Exploring Proxy Detection Methodology

Mandeep Pannu Bob Gill Robert Bird Kai Yang Ben Farrel
Department of Computer Department of Electrical Faculty of Engineering and Department of Computer Department of Computer
Science and Information and Computer Engineering Computing Science and Information Science and Information
Technology BCIT Coventry University Technology Technology
KPU Burnaby, Canada Coventry, UK KPU KPU
Surrey, Canada [email protected] [email protected] Surrey, Canada Surrey, Canada
[email protected] [email protected] [email protected]

Abstract—Under most circumstances, cyber criminals will This paper identifies different proxy connectivity methods,
commit fraudulent transactions using proxy services which hide in order to develop a multi-tiered proxy detection module, and
their real IP address and physical location. This is done in an evaluate the implementation of the module in terms of cost and
effort to avoid being tracked and prosecuted by law enforcement effectiveness. Tests are completed using different types of
agencies. This paper presents the investigation of a proxy
detection methodology and efforts to implement such technology
devices and platforms, such as desktops, laptops (Windows),
into a business solution with the sole purpose of eliminating the and mobile devices (Android). We also test the module using
majority of fraudulent transaction attempts. The approach, computers connected through home networks, work networks,
described in this paper identifies multiple proxy connectivity and mobile networks. The results of the experiments indicate
methods, and implements a multi-tiered detection technique. The that the proxy detection module improves business security by
result of the experiments demonstrates that the proxy successfully identifying proxy users.
methodology improves business security by identifying users who
are utilizing proxies and to collect data that prevents potentially II. BACKGROUND
fraudulent activities.
In the literature about information technology, the term
Keywords—fraud prevention; proxy detection; security “proxy” is also referred to as a “Stepping Stone” [1]. A proxy
is software that resides on a server or node, and has the
purpose of mediating access between the client’s machine and
I. INTRODUCTION the destination server. When an application generates a request
The detection and protection against fraud have become of for a particular resource, the request is relayed via the
utmost importance in modern society. With the rise of online demarcated proxy server. Once the proxy server receives the
financial and e-commerce services, a new class of criminal has request, it analyzes the said request in order to determine the
surfaced. When we use any Internet-related application or desired resource accompanied by its designated server or
service, we become potential targets for cyber criminals. machine, as well as any additional information that it needs to
Cyber criminals utilize techniques such as social engineering, relay, after which it connects and forwards the request to the
phishing, and scamming to exploit system vulnerabilities for target server and waits for a response. Upon receipt, it
personal gain. They could act on our behalf to take our forwards the reply back to its end client [2].
valuable assets, or use our privileges or rights without our Fig. 1. Example of a Typical Proxy
knowledge. Concealing a person’s true identity and location on
the Internet can be done by the usage of proxy or anonymity
services. Cyber criminals commit fraudulent transactions by
using proxy services to hide their real internet protocol (IP)
address and physical location, in order to avoid being tracked
and prosecuted by law enforcement agencies. Thus, having the
ability to detect proxy connections and prevent fraudulent
transactions becomes paramount.
We are proposing to devise and present a proxy detection
A. Proxy Types
methodology to protect businesses, as well as their end users,
against electronic commerce (e-commerce) fraud. Knowledge According to David Gourley and Brian Totty [3], proxy
gained from currently available detection methods, underlying servers can be classified based on their functionality.
technology, and methods of experimentation were all 1) Child filter: Proxies can be utilized in order to block
thoroughly considered and utilized. This proposed proxy certain types of content such as adult material.
detection methodology checks for cyber criminals who access
the website and/or web application for the possibility of proxy 2) Document access controller: Access to certain
usage and perform necessary action before cyber criminals resources can be restricted and/or granted to certain users
carry out fraudulent activities. based on authentication and authorization mechanisms.

