# US 2019/0319957 A1 · Utilizing transport layer security (tls) fingerprints to determine agents and operating systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319957 A1 - Document ID: US20190319957A1 - Status: Published application - Kind: A1 - Application number: 16/452,118 - Filed: 2019-06-25 - Published: 2019-10-17 - Earliest claimed: 2016-08-16 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Yuval Arie Bercovich; Ido Kantor; Maayan Liat Zohar; Elad Bichman; Zahid Nasiruddin Shaikh - Web page: https://patentgrep.com/patent/US20190319957A1 ## CPC - H04L 63/101: {Access control lists [ACL]} - G06F 16/22: Indexing; Data structures therefor; Storage structures - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/44: Program or device authentication - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/166: {at the transport layer} - H04W 12/06: Authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A computer system receives a first information detailing a TLS fingerprint. A computer system determines an amount of bad transactions associated with the TLS fingerprint, wherein a bad transaction is a transaction involved in one or more fraudulent activities. The computer system determines whether the amount of bad transactions associated with the TLS fingerprint exceeds a threshold amount. ## Claims ### Claim 1 A system comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application; extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system; determining a probability for a plurality of operating systems; determining, if the declared operating system is accurate based on the probability determined; and blocking, a communication associated with the TLS fingerprint. ### Claim 2 (depends on 1) The system of claim 1, the operations further comprising: matching, the declared operating system to an operating system with a highest associated probability; and detecting, that the declared operating system to the operating system with the highest associated probability do not match. ### Claim 3 (depends on 1) The system of claim 1, wherein the blocking includes transmitting the TLS fingerprint and declared operating system for risk management evaluation. ### Claim 4 (depends on 1) The system of claim 1, wherein the blocking includes blocking a transaction and communication from an IP address associated with the application. ### Claim 5 (depends on 4) The system of claim 4, wherein in response to the blocking the transaction, an SMS message is transmitted for verification. ### Claim 6 (depends on 4) The system of claim 4, wherein the blocked transaction is flagged as fraudulent activity. ### Claim 7 (depends on 1) The system of claim 1, wherein the element information packet includes the declared operating system, an IP information, and the TLS fingerprint. ### Claim 8 A method comprising: receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application; extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system; determining a probability for a plurality of operating systems; determining, if the declared operating system is accurate based on the probabilities determined; and cancelling, a transaction associated with the element request. ### Claim 9 (depends on 8) The method of claim 8, further comprising: matching, the declared operating system to an operating system with a highest associated probability; and detecting, that the declared operating system to the operating system with the highest associated probability do not match. ### Claim 10 (depends on 8) The method of claim 8, wherein the cancelling includes transmitting the TLS fingerprint and declared operating system for risk management evaluation. ### Claim 11 (depends on 8) The method of claim 8, wherein the cancelling includes blocking a transaction and communication from an IP address associated with the application. ### Claim 12 (depends on 8) The method of claim 8, wherein in response to the cancelling the transaction, an SMS message is transmitted for verification. ### Claim 13 (depends on 11) The method of claim 11, wherein the blocked transaction is flagged as fraudulent activity. ### Claim 14 (depends on 8) The method of claim 8, wherein the element information packet includes the declared operating system, an IP information, and the TLS fingerprint. ### Claim 15 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: receiving, over a first network connection, in response to accessing an application by an agent, an element request for the application, the element request including an element information packet associated with the application; extracting element information from the element information packet, the extracting including detecting a transport layer security (TLS) fingerprint and declared operating system; determining a probability for a plurality of operating systems; determining, if the declared operating system is accurate based on the probabilities determined; and cancelling, a transaction associated with the element request. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the cancelling includes transmitting the TLS fingerprint and declared operating system for risk management evaluation. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the cancelling includes blocking a transaction and communication from an IP address associated with the application. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein in response to the cancelling the transaction, an SMS message is transmitted for verification. ### Claim 19 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the blocked transaction is flagged as fraudulent activity. ### Claim 20 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the element information packet includes the declared operating system, an IP information, and the TLS fingerprint.