A Taxonomy and Feature set for Server-Side Identification of Proxies
- Sandia National Laboratories (SNL-NM), Albuquerque, NM (United States)
Malicious actors frequently use proxies and VPNs to evade detection and hide their origin. Current challenges to information security include the use of residential proxies to blend in with normal traffic and Man-in-the-Middle phishing proxies that are used to compromise accounts protected with mult-factor authentication. We advance a taxonomy and feature set for the identification of proxied traffic based on the network layer where proxying occurs. We describe how these features apply to common proxy types and how to use these features in the classification of the proxied traffic. Collection of these additional features is feasible using existing network sensors and web servers, while only adding about 30% volume to commonly deployed network sensor logs.
- Research Organization:
- Sandia National Laboratories (SNL-NM), Albuquerque, NM (United States)
- Sponsoring Organization:
- USDOE National Nuclear Security Administration (NNSA)
- DOE Contract Number:
- NA0003525
- OSTI ID:
- 2530825
- Report Number(s):
- SAND--2025-02246
- Country of Publication:
- United States
- Language:
- English
Similar Records
A Proxy Signature-Based Drone Authentication in 5G D2D Networks