Proposal: Support HTTP2 fingerprint
deancn opened this issue · 1 comments
deancn commented
Is your feature request related to a problem? Please describe.
In recent years, cyber security is facing more and more issues, as a gateway component, BFE should consider and improve the security part.
We can see BFE already integrated with ja3(salesforce), it's very good. But ja3 can be impersonated easier and easier
We found a good solution - http2fingerprint(akamai) this year, and i have already used it. so I propose to implement it in BFE.
Demo: https://privacycheck.sec.lrz.de/passive/fp_h2/fp_http2.html#fpDemoHttp2
Describe the solution you'd like
Describe alternatives you've considered
Additional context
Reference Paper:
https://www.blackhat.com/docs/eu-17/materials/eu-17-Shuster-Passive-Fingerprinting-Of-HTTP2-Clients-wp.pdf
xqbumu commented
here is an initial implementation: