Fingerprint-Based Bot Blocking & Dynamic Deception
Lightweight reverse proxy and AI agent system using TLS and HTTP fingerprints to block bots and drive dynamic deception.
Summary
Limitations of IP-Based Blocking
IP blocklists rapidly lose effectiveness as attackers cycle through addresses within minutes. In contrast, client TLS and HTTP fingerprints persist across extended campaigns, providing stable identifiers for traffic filtering.
Finch Reverse Proxy Architecture
Finch operates as a lightweight reverse proxy designed to evaluate incoming connections before traffic reaches production infrastructure or research honeypots. The proxy inspects connection attributes—including JA3, JA4, JA4H, and HTTP/2 parameters—to make immediate allow, block, or routing decisions.
AI Agent Dynamic Deception
A custom AI agent processes the event stream generated by Finch. The agent automatically updates filtering rules, suppresses noise from routine scanning bots, and generates synthetic stub responses for unhandled HTTP request paths. This adaptive response pipeline converts passive honeypots and proxies into dynamic deception systems.
Related talks
Blue Team Village·33 min
Thinkst Canary
Shows how deception technology and Thinkst Canary tokens generate high-fidelity alerts during unauthorized network traversal.
Kaspersky·19 min
Engineers explore architecture and security mechanisms for A Framework For Fingerprinting ICS Honeypot.
OWASP Foundation·46 min
Engineers explore architecture and security mechanisms for APPSEC Cali 2018 - Applied Deception Beyond the Honeypot: Moving Past 101.