978-1-5090-6096-2/16/$31.00 ©2016 IEEE

 3) Security firewall: Proxies are an effective technique of control protocol (TCP) based traffic and can also resolve
improving an enterprise’s security when deployed at the entry domain name system (DNS) addresses if the SOCKS4a
point of a given network segment, for the reason that they can extension is utilized. SOCKS5 is the extension of SOCKS4
be configured to filter certain types of application-layer protocol, and besides all functionality delivered by the
protocols. previous version, it provides support for the user datagram
4) Web cache: Due to their caching ability, proxies can protocol (UDP), IPv6, and additional client-based
store frequently accessed content and when a request is authentication.
received, instead of the given resource being retrieved from Additionally, there are proxies that implement virtual
the server and sent to the end client, it is served directly to the private network (VPN) techniques by creating a point-to-point
end client from the local cache, thereby reducing congestion or site-to-site connection that is secure with different type of
protocol. Below are some examples.
and bandwidth consumption.
5) Surrogate: This type of proxy is also termed as 1) Layer 2 tunneling protocol (L2TP): A standard protocol
“reverse-proxy” or “server-accelerator”. It is generally utilized for tunneling L2 traffic over an IP network [5]. Its ability to
in order to reduce server-load caused by the generation of carry almost any L2 data format over IP or other L3 networks
dynamic content. Henceforth, similar to the “web cache” type, makes it particularly useful.
it caches the content generated for a particular request, and if 2) OpenVPN: An open-source software application that
any client initiates the same request, it returns the content implements VPN techniques for creating secure point-to-point
without re-soliciting the end server. or site-to-site connections in routed or bridged configurations
6) Content router: Based on the content-type and network and remote access facilities [6]. It uses a custom security
conditions such as traffic flow/congestion, proxies can be protocol that utilizes secure sockets layer (SSL) and transport
employed to request specific content from servers which deal layer security (TLS) for key exchange.
with the type of content requested and alleviate traffic from 3) Point-to-point tunneling protocol (PPTP): A method for
servers which are over-loaded. implementing virtual private networks [7]. PPTP uses a
control channel over TCP and a GRE tunnel operating to
Moreover, as reflected by Michael Ligh et al. [4], proxies
can also be categorized by the level of anonymity provided to encapsulate point-to-point protocol (PPP) packets.
the end user. 4) Secure socket tunneling protocol (SSTP): A form of
VPN tunnel that provides a mechanism to transport PPP or
1) Transparent: It does not conceal the source IP address L2TP traffic through an SSL 3.0 channel [8].
of the end user when requesting a particular resource. This is 5) Stealth: TorGuard has engineered special “stealth”
accomplished by adding a hypertext transfer protocol (HTTP) connections that are guaranteed to bypass deep packet
header to the request containing the IP address of the user’s inspection (DPI) firewalls and provide “invisible” VPN access
machine. anywhere in the world [9].
2) Anonymous: This type of proxy does conceal the end
user’s IP address, by omitting it from any request headers. On C. HTTP Headers
the other hand it still displays a header indicates that the end As aforementioned, transparent proxies do not conceal the
user is utilizing a proxy therefore this type of proxy is not very end user’s IP address due to the fact that they embed a
effective in providing complete anonymity. particular HTTP header in the request, which identifies the end
3) Highly anonymous: This provides the highest level of user’s machine IP address. The HTTP header analysis
anonymity due to the fact that it does not relay any information technique relies on detecting the HTTP headers and
that might potentially identify a user or the datum that the determining the end user’s IP address based on their typical
aforementioned is utilizing a proxy service. proxy header. This solution is quite common and has been
deployed to prevent IP spoofing even in specialized security
B. Proxy Protocols devices such as the CISCO IronPort Web Security Appliance
Proxies utilize a diversity of protocols to support end client [10]. The most frequently utilized headers that indicate the IP
to proxy-server communication. As emphasized by the author address of a proxy’s end client are:
Blake Adair [4], the most common protocols encompass: 1. VIA: As defined by RFC 2616 [11], this is a general-
purpose header which informs the destination server of the
1) HTTP: It is not explicitly designed for proxy
end-client’s IP address as well as the end-client of the origin
communications. Nevertheless, when utilized by proxy based
server’s IP address.
