US Patent 10887348 Detection of network traffic interception

A network security service is provided to detect various intermediaries to a network connection between a client and a destination service, such as a man-in-the-middle (MITM). The network security service may obtain session feature information indicating attributes of the network connection. Based at least in part on the session feature information the network security service may detect an intermediary and perform a security measure.