Detecting relayed communications

摘要

Methods, apparatus and computer readable code for determining whether a potential relay device is a relay device are provided herein. In some embodiments, first and second information elements are received from a potential relay device, which is an original source of the second information element. In order to determine whether the potential relay device is a relay device, it is determined whether a feature of an original source of the first information element and a feature of the potential relay device are features unlikely to relate to a single device, wherein a positive result of the determining is indicative that the potential relay device is a relay device. In an exemplary embodiment, a disclosed system includes an information element receiver and a feature incompatibility analyzer. Optionally, the disclosed system includes a feature discovery module, a parameter obtainer and a feature database.

主权项

1. A method of determining whether a potential relay device is a relay device, the method comprising:
receiving a communication from the potential relay device, the communication comprising a first information element and a second information element, wherein the potential relay device is an original source of said second information element; identifying a feature of an original source of said first information element, the feature of the original source of said first information element including a device configuration status of the original source of said first information element, the device configuration status including an indication of a type of software installed on the original source of said first information element and an HTTP device type of the original source of said first information element; identifying a feature of the potential relay device, the feature of the potential relay device including a device configuration status of the potential relay device, the device configuration status including an indication of a type of software installed on the potential relay device and an HTTP device type of the potential relay device; and determining, using a relay detection system implemented at least in part in hardware, that the feature of the original source of said first information element of said first information element and the feature of the potential relay device are features unlikely to relate to a single device, said determining being indicative that the potential relay device is a relay device, based on an analysis of the type of software installed on and the HTTP device type of both the original source of said first information element and the potential relay device.