applications, it tolerates encrypted or unencrypted HTTP-
2. X-FORWARDED-FOR: Standardized in 2014 and as
based communications and also has the ability of allowing
defined by RFC 7239 [12]. This HTTP header field is a
non-HTTP traffic to pass-through the proxy-server when the
common method for identifying the originating IP address of a
CONNECT functionality is employed.
client connecting to a web server through a load balancer or
2) Socket secure (SOCKS): There are currently 3 major
HTTP proxy. The originating IP address can be obfuscated at
SOCKS protocol version. SOCKS4 is especially designed for
the server connect stage, and as such, this method is only
proxy-based applications. It will allow any transmission
reliable for trusted servers.
 The HTTP header analysis technique is effective as long as III. METHODOLOGY
the type of proxy is transparent, and the proxy service adds the In order to analyze incoming connections, we aim to build
specific headers. However, if the proxy service omits the a detection methodology that functions similarly to the proxy
headers, or sends a header with a client IP address that does detection demonstrated on WhatIsMyIPAddress [14]. This
not match the actual client address, this detection method will website uses a collection of six tests to determine if a user is
fail. behind a proxy or not. One of these tests is performed using a
D. RBL Databases vast collection of internal testing data that has been formatted
According to the author, John Brozycki, a real-time into an identification database. As this approach is out of the
blacklist (RBL) identification check can be employed to detect scope for this project, we will focus on the identification
methods that can be completed without the need database
whether a person is using a proxy or not [13]. RBLs were
created in order to detect and prevent, in real-time, spamming storage and access. The remaining five tests utilize packet
header analysis, various scripting techniques, and routing
activities such as the sending of unsolicited emails. Large
volumes of email spam are often sent through proxy and VPN analysis. We will analyze these tests, along with other known
anonymity services, which end up getting blacklisted. methods, to accomplish our goal.
However, RBLs are not limited to spam detection only, as they A. Research Method
can also provide listings of hosts compromised via illegal third The primary purpose of this paper is hoping to introduce
party exploits, worms, Trojans or any other form of malware. the readers into the world of e-commerce fraud and its related
The providers of such services are: Spam and Open Relay proxy-based operations. Hence, various references were
Blocking System (SORBS), Spamhaus Project, Abuse Hosts chosen to deliver an adequate amount of knowledge to help
Blocking List (ATLBL), and many more. readers to better understand the relevance of fraud prevention
The principle of determining if an IP address has been via proxy detection. Since our target audiences are mostly
listed in a specific RBL, as described in Brozycki’s paper, is small to medium sized enterprises, their needs and capabilities
that the RBL needs to be queried, and if the reply contains a are also taken into consideration. In order to provide complete
valid DNS record, this implies that the aforementioned IP anonymity to our test subjects, we have sanitized all the IP
address has been listed in the RBL’s database, therefore might addresses and personal information before publication.
represent a proxy. If the reply did not return a DNS record,
then it has not been listed in the particular RBL, and it might B. Data Gathering Method
not be a proxy. For the purpose of data gathering, we have purchased a
E. Limitations of Current Proxy Detection Techniques proxy service license through TorGuard [9]. The services
provided by TorGuard allow us to test five different proxy
To the best of our knowledge, all proxy detection connectivity types from hundreds of servers across the globe.
techniques have a plethora of advantages and disadvantages We also utilized configurations that are available through free
[13]. Currently, there is no single method that is capable of proxy lists, and alternative connectivity types such as mobile
identifying all of the possible configurations for proxy data connections and VPN tunnels. Once the proxy
connections. However, by using several detection schemes, we configurations were completed, connection attempts were
are able to greatly increase the effective detection rate. Several made to our pre-configured server, which contains a packet
disadvantages exist that are outside of the control of the logging application that documents each instance of
methodology tested in this report. connection and identifies specific proxy connections. For the
• These testing methods cannot prevent an end user from best result, we gathered test data from different browsers. For
performing modifications to their computer or network
Windows devices, the following browsers were used: Firefox
traffic with the intention of bypassing a configured
44, Chrome 47, Internet Explorer 11, and Opera 34. For
detection method.
