Method and System for First Party and Third Party Detection and for the Occlusion of Network Device TLS Signatures

A method for uniquely identifying a network client or application based on a transport layer security (TLS) handshake, comprising:

• storing, in a computing device, a list of cipher suites and a list of supported curves;
• intercepting, by the computing device, a data packet transmitted to as part of the TLS handshake;
• filtering, by the computing device, cipher suites included in the list of cipher suites from the data packet;
• filtering, by the computing device, supported curves included in the list of supported curves from the data packet;
• building, by the computing device, a data string using data in the data packet remaining after filtering;
• generating, by the computing device, a signature value by hashing the data string;
• and
• identifying, by the computing device, a network client or application using the generated signature value.

A system, comprising:

• a first computing network;
• a second computing network including a resource;
• and
• a target client device included in the first computing network;
• a computing device including a first memory cache and a second memory cache, wherein
• the computing device
• receives a request for access to the resource in the second computing network from the target client device,
• determines a time of the request for access, a referring domain of the request, and a destination domain of the request,
• determines that the destination domain is not included in a list of previously determined first-party domains stored in the first memory cache,
• classifies the request for access as a third-party request,
• if the referring domain of the third-party request is included in a list of previously determined third-party domains, sets a counter value for the third-party request in the second memory cache based on whether an expiration time associated with the referring domain has expired, wherein the expiration time identifies a time in which the third-party request is removed from the list of previously determined third-party domains,
• if the referring domain of the third-party request is not included in a list of previously determined third-party domains, adds the third-party request to the list of previously determined third-party domains and sets the counter value for the third-party request in the second memory cache to zero, and
• adds the referring domain of the third-party request to the list of previously determined first-party domains stored in the first memory cache if the counter value for the third-party request in the second memory cache is greater than a non-zero threshold value.

A system for uniquely identifying a network client or application based on a transport layer security (TLS) handshake, comprising:

• a computing device;
• a memory included in the computing device storing a list of cipher suites and a list of supported curves;
• and
• a processor of the computing device, wherein the processor
• intercepts a data packet transmitted to as part of the TLS handshake,
• filters cipher suites included in the list of cipher suites from the data packet,
• filters supported curves included in the list of supported curves from the data packet,
• builds a data string using data in the data packet remaining after filtering,
• generates a signature value by hashing the data string, and
• identifies a network client or application using the generated signature value.