System and method of filtering internet traffic via a client fingerprint
A system and method that includes receiving a client data packet from network traffic with a client device; extracting a set of packet components from the client data packet; generating a client fingerprint from the set of packet components; assigning a client type to the network traffic using the client fingerprint; and optionally filtering the network traffic of the client device based at least in part on the client type.
1. A method comprising:
receiving a client data packet from network traffic with a client device;
extracting a set of packet components from the client data packet;
individually applying a hash operation to each of the set of packet components to generate a set of hashed packet components;
applying a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components;
generating a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components; and
assigning a client type to the network traffic using the multiple tiered client fingerprint.
2. The method of claim 1 , wherein the client data packet is a client hello message received during negotiation during a cryptographic protocol.
3. The method of claim 2 , wherein the cryptographic protocol is a transport layer security (TLS) protocol.
4. The method of claim 2 , further comprising filtering the network traffic of the client device based at least in part on the client type.
5. The method of claim 4 , wherein assigning the client type to the network traffic using the multiple tiered client fingerprint comprises of selecting the client type from a database mapping multiple tiered client fingerprints to a classification of client type.
6. The method of claim 4 , wherein extracting the set of packet components comprises extracting identifying data from a client cipher suite list and a list of compression methods from the client hello message; and wherein generating the multiple tiered client fingerprint comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation, wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list and hashing the list of compression methods.
7. The method of claim 4 , wherein filtering the network traffic further comprises limiting network traffic from a client because of the client type.
8. The method of claim 2 , wherein generating the multiple tiered client fingerprint further comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation.
9. The method of claim 8 , wherein encoding the set of packet components into the multiple tiered client fingerprint as a character representation of the hash of the set of hashed packet components and the set of sub-fingerprints from the set of hashed packet components.
10. The method of claim 8 , wherein extracting the set of packet components further comprises extracting identifying data from a client cipher suite list from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list.
11. The method of claim 8 , wherein extracting the set of packet components further comprises extracting identifying data from a list of compression methods from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the list of compression methods.
12. The method of claim 8 , wherein extracting the set of packet components further comprises extracting identifying data from a client point formats from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client point formats.
13. The method of claim 8 , wherein extracting the set of packet components further comprises extracting identifying data from a list of supported application protocols from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the list of supported application protocols.
14. The method of claim 8 , wherein extracting the set of packet components further comprises extracting identifying data from a list of client-supported extensions from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing a formation of the list of client-supported extensions.
15. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a communication platform, cause the communication platform to perform operations comprising:
receiving a client data packet from network traffic with a client device;
extracting a set of packet components from the client data packet;
individually applying a hash operation to each of the set of packet components to generate a set of hashed packet components;
applying a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components;
generating a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components; and
assigning a client type to the network traffic using the multiple tiered client fingerprint.
16. The non-transitory computer-readable medium of claim 15 , wherein the client data packet is a client hello message received during negotiation during a transport layer security (TLS) protocol.
17. The non-transitory computer-readable medium of claim 16 , wherein extracting the set of packet components comprises extracting identifying data from a client cipher suite list and a list of compression methods from the client hello message; wherein generating the multiple tiered client fingerprint comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation; wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list and hashing the list of compression methods; and wherein assigning the client type to the network traffic using the multiple tiered client fingerprint comprises selecting the client type from a database mapping multiple tiered client fingerprints to a classification of client type; and further comprising filtering the network traffic of the client device based at least in part on the client type.
18. The non-transitory computer-readable medium of claim 17 , wherein extracting the set of packet components comprises extracting identifying data from the client point formats, the list of supported application protocols, and the list of client-supported extensions from the client hello message; wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client point formats, hashing the list of supported application protocols, and hashing the list of client-supported extensions.
19. The system of claim 18 , wherein the client data packet is a client hello message received during negotiation during a transport layer security (TLS) protocol.
20. The system of claim 19 , wherein instructions to extract the set of packet components comprises instructions to extract identifying data from the client point formats, the list of supported application protocols, and the list of client-supported extensions from the client hello message; wherein instructions to individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises instructions to hash the client point formats, hash the list of supported application protocols, and hash the list of client-supported extensions.
21. A system comprising of:
a network traffic data interface with access to client data packet from network traffic with a client device; and
a data packet analyzer that receives the client data packet from the network traffic data interface and comprises one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause a computing platform to:
extract a set of packet components from the client data packet,
individually apply a hash operation to each of the set of packet components to generate a set of hashed packet components,
apply a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components,
generate a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components, and
assign a client type to the network traffic using the multiple tiered client fingerprint.
22. The system of claim 21 , wherein instructions to extract the set of packet components comprises instructions to extract identifying data from a client cipher suite list and a list of compression methods from the client hello message; wherein instructions to generate the multiple tiered client fingerprint comprises instructions to encode the set of packet components into the multiple tiered client fingerprint as a character representation, wherein instructions to individually apply the hash operation to each of the set of packet components to generate the set of hashed packet components comprises instructions to hash the client cipher suite list and hash the list of compression methods; and wherein instructions to assign the client type to the network traffic using the multiple tiered client fingerprint comprises instructions to select the client type from a database mapping multiple tiered client fingerprints to a classification of client type; and further comprising instructions to filter the network traffic of the client device based at least in part on the client type.