MALICIOUS CLIENT DETECTION BASED ON USAGE OF NEGOTIABLE PROTOCOLS

A destination server receives an application layer request, including a user-agent and one or more cipher suites, from a user client to initiate a secure communications channel. In response to the request, the destination server obtains from a user-agent database a set of one or more cipher suites that are supported by a user agent corresponding to the user-agent provided by the user client. The destination server uses this set of one or more cipher suites to determine if the user client fails to support any of these cipher suites. If the destination server determines, based on the set of one or more cipher suites, that the user client fails to support any of these cipher suites, the destination server initiates one or more security measures.