Utilizing transport layer security (tls) fingerprints to determine agents and operating systems
AssigneePaypal, Inc.
InventorsYuval Arie Bercovich, Ido Kantor, Maayan Liat Zohar, Elad Bichman, Zahid Nasiruddin Shaikh
Life of this patent
Estimating the term…
Abstract
A computer system receives a first information detailing a TLS fingerprint. A computer system determines an amount of bad transactions associated with the TLS fingerprint, wherein a bad transaction is a transaction involved in one or more fraudulent activities. The computer system determines whether the amount of bad transactions associated with the TLS fingerprint exceeds a threshold amount.
Claims20
A system comprising:
- a non-transitory memory;
- and
- one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
- receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application;
- extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system;
- determining a probability for a plurality of operating systems;
- determining, if the declared operating system is accurate based on the probability determined;
- and
- blocking, a communication associated with the TLS fingerprint.
A method comprising:
- receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application;
- extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system;
- determining a probability for a plurality of operating systems;
- determining, if the declared operating system is accurate based on the probabilities determined;
- and
- cancelling, a transaction associated with the element request.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application;
- extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system;
- determining a probability for a plurality of operating systems;
- determining, if the declared operating system is accurate based on the probabilities determined;
- and
- cancelling, a transaction associated with the element request.
Dependencies are inferred from the claim text.