Android devices, the following browsers were used: Chrome
• Not all businesses will have the resources to manage 47 and the default browser with Flash player installed.
and maintain secure access to all of their systems. This
is especially the case when portions of the company are C. Design Detection and Prevention Method
outsourced. To identify a large number of configurable proxy
connection types, several steps can be used.
• Any tests that are heavily dependent on RBL databases
might be prone to higher amounts of false positive 1) Identify the public IP address of the target machine.
results. 2) Implement a Flash element that runs client-side and
quickly reports the true public IP.
• People are becoming highly protective of their data and 3) If the target machine’s IP and the retrieved public IP
privacy. Some users like to surf the internet in stealth so match, then this test will return a value representing that no
they can keep their browsing details private. Therefore, proxy was detected. However, if the IP addresses do not match,
not every user is willing to go online with their original
we are able to confirm that a proxy is certainly in use.
IP address that can reveal their true identity and location.
 Utilizing this test, we are able to positively identify any connection IP for determining whether a proxy or VPN is in
simple proxy that has been configured through a browser, or use. This implementation method has the benefit of quickly
users requesting access through a web-based proxy portal. identifying any locally configured proxy connections, or web-
Fig. 2. Detection Architecture based proxy portals. The IP detection of our module is
accomplished by reporting the locally detected public IP, and
comparing it against the IP address that initiated the
connection to our test server. In order to ensure that the test
will carry out, it is designed to verify that the user attempting
to access the site is able to run the Flash object in their browser.
The following steps were required to provision and install
the aforementioned proxy detection module method:
1) Set up a web server capable of running Perl and PHP.
Additional tests can also be made to identify stealth
2) Adjust the parameters of the proxy detection module
connections such as universal VPN services, though only to a
according to the environment variable of the server.
certain degree. In order to target VPN services that our first
3) Copy the configured module over to the web server.
test would not identify, we can implement further checks.
4) Create the necessary file and log that runs the module
1) Reverse DNS test: Attempt to confirm the IP of a target
on the web server.
machine through an Internet Control Message Protocol (ICMP)
5) Integrate the Adobe Flash in small web format (SWF)
request, then using the resulting DNS name, verify that the
file format on the webpage as an embedded object, so it will
connection path resolves to the same target machine and not to
initiate the analysis process locally and remotely. Once the
a local IP or a different system entirely.
flash object runs on the client-side, it will return the local IP of
2) TOR network discovery test: Identifying the majority of
the client to help identify whether a proxy had been used or
TOR (an anonymity network) users can be accomplished by
not. Additional methodology checks can be implemented by
parsing the list of publicly available TOR exit nodes, then
altering the PHP code segments to include a reverse DNS test,
comparing the target machine's public IP against the list.
TOR network discovery test, and RBL database test.
3) RBL database test: Compare the target machine's public
In order to identify the effectiveness of our detection
IP against RBL database. However, this test might not be as
algorithm, we need to configure our test platform computers
reliable, due to possible false positive results. In addition, all
with various known proxy configurations, and then connect to
connection IP addresses are required to send to a third party our target server for validation. A debug logging function was
service in order to use RBL databases, which can present a added to the module, so we can validate correct identification
potential security concern and higher service cost. of proxies and to further troubleshoot false positives if the
IV. IMPLEMENTATION situation requires it. Furthermore, a Wireshark packet capture
was set up on the client-side, to monitor the connection and
A. Proxy Connection Configuration record the TCP/IP packet information to avoid data collection
Proxy connections can be configured in a multitude of error and possible human error throughout the test.
fashions. These include configuring a simple redirection C. Provisioning
within a given browser that will send any web based traffic
We provisioned Windows and Android since these
through the provided proxy service. Alternatively, a proxy
operating systems make up approximately 77.58% of Internet
connection can be configured as a new network device, and
connected devices worldwide [16]. Due to the fact that iOS
bridged to the existing network adapter to send packets
does not support flash, the module will not work on iOS
through a designated server. A client side application can be
devices. The module is configured to run on a website hosted
used, such as TorGuard, to automate the creation and
on a dedicated server with Intel E3-1230v2 processor using
connection type through a designated secure proxy service.
