Detecting VPNs/Proxies By Analyzing Their Attack Patterns Over Time

The talk looks at how crowdsourced intrusion data from an open-source intrusion prevention system can be used to spot VPN and proxy addresses. The data only records abusive activity, so anonymized services with mostly legitimate users show up as gaps and irregular bursts rather than steady traffic.

The analysis has two parts. A static view compares which attack scenarios are more common from proxy addresses than from other addresses. Brute-force attempts tend to come from compromised hosts, while spam comments often arrive through anonymized traffic, which suggests attackers rely on anonymization when interrupted attacks still succeed. The dynamic view groups each address's daily mix of attack types into clusters, so small day-to-day variation counts as the same pattern while major shifts count as changes. Frequent changes in cluster membership, along with missing days and erratic activity, point toward a proxy or VPN.

These signals feed a machine learning model trained on externally sourced labels. The model is tuned for recall, which accepts many false positives, and the speaker notes that some of these were later confirmed as unlabeled anonymizers. The pipeline runs serverless on AWS and takes about half a second per lookup. The talk closes with a public labeled dataset released as a competition, giving practitioners a way to build and test their own models.