Securing the Internet Through the Detection of Anonymous Proxy Usage
Total Page：16
File Type：pdf, Size：1020Kb
Please cite as: Shane Miller, Kevin Curran, Tom Lunney (2015) Securing the internet through the detection of anonymous proxy usage. World Congress on Internet Security (WorldCIS-2015), Dublin, Ireland October 19-21 2015 Securing the internet through the detection of anonymous proxy usage. Shane Miller, Kevin Curran, Tom Lunney School of Computing and Intelligent Systems Faculty of computing and Engineering Ulster University, Magee Derry/Londonderry, Northern Ireland E-mail:[email protected] Abstract— Many businesses and educational facilities employ some whilst also hiding a user’s identity by concealing their IP address form of filtering to control what internet sites their users may from web servers on the Internet. This type of server is regularly browse. This is done to help protect network assets, to protect data used as a means to hide a criminal’s identity so they can commit from being stolen and to comply with company policies on internet various crimes on the internet without being caught. There are usage. Anonymous proxies (or web proxies) can be used by the end also a number of risks with using an anonymous proxy as a users to bypass most filtering systems put in place by businesses and this can remove the protection that the filtering systems method to bypass network filters on a company network. The provide for the network. For instance, unless the web proxy being anonymous proxy server might not be a simple intermediary that used is being hosted by the end user or someone they know, then only forwards requests and fetches the results. It could also be the identity of whoever is hosting the proxy is unknown and they logging all the requests and information that pass through it. This potentially cannot be trusted. The proxy website could also have information could include usernames and passwords and the been set up to eavesdrop on the data flow between the end user’s operators of the proxy site may use these to steal the identity machine and the internet. Sites set up to do this would normally log linked to the credentials and use it to commit fraud and other information for later inspection and data sent from a business criminal actions. A user employing an anonymous proxy on an user’s machine could contain potentially confidential information enterprise network to bypass a network filter might be, about the company or the user themselves. This research aims to identify the characteristics or signatures whenever a user is using a unwittingly, leaking confidential information about their web proxy by developing a Detection System that records packets company. To combat this issue we propose a system that will and analyses them looking for identifying patterns of web proxies. detect suspicious traffic on the network and attempt to determine One of the main focuses of the research will be in detecting the whether the traffic indicates the usage of an anonymous proxy usage of proxy websites that make use of SSL to encrypt the website. The system will specifically check for characteristics contents of their packets. that appear in packets generated by anonymous proxies and then create rules to determine the usage of anonymous proxies. Keywords— Anonymous proxy, network traffic, traffic analysis, pattern recognition, adaptive learning, SSL/TLS encryption II. BACKGROUND A. IP Blocking I. INTRODUCTION IP blocking is the most basic technique used to combat A proxy server, in terms of computer networks, is a server malicious threats to networks and is one of the most commonly that acts as an intermediary for requests from clients for used techniques for protecting networks [1]. Using this method resources located on other servers on a network or the Internet. an administrator can block an IP address or a range of IP This is the most basic type of proxy which is known as a gateway. addresses from accessing a certain domain name IP address. A Another type of proxy is a reverse proxy. This consists of a network administrator can also block access to an IP address that server on an internal company network and acts as an is being used by a disruptive user. IP blocking can however be intermediary for other servers based on that network. Reverse overcome by using anonymising proxies. The user’s IP address proxies are typically used as an Internet facing server that is usually sent out as a source IP address in the network packet handles a number of different tasks. Some examples include: containing the request to a web server. However, when using a SSL acceleration using specially designed hardware for the proxy, this request is first sent to the proxy server which then encryption and decryption of SSL traffic, load balancing to forwards it on towards the web server. This forwarded request is distribute requests between several web servers and acting as a encased in a new network packet which means that the source IP cache for static content such as pictures and other graphical address is no longer that of the end user but instead is that of the content. The proxies that will be discussed in this research are proxy server. So, the blocked IP address of the user is not anonymising proxies which are based on another type of proxy actually making any direct contact with the web server running known as an open proxy. Open proxies are a proxy that is the IP filter. The network administrator may also block the IP available to any user on the Internet. They are mostly used to set addresses of websites that they do not want users to access, but up anonymous proxy websites. Anonymising proxy sites act as in this case a proxy will separate the business network and the an intermediary, forwarding requests and fetching the results, Please cite as: Shane Miller, Kevin Curran, Tom Lunney (2015) Securing the internet through the detection of anonymous proxy usage. World Congress on Internet Security (WorldCIS-2015), Dublin, Ireland October 19-21 2015 website being accessed. The IP block filter will only detect the IP of the proxy site, which will likely not be in the filter’s block list. Figure 1 shows how the proxy is located between the user and the website they are trying to access. B. Firewalls & Intrusion Detection Systems Client Proxy Server Web Server A significant security problem for business type networks is Fig. 1 Proxy connection hostile or unwanted access by users or software [2]. Unwanted user access (an intrusion) can be in the form of unauthorised Glype is a PHP based script and is one of the most common and logon to a machine or gaining the ability to perform higher popular web proxy scripts available on the internet. This is due privilege actions than what is normally authorised. Unwanted to its support for content like JavaScript and to its ease of set up software access can take the form of a virus, Trojan horse or and use. To set up a Glype proxy server, a user must download other form of malware. To combat these intrusions there are a the proxy files from the Glype website and then relocate the files number of defences. There are host based security methods that to the correct directories on their webserver. Another option are managed by the operating system of the machine, various would be to use one of the many existing proxy sites already types of firewall used to filter network packets, such as Intrusion available. The Glype website provides a list of working proxy Detection Systems (IDS) and Intrusion Prevention Systems servers whose administrators have paid to have their site listed (IPS). A firewall is defined as a component or set of components in the hope of increasing the popularity of their own server. At that restrict access between a protected network and external the time of writing this list contained 3,389 unique servers. This networks [3]. list, however only represents those that have paid to have better Intrusion Detection Systems detect intrusions on a network. exposure; there are possibly many more Glype proxy servers. IDSs come in many different configurations, two of which are This presents a problem when trying to block access to these Host-based IDS (HIDS) and Network-based IDS (NIDS). The proxies because there are so many. This makes it difficult to difference between these two is the location of the IDS on the compile a complete list to add to an IP block list or ACL. In network. A HIDS monitors and collects the characteristics for addition, because it is so easy to set up the proxy, new servers hosts containing sensitive information, servers running public are being added all the time. URL filtering will not work either services and suspicious activities [4]. To detect intrusions to the as the majority of proxy servers based on the Glype script will network HIDSs typically follow one of two general approaches. have some form of URL obfuscation available. The most These are anomaly detection and signature detection. Anomaly popular methods of obfuscation are encoding the URL using detection involves the collection of data relating to behaviour of either base64 or ROT-13 encoding. Other methods of encoding legitimate users over a period of time. Next, tests are applied to exist, but these are the main ones used by the Glype script. observed behaviour to determine if it involves an illegitimate The CGIProxy is a Common Gateway Interface (CGI) script user. Signature detection involves a set of rules or attack patterns that acts as a HTTP, HTTPS or FTP proxy. CGI scripts can be that can be used to decide if an observed behaviour is that of an programmed in a number of different languages.