METHOD AND APPARATUS FOR DYNAMIC DETECTION OF GEO-LOCATION OBFUSCATION IN CLIENT-SERVER CONNECTIONS THROUGH AN IP TUNNEL

摘要

Methods and systems are disclosed for dynamic detection of fraudulent client connections to a server, in which, for example, the connection is made using an internet protocol (IP) tunneling technology such as networking on a virtual private network (VPN) and making the connection via a VPN tunnel in order to obfuscate the client IP address, in which a user of a client device may employ spoofing of IP-geo location mechanisms and IP classification on the server side. Such a user may have various motivations for obfuscating the client device's geo-location by using an IP tunnel when connecting to a server such as gaining access to services that are not allowed in certain locations (e.g., certain movie and television content providers); browsing server data while maintaining a higher level of anonymity; and performing fraudulent actions on the server.

主权项

1. A method for dynamically detecting geo-location obfuscation of a client connection to a server, the method comprising:
evaluating, based on a maximum segment size (MSS) parameter of a packet of a client connection to the server, whether the connection is made via tunneling; estimating a risk of geo-location obfuscation associated with the client connection to the server, based on a latency analysis of the connection when the evaluation indicates the connection is made via tunneling; and providing a risk assessment, according to the evaluation based on MSS of whether the connection is made via tunneling and the estimation of risk based on the latency analysis, of whether the client connection to the server is made via tunneling so as to obfuscate the geo-location of a client making the client connection to the server.