System, device, and method for detection of proxy server

1. A system comprising:

a proxy server detector apparatus, able to determine that a proxy server is utilized by an end-user using an end-user device over a communication network for accessing a trusted server;

wherein the proxy server detector apparatus is configured to determine whether: (I) the end-user device is communicating indirectly with the trusted server via the proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;

wherein the proxy server detector apparatus comprises:

an Operating System detector,

(a) to analyze transmission channel parameters, that exclude a User Agent field reported by the end-user device;

(b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, to determine an actual Operating System identity of the end-user device;

(c) to determine a mismatch between: (I) a reported Operating System identity as reported by the User Agent field of the end-user device, and (II) the actual Operating System identity of the end-user device as determined by the Operating System detector without relying on the User Agent field reported by the end-user device;

(d) based on said mismatch, to determine that a proxy server exists between the end-user device and the trusted server.

2. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a requests generator to generate a batch of TCP/IP requests;

a TCP source-port identifier to identify a TCP source-port for each of said TCP/IP requests;

a TCP source-port entropy analyzer to analyze a distribution of TCP source-ports associated with said batch of TCP/IP requests;

wherein the proxy server detector unit is to determine, based on entropy analysis of the distribution of TCP source-ports associated with said batch, that a proxy server exists between the end-user device and the trusted server.

3. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a requests generator to generate a batch of TCP/IP requests;

a TCP source-port identifier to identify a TCP source-port for each of the TCP/IP requests;

a TCP source-port sequencing analyzer to analyze a sequencing of TCP source-ports associated with said batch of TCP/IP requests;

wherein the proxy server detector unit is to determine, based on sequencing analysis of the sequencing of TCP source-ports associated with said batch of TCP/IP requests, that a proxy server exists between the end-user device and the trusted server.

4. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a proxy lists scraper and analyzer, (a) to scrape a list of proxy servers and their characteristics, and (b) to analyze incoming traffic from an end-user device, and (c) and to determine that a proxy server exists by identifying a proxy server characteristic in said incoming traffic.

5. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a non-relayed-data sender, (a) to send to said end-user device a data-item that is not relayed by proxy servers; and (b) based on a local determination in said end-user device, that said data-item was not received at the end-user device, to determine that a proxy server exists.

6. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a local-time extractor to extract, locally at the end-user device, a local time zone that is reported locally at the end-user device;

a geo-location mismatch detector, to detect a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) an alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device;

wherein the proxy server detector unit is to determine that a proxy server exists, between the end-user device and the trusted server, based on a mismatch between: (I) the local time zone as extracted locally at the end-user device, and (II) the alleged local time zone obtained from geo-location of an originating Internet Protocol (IP) address associated with the end-user device.

7. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an HTTP-header modifier to modify an HTTP header, that is intended for transmission to the end-user device, to be an HTTP-violating non-HTTP-compliant header;

wherein the proxy server detector unit is to perform an evaluation of a response of the end-user device to said HTTP-violating non-HTTP-compliant header, and to determine whether or not a proxy server exists, between the end-user device and the trusted server, based on said evaluation results.

8. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a reverse Domain Name Server (DNS) query module,

(a) to perform a reverse DNS query on an Internet Protocol (IP) address of the end-user device,

(b) to determine whether or not a reverse IP record exists for said IP address,

(c) to determine that a proxy server exists, between the end-user device and the trusted server, based on determining that a reverse IP record exists for said IP address.

9. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an HTTP header analyzer,

(a) to perform analysis of an incoming HTTP header that is received from said end-user device;

(b) to determine that said incoming HTTP header was modified relative to an expected HTTP header;

(c) to determine that a proxy server exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

10. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an HTTP header analyzer,

(a) to perform analysis of an incoming HTTP header that is received from said end-user device;

(b) to determine that said incoming HTTP header was modified relative to an expected HTTP header, by detecting a particular content-item in a Via field of said incoming HTTP header;

(c) to determine that a proxy server exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

11. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an HTTP header analyzer,

(a) to perform analysis of an incoming HTTP header that is received from said end-user device;

(b) to determine that said incoming HTTP header was modified relative to an expected HTTP header, by detecting a particular content-item in a X-Forwarded For (XFF) field of said incoming HTTP header;

(c) to determine that a proxy server exists, between the end-user device and the trusted server, based on determining that said incoming HTTP header was modified relative to the expected HTTP header.

12. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a browser identity detector,

(a) to analyze transmission channel parameters, that exclude a User Agent field reported by the end-user device;

(b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, to determine an actual browser identity of the end-user device;

(c) to determine a mismatch between: (I) a reported browser identity as reported by the User Agent field of the end-user device, and (II) the actual browser identity of the end-user device as determined by the browser identity detector without relying on the User Agent field reported by the end-user device;

(d) based on said mismatch, to determine that a proxy server exists between the end-user device and the trusted server.

13. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a ports connector and analyzer,

(a) to attempt to connect through a particular port to an originating Internet Protocol (IP) address) of the end-user device;

(b) to determine that a proxy server exists and is utilized, if a response is received to said attempt to connect through said particular port to said originating IP address of the end-user device.

14. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a ports connector and analyzer,

(a) to attempt to connect through a particular port to an originating Internet Protocol (IP) address) of the end-user device, wherein said particular port comprises a port selected from the group consisting of: port 80, port 8080, port 443, port 8888;

(b) to determine that a proxy server exists and is utilized, if a response is received to said attempt to connect through said particular port to said originating IP address of the end-user device.

15. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

a Domain Name Server (DNS) failed requests manager,

(a) to send to the end-user device an outgoing request for a resource, wherein the outgoing request is sent from a one-time subdomain of a domain that is controlled by a trusted server;

(b) to ignore incoming queries to resolve said one-time subdomain, that are received from Domain Name Servers;

(c) to detect an incoming attempt to resolve directly said one-time subdomain;

(d) based on detecting said incoming attempt to resolve directly said one-time subdomain, to determine that a proxy server exists and is utilized.

16. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an Internet Protocol (IP) addresses manager,

(a) to determine IP addresses of multiple sessions that originate from different end-user devices;

(b) to detect a particular IP address which is reported as originating IP address for at least K different end-user devices, wherein K is a pre-defined positive threshold value;

(c) to determine that said particular IP address belongs to a proxy server.

17. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

wherein the proxy server detector unit is to determine that traffic from the end-user device is incoming to a trusted server from an exit node of The Onion Router (TOR) network; and to determine that the end-user device utilizes TOR network as web proxy.

18. The system of claim 1 ,

wherein the proxy server detector apparatus comprises:

an HTTP to WebSockets upgrader and inspector module,

(a) to attempt to upgrade an HTTP connection to a WebSockets connection,

(b) to detect that said attempt fails even though end-user device parameters indicate support for WebSockets, and

(c) to determine that a proxy server exists between the end-user device and the trusted server.

19. A computerized method, comprising:

determining that a proxy server is utilized by an end-user using an end-user device over a communication network for accessing a trusted server;

wherein said determining comprises performing an analysis of communications incoming from said user device to said trusted server, and based on said analysis, determining whether: (I) the end-user device is communicating indirectly with the trusted server via the proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;

wherein said analysis comprises:

(a) analyzing transmission channel parameters, that exclude a User Agent field reported by the end-user device;

(b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, determining an actual Operating System identity of the end-user device;

(c) determining a mismatch between: (I) a reported Operating System identity as reported by the User Agent field of the end-user device, and (II) the actual Operating System identity of the end-user device as determined by the Operating System detector without relying on the User Agent field reported by the end-user device;

(d) based on said mismatch, determining that a proxy server exists between the end-user device and the trusted server.

20. A non-transitory storage medium having stored thereon instructions that, when executed by a machine, cause the machine to perform a method comprising:

determining that a proxy server is utilized by an end-user using an end-user device over a communication network for accessing a trusted server;

wherein said determining comprises performing an analysis of communications incoming from said user device to said trusted server, and based on said analysis, determining whether: (I) the end-user device is communicating indirectly with the trusted server via the proxy server, or (II) the end-user device is communicating directly with the trusted server via a proxy-less communication route;

wherein said analysis comprises:

(a) analyzing transmission channel parameters, that exclude a User Agent field reported by the end-user device;

(b) based on analysis of transmission channel parameters, and without relying on a User Agent field reported by the end-user device, determining an actual Operating System identity of the end-user device;

(c) determining a mismatch between: (I) a reported Operating System identity as reported by the User Agent field of the end-user device, and (II) the actual Operating System identity of the end-user device as determined by the Operating System detector without relying on the User Agent field reported by the end-user device;

(d) based on said mismatch, determining that a proxy server exists between the end-user device and the trusted server.