# US 10,320,784 B1 · Methods for utilizing fingerprinting to manage network security and devices thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,784 B1 - Document ID: US10320784B1 - Status: Granted - Kind: B1 - Application number: 14/939,697 - Filed: 2015-11-12 - Granted: 2019-06-11 - Earliest claimed: 2014-11-12 - Assignees: F5 Networks, Inc. - Applicants: F5 Networks, Inc. - Inventors: Ron Talmor; Yaniv Shemesh - Web page: https://patentgrep.com/patent/US10320784B1 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, non-transitory computer readable media, and security management computing devices are disclosed herein. With this technology, an executable code is sent to a client. The executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint. A determination is made when the fingerprint is returned from the client. When the determining indicates that the fingerprint has been returned, a determination is made when a record of a reputation database matches the fingerprint. Historical data in the record is updated to include information associated with the request and an action is initiated based on the historical data or other data included in the record. The action includes blocking an access request or providing access to a requested resource to the client, when the determining indicates that the record of the reputation database matches the fingerprint. ## Claims ### Claim 1 A method for improved network security management using fingerprinting implemented by a network traffic management system comprising one or more security management computing devices, one or more server devices, and one or more client devices, the method comprising: sending, prior to providing access to a client in response to a request for a resource, executable code to the client, wherein the executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint in response; determining whether the fingerprint has been returned from the client; when the fingerprint has not been returned from the client, blocking the request; when the fingerprint has been returned from the client, determining whether a record of a reputation database matches the fingerprint; and when the record of the reputation database matches the fingerprint: updating historical data in the record to include information associated with the request; and initiating an action based on the historical data or other data included in the record, the action comprising blocking the request or providing access to the resource to the client. ### Claim 2 (depends on 1) The method as set forth in claim 1, wherein the fingerprint is used to prevent an activity selected from scraping a website, initiating a denial of service (DOS) attack, repeatedly guessing authentication information, initiating a fraudulent activity, accessing a virtual private network (VPN) without authorization, exploiting a web application, or hijacking a session. ### Claim 3 (depends on 1) The method as set forth in claim 1, wherein the information associated with the request comprises a time at which the request was received from the client or the historical data comprises a number of requests received from the client or a number of requests to access the resource received from the client. ### Claim 4 (depends on 1) The method as set forth in claim 1, further comprising: determining whether an Internet Protocol (IP) address of the client is included in a blacklist; and blocking the request prior to requesting the fingerprint, when the IP address of the client is included in the blacklist. ### Claim 5 (depends on 1) The method as set forth in claim 1, wherein the historical data is based on network traffic received from the client by two or more network devices having access to the reputation database. ### Claim 6 (depends on 1) The method as set forth in claim 1, further comprising, when the record of the reputation database does not match the fingerprint: inserting a new record into the reputation database including the fingerprint; requesting additional authentication information from the client; and initiating the action based on a response received from the client to the request for additional authentication information. ### Claim 7 A non-transitory computer readable medium having stored thereon instructions for improved network security management using fingerprinting, comprising first executable code, which, when executed by one or more processors, causes the processors to: send, prior to providing access to a client in response to a request for a resource, second executable code to the client, wherein the second executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint in response; determine whether the fingerprint has been returned from the client; when the fingerprint has not been returned from the client, block the request; when the fingerprint has been returned from the client, determine whether a record of a reputation database matches the fingerprint; and when the record of the reputation database matches the fingerprint: update historical data in the record to include information associated with the request; and initiate an action based on the historical data or other data included in the record, the action comprising blocking the request or providing access to the resource to the client. ### Claim 8 (depends on 7) The non-transitory computer readable medium as set forth in claim 7, wherein the fingerprint is used to prevent an activity selected from scraping a website, initiating a denial of service (DOS) attack, repeatedly guessing authentication information, initiating a fraudulent activity, accessing a virtual private network (VPN) without authorization, exploiting a web application, or hijacking a session. ### Claim 9 (depends on 7) The non-transitory computer readable medium as set forth in claim 7, wherein the information associated with the request comprises a time at which the request was received from the client or the historical data comprises a number of requests received from the client or a number of requests to access the resource received from the client. ### Claim 10 (depends on 7) The non-transitory computer readable medium as set forth in claim 7, wherein the first executable code, when executed by the processors, further causes the processors to: determine whether an Internet Protocol (IP) address of the client is included in a blacklist; and block the request prior to requesting the fingerprint, when the IP address of the client is included in the blacklist. ### Claim 11 (depends on 7) The non-transitory computer readable medium as set forth in claim 7, wherein the historical data is based on network traffic received from the client by