Web Server Proxy Detection via RTT Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web servers face challenges in detecting proxy usage, which hinders their ability to differentiate between human users and automated scrapers, leading to potential overload and resource misuse.
Innovation Solution
Utilizing HTTP/2 and HTTP/3 protocols, specifically the ping frames, to measure round trip times (RTTs) between a web server and a user, in conjunction with Internet Control Message Protocol (ICMP) pings, to determine if a proxy server is being used, allowing for policies to be implemented to mitigate proxy usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web servers allow unrestricted access to all users, then service availability is improved, but resource overload and misuse increase
Solution Approach 1:
The patent introduces an intermediary detection mechanism that sits between the web server and users. This mechanism uses HTTP/2 and HTTP/3 ping frames as mediators to measure round trip times and identify proxy servers without blocking legitimate traffic. The intermediary layer filters out abusive proxy traffic while allowing normal user access, thus maintaining service availability while preventing resource overload.
2Reliability
If web servers implement strict access control to prevent abuse, then resource protection is improved, but service accessibility deteriorates
Solution Approach 1:
The patent applies local quality by implementing differentiated access control based on user identification. Legitimate users with normal RTT characteristics receive standard access, while identified proxy servers receive restricted or blocked access. This localized application of control measures protects resources from abuse while maintaining full accessibility for legitimate users, avoiding the need for blanket restrictions.
3Difficulty of detecting and measuring
If web servers use traditional detection methods to identify proxy usage, then proxy detection capability is improved, but false positive rates increase
Solution Approach 1:
The patent replaces traditional mechanical detection methods (such as analyzing HTTP headers, user agents, or connection patterns) with a physics-based measurement approach using network latency. By substituting header analysis with RTT measurement through ping frames, the system achieves more precise proxy identification. The physical property of network transmission time provides a more reliable indicator of proxy usage than configurable HTTP parameters, significantly reducing false positives.
4Measurement precision
If web servers implement comprehensive monitoring to detect proxy usage, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent extracts the essential detection function from complex monitoring systems and isolates it to a specific mechanism using HTTP/2 and HTTP/3 ping frames. By taking out only the necessary RTT measurement capability and removing unnecessary monitoring components, the system achieves accurate proxy detection with minimal complexity. The solution focuses on extracting and utilizing the specific property of ping frame transmission time rather than implementing comprehensive traffic analysis.
Data Source
AI summary
The method and system detects if proxies are used by a user from a web server's side. The method and system uses HTTP/2 and HTTP/3 protocols and, more precisely, the ping frames to test the round trip time of messages between a web server and a user. At the same time, a web server uses an Internet Control Message Protocol echo requests to measure the round trip time to an IP address. A web server can then compare, aggregate, and analyze different round trip times and determine if they are coming from different sources, i.e. if a user is using a proxy server. A web server can make decisions based on the comparison of round trip times. For example, a difference in a single user's round trip times may trigger a restrictive user policy at the web server's end and a web server can decide to return the requested content, return an error message, or ban them and similarly limit services.