Patent ID: 11916887
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause performance of operations comprising:
receiving, from a client, a first message and a second message associated with connecting the client and a first host, wherein:
the first message comprises an encrypted portion indicating the first host; and
the second message comprises a server name extension indicating a second host;

determining a first set of links, wherein the first set of links are associated with the first host and are determined based on monitoring a result of connecting the client and the first host;
determining a second set of links, wherein the second set of links associated with the second host;
determining, based on comparing the first set of links and the second set of links, whether the first host differs from the second host; and
detecting domain fronting in response to determining that the first host differs from the second host;
wherein monitoring the result of connecting the client and the first host comprises detecting zero or more subsequent connections initiated by the client within a pre-determined time period of connecting the client and the first host.