two or more network devices having access to the reputation database. ### Claim 12 (depends on 7) The non-transitory computer readable medium as set forth in claim 7, wherein the first executable code, when executed by the processors, further causes the processors to, when the record of the reputation database does not match the fingerprint: insert a new record into the reputation database including the fingerprint; request additional authentication information from the client; and initiate the action based on a response received from the client to the request for additional authentication information. ### Claim 13 A security management computing device, comprising memory comprising programmed instructions stored thereon and one or more processors configured to execute the stored programmed instructions to: send, prior to providing access to a client in response to a request for a resource, executable code to the client, wherein the executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint in response; determine whether the fingerprint has been returned from the client; when the fingerprint has not been returned from the client, block the request; when the fingerprint has been returned from the client, determine whether a record of a reputation database matches the fingerprint; and when the record of the reputation database matches the fingerprint: update historical data in the record to include information associated with the request; and initiate an action based on the historical data or other data included in the record, the action comprising blocking the request or providing access to the resource to the client. ### Claim 14 (depends on 13) The security management computing device as set forth in claim 13, wherein the fingerprint is used to prevent an activity selected from scraping a website, initiating a denial of service (DOS) attack, repeatedly guessing authentication information, initiating a fraudulent activity, accessing a virtual private network (VPN) without authorization, exploiting a web application, or hijacking a session. ### Claim 15 (depends on 13) The security management computing device as set forth in claim 13, wherein the information associated with the request comprises a time at which the request was received from the client or the historical data comprises a number of requests received from the client or a number of requests to access the resource received from the client. ### Claim 16 (depends on 13) The security management computing device as set forth in claim 13, wherein the processors are further configured to execute the stored programmed instructions to: determine whether an Internet Protocol (IP) address of the client is included in a blacklist; and block the request prior to requesting the fingerprint, when the IP address of the client is included in the blacklist. ### Claim 17 (depends on 13) The one or more security management computing devices as set forth in claim 13, wherein the historical data is based on network traffic received from the client by two or more network devices having access to the reputation database. ### Claim 18 (depends on 13) The security management computing device as set forth in claim 13, wherein the processors are further configured to execute the stored programmed instructions to, when the record of the reputation database does not match the fingerprint: insert a new record into the reputation database including the fingerprint; request additional authentication information from the client; and initiate the action based on a response received from the client to the request for additional authentication information. ### Claim 19 A network traffic management system comprising one or more security management computing devices, one or more server devices, and one or more client devices, the system comprising memory comprising programmed instructions stored thereon and one or more processors configured to execute the stored programmed instructions to: send, prior to providing access to a client to a requested resource, executable code to the client, wherein the executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint in response; determine whether the fingerprint has been returned from the client; when the fingerprint has not been returned from the client, block the request; when the fingerprint has been returned from the client, determine whether a record of a reputation database matches the fingerprint; and when the record of the reputation database matches the fingerprint: update historical data in the record to include information associated with the request; and initiate an action based on the historical data or other data included in the record, the action comprising blocking the request or providing access to the resource to the client. ### Claim 20 (depends on 19) The network traffic management system of claim 19, wherein the fingerprint is used to prevent an activity selected from scraping a website, initiating a denial of service (DOS) attack, repeatedly guessing authentication information, initiating a fraudulent activity, accessing a virtual private network (VPN) without authorization, exploiting a web application, or hijacking a session. ### Claim 21 (depends on 19) The network traffic management system of claim 19, wherein the processors are further configured to execute the stored programmed instructions to: determine whether an Internet Protocol (IP) address of the client is included in a blacklist; and block the request prior to requesting the fingerprint, when the IP address of the client is included in the blacklist. ### Claim 22 (depends on 19) The network traffic management system of claim 19, wherein the historical data is based on network traffic received from the client by two or more network devices having access to the reputation database. ### Claim 23 (depends on 19) The network traffic management system of claim 19, wherein the information associated with the request comprises a time at which the request was received from the client or the historical data comprises a number of requests received from the client or a number of requests to access the resource received from the client. ### Claim 24 (depends on 19) The network traffic management system of claim 19, wherein the processors are further configured to execute the stored programmed instructions to, when the record of the reputation database does not match the fingerprint: insert a new record into the reputation database including the fingerprint; request additional authentication information from the client; and initiate the action based on a response received from the client to the request for additional authentication information.