Detecting DDoS attackers using intermediaries

A method, comprising:

• detecting, by one or more processing circuits, based on information associated with a plurality of data packet exchanges of a network, a transmission of a first data packet between a computing device and a server, the first data packet to initiate an establishment of a communication session between the computing device and the server, wherein the first data packet is transmitted in accordance with a first layer of a network architecture;
• determining, by the one or more processing circuits, responsive to detecting a transmission of a second data packet between the computing device and the server, a first amount of time elapsed between the transmission of the first data packet and the transmission of the second data packet, the second data packet to indicate the establishment of the communication session between the computing device and the server, wherein the second data packet is transmitted in accordance with the first layer of the network architecture;
• storing, by the one or more processing circuits, the first amount of time in a data structure in a database;
• detecting, by the one or more processing circuits, responsive to monitoring subsequent interactions between the computing device and the server, a transmission of a third data packet between the computing device and the server, wherein the third data packet is transmitted in accordance with a second layer of the network architecture, the second layer being different than the first layer;
• determining, by the one or more processing circuits, responsive to detecting the transmission of the third data packet, a second amount of time elapsed between the transmission of the second data packet and the transmission of the third data packet;
• determining, by the one or more processing circuits, based on a difference between the first amount of time and the second amount of time, that the computing device is utilizing a proxy device to communicate with the server;
• and
• blocking, by the one or more processing circuits, based on the determination that the computing device is utilizing the proxy device, the proxy device from communicating across the network, wherein the plurality of data packet exchanges comprise encrypted data packet exchanges.

One or more non-transitory storage medium storing instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• detecting, based on information associated with a plurality of data packet exchanges of a network, a transmission of a first data packet between a computing device and a server, the first data packet to initiate an establishment of a communication session between the computing device and the server, wherein the first data packet is transmitted in accordance with a first layer of a network architecture;
• determining, responsive to detecting a transmission of a second data packet between the computing device and the server, a first amount of time elapsed between the transmission of the first data packet and the transmission of the second data packet, the second data packet to indicate the establishment of the communication session between the computing device and the server, wherein the second data packet is transmitted in accordance with the first layer of the network architecture;
• storing the first amount of time in a data structure in a database;
• detecting, responsive to monitoring subsequent interactions between the computing device and the server, a transmission of a third data packet between the computing device and the server, wherein the third data packet is transmitted in accordance with a second layer of the network architecture, the second layer being different than the first layer;
• determining, responsive to detecting the transmission of the third data packet, a second amount of time elapsed between the transmission of the second data packet and the transmission of the third data packet;
• determining, based on a difference between the first amount of time and the second amount of time, that the computing device is utilizing a proxy device to communicate with the server;
• and
• blocking, based on the determination that the computing device is utilizing the proxy device, the proxy device from communicating across the network, wherein the plurality of data packet exchanges comprise encrypted data packet exchanges.