Apache, MySQL, PHP, and CentOS - one of the best
Finally, there are websites, such as kproxy.com and hide.me,
community-based Linux server distributions available today
that act as an anonymous proxy browser by creating a separate
[17]. Since the test devices are configured to specifically use
frame that connects to the requested sites through a designated
proxy connections, additional tests are conducted on our
server location. Manually configuring a proxy connection
personal devices (desktop, laptop, and mobile) to better
requires a fair amount of configuration information including
represent real-life situations of normal proxy users.
the IP or DNS address, the port being used, the security option
utilized for authentication, encryption type, valid user V. EXPERIMENT RESULTS AND EVALUATION
credentials, and the knowledge needed to bridge a network
adapter to the configured proxy connection. A. Proxy Operations Analysis
B. Method Development In the first part of this particular investigation, we have
determined that when proxy connections are created, specific
Given the accuracy of the aforementioned methods, we characteristics that are unique to the proxy become identifiable
have opted to focus on developing a client-side Flash object during transmission of information, or during connection
that runs from the target machine, and reports the local
attempts. The information needed to identify a proxy can they were connecting through a mobile data service, or have
sometimes be as simple as reading the packet header disabled any ICMP requests on their firewall.
containing connection type details, or checking for a matching 4) Connection four indicates that a TOR network
forward and reverse DNS records, or comparing the client’s IP connection was detected.
to a RBL database. Many methods exist to identify these traits
and we intend to devise a detection logic that utilizes these D. Result Evaluation
tests with efficiency and accuracy. The proxy detection module performed its function with
efficiency and effectiveness. The detection process time per
B. Proxy Detection Test
client is approximately one millisecond (1 ms) plus the latency
Proxy detection tests were performed in each development between the client and the server. The detection rate for
phase. Each test signified advancement in our detection SOCKS proxy connections is 100%. On the other hand, the
algorithm. During testing, it was determined that the easiest detection rate for HTTP proxy connections is 94%, due to
method of integration is via PHP. Further testing was some devices disabled flash and scripts. The module is
performed in an attempt to utilize HTML5; however, we were relatively straightforward to integrate into existing systems. As
unable to create a non-PHP module that is capable of operating long as we are able to enforce the use of the Flash object on
without requiring the user to install a plug-in or add-on the browser, the detection of any locally configured proxy will
extension. Through the utilization of both paid proxy services be positively identified.
and manual configuration on several system platforms, we Unfortunately we were unable to create a database-free
were able to positively identify proxy users of any manually methodology of identifying users utilizing advanced VPN
configured proxy options, or web based portals. As previously services. Since VPN services bind to a locally created network
described, VPN services were more difficult to identify in a device, the proxy detection module will find both the public IP
meaningful way. These VPN services can potentially be and the discovered IP to be the same, which renders the proxy
detected using one of the following methods. detection module ineffective.
• Personal computer fingerprinting and analysis of data 78 out of 80 of the VPN services that we tested through
stored in a database. TorGuard were positively identified with a reverse DNS test.
• A client-side invasive application that monitors all web However, the reverse DNS test is vulnerable to false positives.
traffic and ensures a secure connection to the target site In order to filter out the false positives, we would need to
(this is used by a number of banks). create a complex mechanism to analyze the client machines'
details. A detailed fingerprint can be created from any
• Advanced hardware technology that performs detailed incoming connection containing information about the
packet inspection used in combination with tracking computer and location [18]. The fingerprint is used to identify
packets. information about the target machine, such as local machine's
C. Experiment Results country codes, language options, and regional settings. This
information can then be compared against the public IP
Below are some of the proxy users logged by the proxy
address' country of origin.
detection module, which demonstrates the result of our
experiment. VI. E-COMMERCE MODULE DESIGN AND
IMPLEMENTATION
TABLE 1. SELECTEDA EXPERIMENT RESULTS
Time Connection Discovered Proxy RDNS Tor
As modern society becomes more and more dependent on
Stamp IP IP Detected Failure Check electronic transactions, data has become the most valuable
1/31/2016 10.190.147.23 10.190.22.1
7:11 4 76
Yes Yes No asset for any businesses. Due to the inherently insecure nature
1/31/2016 10.107.147.23 10.107.147.
