DETECTING RELAYED COMMUNICATIONS

摘要

Methods, apparatus and computer readable code for determining whether a potential relay device is a relay device are provided herein. In some embodiments, first and second information elements are received from a potential relay device, which is an original source of the second information element. In order to determine whether the potential relay device is a relay device, it is determined whether a feature of an original source of the first information element and a feature of the potential relay device are features unlikely to relate to a single device, wherein a positive result of the determining is indicative that the potential relay device is a relay device. In an exemplary embodiment, a disclosed system includes an information element receiver and a feature incompatibility analyzer. Optionally, the disclosed system includes a feature discovery module, a parameter obtainer and a feature database.

主权项

1. A method comprising:
identifying a first feature corresponding to a first source of a first information element, the first feature comprising a first characteristic of a first type of software installed on the first source of said first information element and a first Hypertext Transfer Protocol (HTTP) device type of the first source of said first information element; identifying a second feature corresponding to a device communicating the first information element, the second feature of the device comprising a second characteristic of a second type of software installed on the device and a second HTTP device type of the device, and wherein the device communicates a second information element from the device with the first information element; and determining, using a relay detection system implemented at least in part in hardware, whether the device comprises a relay device using the first feature and the second feature.