Determining sum length of host and path in encrypted HTTP request message

1 . A computer-implemented method comprising:

intercepting an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;

determining a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message; and

in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, performing a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.

2 . The method of claim 1 , further comprising:

detecting a version of HTTP based on the encrypted HTTP connection; and

determining a packet of the encrypted HTTP request message containing one or more encrypted headers, an encrypted host, and an encrypted path based on the version of the HTTP.

3 . The method of claim 1 , further comprising:

determining a value for the encryption constant based on the communication session handshake.

4 . The method of claim 1 , further comprising:

identifying a client of the encrypted HTTP request message and a version of HTTP based on the encrypted HTTP connection.

5 . The method of claim 4 , further comprising:

determining the unencrypted headers length based on the client and the version of the HTTP.

6 . The method of claim 4 , wherein identifying the client of the encrypted HTTP request message based on the encrypted HTTP connection further comprises:

identifying the client based on a fingerprint generated with a John Althouse 4 (JA4) algorithm for a client hello message of the communication session handshake.

7 . The method of claim 6 , wherein the fingerprint comprises a JA4_b field.

8 . The method of claim 7 , wherein the fingerprint also comprises at least a part of a JA4 a field.

9 . The method of claim 1 , wherein the reference database comprises sum lengths of hosts and paths of malicious websites.

10 . The method of claim 9 , wherein the sum lengths of the hosts and the paths of the malicious websites comprise sum lengths of compressed hosts and paths of the malicious websites.

11 . The method of claim 1 , wherein performing the cybersecurity operation in relation to the one or more of the client, the server, and the encrypted HTTP connection further comprises:

blocking the encrypted HTTP connection in a local area network (LAN).

12 . The method of claim 1 , further comprising:

in response to detecting an at least partly unencrypted client hello message in the communication session handshake, determining a length of the unencrypted host as a length of a server name indication (SNI) extension in the at least partly unencrypted client hello message, and a length of the unencrypted path by subtracting the length of the SNI extension in the at least partly unencrypted client hello message from the sum length of the unencrypted host and the unencrypted path in the encrypted HTTP request message.

13 . The method of claim 1 , further comprising:

in response to detecting an encrypted client hello (ECH) message in the communication session handshake, determining a length of an encrypted host as a length of an inner server name indication (SNI) in the ECH message, a path as a slash, and a length of the unencrypted path as one.

14 . The method of claim 1 , wherein intercepting the encrypted HTTP connection between the client and the server further comprises:

intercepting the encrypted HTTP connection in a local area network (LAN) implemented by an access point.

15 . The method of claim 1 , wherein the communication session handshake comprises a transport layer security (TLS) session handshake.

16 . The method of claim 1 , wherein the client is configured to execute in a connected device.

17 . The method of claim 1 , wherein the server is configured to execute in a computing resource to implement a target website.

18 . An apparatus comprising:

one or more memories; and

one or more processors coupled to the one or more memories configured to:

intercept an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;

determine a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message; and

in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, perform a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.

19 . A non-transitory computer-readable medium comprising a computer program with instructions which, when executed by an apparatus, cause the apparatus to:

intercept an encrypted hypertext transfer protocol (HTTP) connection between a client and a server, wherein the encrypted HTTP connection comprises a communication session handshake, and an encrypted HTTP request message;

determine a sum length of an unencrypted host and an unencrypted path in the encrypted HTTP request message by subtracting an unencrypted headers length and an encryption constant from a length of the encrypted HTTP request message; and

in response to finding a match between the sum length of the unencrypted host and the unencrypted path and a reference sum length in a reference database containing known malicious hosts and paths and their sum lengths, perform a cybersecurity operation in relation to one or more of the client, the server, and the encrypted HTTP connection.