No No No
of the Internet, businesses need to take into account that
7:12 4 234
1/31/2016 10.150.208.
vulnerable web-based applications can be exploited by cyber-
10.150.208.18 No Yes No
15:41 18 criminals. Thus, it is crucial that businesses adopt e-commerce
1/31/2016
22:34
10.164.234.13
8
10.164.234.
138
No No Yes fraud prevention methods to safeguard their data.
A Out of 811 connection attempts from 50 devices.
A. Legal Implications
Based on table 1, below are the interpretations of the data. Several legal implications need to be considered when
1) Connection one is using a simple proxy configuration, designing the proxy detection module for e-commerce use.
as the initial IP address differs from the one identified through 1) Data protection: All processed data need to be secured
the proxy detection module. It also failed the reverse DNS test. by employing cryptographic technology, and stored in a secure
2) Connection two passes the test as both the public and environment where the information is not disclosed unless
detected IP are the same. There were no detections on the legally permitted. All parts of the module should provide
remaining two tests. boundary-checking and input validation. The module should
3) Connection three is a partial match. It fails the reverse also be capable of preventing attacks such as SQL injection,
DNS check, which can mean that they are using a remote command execution, remote file inclusion, and
misconfigured stealth VPN service, but it can also indicate that information disclosure.
 2) Customer privacy: An enterprise must adhere to the any interested researchers and organizations to explore this
laws of the country they operate in. If the enterprise is based in particular area. In the future, we would like the opportunity to
the United Kingdom, it must provide an adequate layer of improve the current detection technique. One of the features
obscurity and control for its customers' identities, and only we would like to develop in future is the ability to encompass
share such information with other parties in accordance with various data analysis techniques, which should improve the
the laws and regulations. existing proxy detection methods. Another feature to be
3) Trademark laws: Violating any existing patents or developed is seamless integration to any existing systems,
trademarks could do serious damage to an enterprise's where the module can be attached or removed from the system
financial status or image. Therefore, it is advised that without impacting the overall quality and functionality of
enterprises be aware of trademark laws. business operations.
4) Terms and conditions for the provided service: REFERENCES
Customers must acknowledge a specific set of terms and [1] R.-M. Lin, Y.-C. Chou and K.-T. Chen, "Stepping Stone Detection at
conditions before using an enterprise' product or service. Due The Server Side," in 2011 IEEE Conference, Shangai, 2011, pp. 964-969.
to the fact that the module utilizes resources on the end user's [2] D. Stuttard and M. Pinto, "The Web Application Hacker's Handbook:
Finding and Exploiting Security Flaws," John Wiley & Sons, 2011, pp.
machine, it is important to obtain permission from the end user 50.
to avoid potential legal action from the end user. [3] D. Gourley and B. Totty, "Http: The Definitive Guide," O'Reilly Media,
2002, pp. 131-137.
B. Module Integration [4] M. Ligh, S. Adair, B. Hartstein and M. Richard, "Malware Analyst's
All business operations that are conducted through existing Cookbook and DVD : Tools and Techniques for Fighting Malicious
Code," John Wiley & Sons, 2010, pp. 11-15.
solutions need to be modularized in such a way that the [5] V. Rawat, R. Tio, S. Nanji and R. Verma, "Layer Two Tunneling
ordering process is clearly visible and can be altered to include Protocol (L2TP) over Frame Relay," February 2001, pp. 1-3. [Online].
the proxy detection module. During the user authentication Available:
https://www.researchgate.net/publication/277825842_Layer_Two_Tunne
stage, the module will check the validity of user's login or ling_Protocol_L2TP_over_Frame_Relay.
