Edge Network Bot Detection via TLS Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of TLS connections for secure communication poses a challenge in detecting automated attacks by scripts or bots, as existing techniques struggle to effectively differentiate between legitimate and automated traffic.
Innovation Solution
The technique involves fingerprinting TLS connection information by combining parameters from the initial "Hello" packet sent by the client, creating a unique "TLS signature" that can be used to detect bots. This signature includes record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS connections are used for secure communication, then communication security is improved, but bot detection capability deteriorates
Solution Approach 1:
The patent segments the TLS handshake process into multiple parameters (record layer version, client version, TLS extensions, cipher list, elliptic curve list, signature algorithms list) that can be individually analyzed and combined to create a fingerprint signature for bot detection
Solution Approach 2:
The patent introduces an intermediary fingerprinting mechanism that operates at the TLS layer between the client and server, extracting characteristics from the TLS handshake to create a signature that helps detect bots without compromising the security of the TLS connection
2Ease of operation
If existing bot detection techniques are used, then detection simplicity is maintained, but detection accuracy deteriorates
Solution Approach 1:
The patent changes the parameters used for bot detection by utilizing multiple TLS handshake parameters (version, extensions, cipher list, etc.) instead of traditional detection methods, creating a composite fingerprint signature that improves detection accuracy while maintaining operational simplicity through automated extraction and comparison
3Measurement precision
If multiple TLS parameters are combined for fingerprinting, then bot detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent applies preliminary action by extracting and organizing TLS parameters during the initial handshake phase, creating the fingerprint signature upfront before actual content transmission, which simplifies subsequent detection processes by having the signature ready for immediate comparison
Data Source
AI summary
This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as “TLS fingerprinting.” Preferably, TLS fingerprinting herein comprises combining different parameters from the initial “Hello” packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the “TLS signature”) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.