Detecting relayed communications

A system comprising:

• a non-transitory memory;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
• receiving, by a monitored hub, communications comprising a first information element and a second information element originated from a device;
• determining a first roundtrip time (RTT) measurement between the monitored hub and first source of the first information element in the communications;
• identifying a first feature corresponding to the first source, the first feature comprising a first characteristic of a first type of software installed on the first source and a first device type of the first source,
• identifying a second feature corresponding to the device using the second information element originated from the device, the second feature of the device comprising a second characteristic of a second type of software installed on the device and a second device type of the device;
• determining a second RTT measurement between the monitored hub and the device;
• comparing the first feature to the second feature to determine whether the first feature and the second feature correspond to the device;
• determining an RTT gap between the first RTT measurement and the second RTT measurement;
• and
• determining whether the device comprises a relay device relaying the first information element from the first source that is different than the device to the monitored hub based on the comparison of the first feature to the second feature and the RTT gap, wherein the device comprises the relay device at least when the first feature is different than the second feature.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• receiving, by a monitored hub, communications comprising a first information element and a second information element originated from a device;
• identifying a first feature corresponding to a first source of the first information element in the communications, the first feature comprising a first characteristic of a first type of software installed on the first source and a first device type of the first source;
• determining a first roundtrip time (RTT) measurement between the monitored hub and the first source;
• identifying a second feature corresponding to the device using the second information element originated from the device, the second feature of the device comprising a second characteristic of a second type of software installed on the device and a second device type of the device;
• determining a second RTT measurement between the monitored hub and the device;
• comparing the first feature to the second feature to determine whether the first feature and the second feature correspond to the device;
• determining a RTT gap between the first RTT measurement and the second RTT measurement;
• and
• determining, using a relay detection system implemented at least in part in hardware, whether the device comprises a relay device relaying the first information element from the first source that is different than the device to the monitored hub based on the comparison of the first feature to the second feature and the RTT gap, wherein the device comprises the relay device at least when the first feature is different than the second feature.