transaction attempts, and relay the detection results to the web [6] Z. Hou, M. Xu, L. Zhu, L. Peng and B. Hu, "The Design and Realization
server to determine the access permission. If needed, further of the Test Scheme OpenVPN, Based on Message Simulation,"
analysis such as statistical analysis, data correlation, or November 2013. [Online]. Available:
https://www.researchgate.net/publication/266643218_The_Design_and_
intelligent agent approach can be performed since all detection Realization_of_the_Test_Scheme_OpenVPN_Based_on_Message_Simu
results are logged. Given its construction, the module can be lation.
easily integrated with the majority of the web platforms and [7] K. Hamzeh, G. Pall, W. Verthein, J. Taarud, W. Little and G. Zorn,
"Point-to-point tunneling protocol (PPTP)," December 1998. [Online].
appended to a user authentication prompt. The cost to add the Available: https://www.researchgate.net/publication/234818729_Point-
module to systems is low due to its simplicity. Once the to-point_tunneling_protocol_PPTP.
module is integrated with the website, the module can actively [8] G. Trinder, "How SSTP based VPN connection works," Microsoft,
monitor all transactions. The added security offered by the January 2007. [Online]. Available:
https://blogs.technet.microsoft.com/rrasblog/2007/01/10/how-sstp-based-
module benefits any website that stores confidential customer vpn-connection-works.
data. [9] TorGuard.net, "Anonymous VPN, Proxy & Anonymous Proxy
Services," 2016. [Online]. Available: https://torguard.net.
VII. CONCLUSION AND FURTHER RESEARCH [10] P. Ružicka, "Deployment of Cisco IronPort Web Security Appliance,"
Cisco Expo, 2009, pp. 27-31.
A. Conclusion [11] R. Fielding, J. Gett S, J. Mogul, H. F. Nielsen, L. Masinter, P. J. Leach
and T. Berners-lee, "RFC 2616: Hypertext Transfer Protocol -
Proxy connections have many types and protocols, and HTTP/1.1," December 1998, pp. 145-169. [Online]. Available:
with different software and technique configurations, it can be https://www.researchgate.net/publication/242418693_RFC_2616_Hypert
ext_Transfer_Protocol_-_HTTP11.
difficult to uncover a proxy connection. Although there are [12] A. Petersson and M. Nilsson, "Forwarded HTTP Extension," June 2014,
many existing methods to detect a proxy connection, all pp. 2-4. [Online]. Available: https://www.rfc-editor.org/rfc/rfc7239.txt.
methods have their limitations. It is our goal to create a
module that is capable of identifying as many proxy types as
[13] J. Brozycki, "Detecting and Preventing Anonymous Proxy Usage,"
possible. In this paper, we have investigated and tested September 2008. [Online]. Available: https://www.sans.org/reading-
different detection techniques, used the knowledge attained to room/whitepapers/detection/detecting-preventing-anonymous-proxy-
design a multi-tiered proxy detection module, and explained usage-32943.
[14] What Is My IP Address, "Advanced Proxy Check," [Online]. Available:
how to implement the module in a business environment. With http://whatismyipaddress.com/proxy-check. [Accessed 15 12 2015].
the overall detection rate of 97% and low integration cost, our [15] P. C. Kolin, "Successful Writing at Work," Cengage Learning, 2012, pp.
proxy detection module is an effective and efficient solution 331-353.
for businesses to prevent fraudulent transactions from non- [16] Stat Counter Global Stats, "Top 8 Operating Systems from Aug 2012 to
Mar 2015" [Online]. Available: http://gs.statcounter.com/#all-os-ww-
VPN proxy connections. monthly-201208-201503-bar. [Accessed 16 December 2015].
[17] S. Bhartiya, "The Best Linux Distros of 2016," January 2016. [Online].
B. Further Research Available: https://www.linux.com/news/software/applications/878620-
This paper serves as an example and starting point for the the-best-linux-distros-of-2016.
[18] R. Broenink, "Using Browser Properties for Fingerprinting Purposes," in
study of proxy detection, and stands as a reference point for 16th Twente Student Conference on IT, Enschede, 2012.