SYSTEM AND METHOD OF FILTERING INTERNET TRAFFIC VIA CLIENT FINGERPRINT
A system and method that includes receiving a client data packet from network traffic with a client device; extracting a set of packet components from the client data packet; generating a client fingerprint from the set of packet components; assigning a client type to the network traffic using the client fingerprint; and optionally filtering the network traffic of the client device based at least in part on the client type.
1 . A method comprising:
extracting, by a device, a set of packet components from a data packet;
generating, by the device, a tiered client fingerprint with an overall client fingerprint based on encoding an encoded collection of packet components of the set of packet components; and
assigning, by the device based on the tiered client fingerprint, a type to network traffic associated with the data packet.
2 . The method of claim 1 , wherein the tiered client fingerprint is a multi-tiered client fingerprint.
3 . The method of claim 1 , wherein the data packet is a hello message received during negotiation associated with a cryptographic protocol.
4 . The method of claim 3 , further comprising:
extracting identifying data from client point formats from the hello message;
encoding the client point formats; and
including the encoded client point formats in a set of sub-fingerprints.
5 . The method of claim 1 , further comprising filtering the network traffic based on the type.
6 . The method of claim 1 , wherein assigning the type to the network traffic comprises selecting the type from a database,
wherein the database includes a mapping of the tiered client fingerprint to a classification of client type.
7 . The method of claim 1 , wherein the data packet is a hello message received during negotiation associated with a transport layer security (TLS) protocol.
8 . A device, comprising:
one or more memories; and
one or more processors, coupled to the one or more memories, configured to:
extract a set of packet components from a data packet;
generate a tiered client fingerprint with an overall client fingerprint based on encoding an encoded collection of packet components of the set of packet components; and
assign, based on the tiered client fingerprint, a type to a network traffic associated with the data packet.
9 . The device of claim 8 , wherein the tiered client fingerprint is a multi-tiered client fingerprint.
10 . The device of claim 8 , wherein the data packet is a hello message received during negotiation associated with a cryptographic protocol.
11 . The device of claim 10 , wherein the one or more processors are further configured to:
extract identifying data from client point formats from the hello message;
encode the client point formats; and
include the encoded client point formats in a set of sub-fingerprints.
12 . The device of claim 8 , wherein the one or more processors are further configured to filter the network traffic based on the type.
13 . The device of claim 8 , wherein the one or more processors, to assign the type to the network traffic, are configured to select the type from a database,
wherein the database includes a mapping of the tiered client fingerprint to a classification of client type.
14 . The device of claim 8 , wherein the data packet is a hello message received during negotiation associated with a transport layer security (TLS) protocol.
15 . A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
extract a set of packet components from a data packet;
generate a tiered client fingerprint with an overall client fingerprint based on encoding an encoded collection of packet components of the set of packet components; and
assign, based on the tiered client fingerprint, a type to a network traffic associated with the data packet.
16 . The non-transitory computer-readable medium of claim 15 , wherein the tiered client fingerprint is a multi-tiered client fingerprint.
17 . The non-transitory computer-readable medium of claim 15 , wherein the data packet is a hello message received during negotiation associated with a cryptographic protocol.
18 . The non-transitory computer-readable medium of claim 17 , wherein the one or more instructions further cause the device to:
extract identifying data from client point formats from the hello message;
encode the client point formats; and
include the encoded client point formats in a set of sub-fingerprints.
19 . The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions further cause the device to filter the network traffic based on the type.
20 . The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the device to assign the type to the network traffic, cause the device to select the type from a database,
wherein the database includes a mapping of the tiered client fingerprint to a classification of client type.