Proxy Connection Detection Using Delayed TCP Handshakes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting fraudulent or abusive client requests routed through proxy devices, particularly residential proxies, is challenging due to their ability to obfuscate detection mechanisms, leading to inefficient allocation of computational resources without adequate return.
Innovation Solution
A proxy detection method involving a delay timer mechanism and analysis of source port and sequence number consistency, combined with round-trip time assessment, to distinguish between proxied and non-proxied requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the server responds immediately to transport-layer connection requests, then client service speed is improved, but the server cannot detect proxy devices and wastes computational resources on fraudulent requests
Solution Approach 1:
The server performs preliminary detection actions by introducing a delay before responding to transport-layer connection requests. During this delay period, the server monitors for retransmitted requests with matching source port numbers, allowing proxy detection to occur before full computational resources are allocated to processing the request.
2Productivity
If the server allocates computational resources to process all requests, then service completeness is improved, but computational resources are wasted on fraudulent requests from proxy devices
Solution Approach 1:
The server uses feedback from the connection request pattern itself to identify proxy devices. By monitoring whether source port numbers match between initial and retransmitted requests within a specific time window, the server receives feedback that indicates whether a request should be processed or discarded, enabling selective resource allocation.
Solution Approach 2:
The server extracts and analyzes specific identifying features from connection requests—particularly source port numbers—without processing the full request content. This allows the server to identify and discard proxy requests based on port number mismatches before allocating computational resources to process the actual request payload.
3Measurement precision
If the server monitors source port numbers to detect proxies, then proxy detection accuracy is improved, but the complexity of request handling increases
Solution Approach 1:
The server applies different handling rules based on the local characteristic of source port number matching. For requests where the source port number matches between initial and retransmitted requests, the server applies standard processing. For requests with mismatched port numbers, the server applies proxy detection and discards them, creating localized quality differences in request handling based on this specific attribute.
Data Source
AI summary
A method includes receiving, from a client device, a first request to establish a transport-layer connection between the client device and the server, the first request containing a first source port number; in response to receiving the first request, initiating a delay timer and withholding transmission of an acknowledgement to the first request until expiry of the delay timer; receiving from the client device, prior to expiry of the delay timer, a second request to establish the transport-layer connection; determining whether the second request contains a second source port number matching the first source port number; and selecting, based on the determination, a handling action for the second request.