not known to the web filter to be an anonymizing web server (such as a user-hosted anonymizer). The anonymize attempt may be detected by monitoring for the HTTP 302 Moved message and parsing the HTTP 302 Moved message for URLs, which may then be checked for unapproved content. The anonymize attempt may, additionally or alternatively, be detected by looking the IP addresses in an IP address rating database to detect suspicious traffic.