DETECTION OF PROXIED NETWORK CONNECTIONS

Methods, systems, and apparatus for detection of proxied network connections are disclosed. The methods, systems, and apparatus for detection of proxied network connections perform analysis of network packets observed in real-time, near real-time, or stored packet captures and/or reassembled payloads to identify if a particular network connection includes traversal of one or more proxied connections or tunnels from a client to a proxy server before being routed to the eventual endpoint. The methods, systems, and apparatus for detection of proxied network connections also perform analysis to provide a risk score to inform a policy that may block, challenge, or allow the connection.