# US 10,375,026 B2 · Web transaction status tracking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,026 B2 - Document ID: US10375026B2 - Status: Granted - Kind: B2 - Application number: 14/925,547 - Filed: 2015-10-28 - Published: 2017-05-04 - Granted: 2019-08-06 - Earliest claimed: 2015-10-28 - Assignees: Shape Security, Inc. - Applicants: Shape Security, Inc. - Inventors: Siying Yang; Justin D. Call - Web page: https://patentgrep.com/patent/US10375026B2 ## CPC - H04L 63/0281: {Proxies} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and other techniques for improving the operation of computing systems are described. Some implementations include a computer-implemented method. The method can include intercepting, at an intermediary computing system, messages communicated between a web server system and one or more client computing devices. A subset of the intercepted messages can be selected that are determined to commonly relate to a particular web transaction. The method can identify an expression pattern that occurs in the subset of the intercepted messages, and can determine that the identified expression pattern matches a first pre-defined expression pattern from among a plurality of different pre-defined expression patterns. A status of the particular web transaction can be determined based on the first pre-defined expression pattern that matches the identified expression pattern occurring in the subset of the intercepted messages. Information can be stored that indicates the determined status of the particular web transaction. ## Claims ### Claim 1 A computer-implemented method, comprising: intercepting, at an intermediary computing system, first response messages comprising web code for web page content served by a web server system to client computing devices in response to first operations of a particular operation type when the first operations have a successful completion state; determining a first expression pattern with at least one wildcard value that occurs in the web code of the web page content of each of the first response messages served in response to the first operations when the first operations have the successful completion state; storing a first mapping from the first expression pattern to a success status for the particular operation type; intercepting, at the intermediary computing system, second response messages comprising web code for web page content served by the web server system to the client computing devices in response to second operations of the particular operation type when the second operations have an unsuccessful completion state; determining a second expression pattern with at least one wildcard value that occurs in the web code of the web page content of each of the second response messages served in response to the second operations when the second operations have the unsuccessful completion state; storing a second mapping from the second expression pattern to a non-success status for the particular operation type; based on a set of mappings comprising the first mapping and the second mapping, determining a status for each operation of a set of operations of the particular operation type based on matching one or more expression patterns in the set of mappings to web code for one or more web page content served by the web server system in response to the set of operations; updating aggregate status information for the particular operation type based on the status for the set of operations; and based on the aggregate status information corresponding to the particular operation type, performing an appropriate action; wherein the method is performed by one or more computing devices. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the appropriate action is performed based on determining that a volume of unsuccessful operations of the particular operation type over a period of time exceeds a threshold volume of unsuccessful operations. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the appropriate action is performed based on determining that a volume of unsuccessful operations of the particular operation type is changed over a period of time by an amount that exceeds a threshold amount. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the appropriate action comprises adjusting security parameters based on credentials for login operations with a non-success status. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: intercepting, at the intermediary computing system, third response messages comprising web code for web page content served by the web server system to the client computing devices in response to third operations of the particular operation type when the third operations have a third completion state; determining a third expression pattern that occurs in the web code of the web page content of each of the third response messages served in response to the third operations when the third operations have the third completion state; storing a third mapping from the third expression pattern to a third status for the particular operation type; wherein the third status indicates a pending operation. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising receiving, at the intermediary computing system, user-defined configuration data that specifies the first expression pattern and the second expression pattern. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein identifying the first expression pattern and identifying the second expression pattern comprises generating the first expression pattern and the second expression pattern based on a model that automatically determines distinctive characteristics of model web page content served by the web server system regarding the particular operation type that describe different statuses for the particular operation type, wherein the model web page content includes web code that corresponds to the success status for the particular operation type and web code that corresponds to the non-success status for the particular operation type. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the first expression pattern comprises distinctive characteristics of at least one of body content and header content of web code for web page content served by the web server system when operations of the particular operation type have the successful completion state. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the first expression pattern specifies a combination of distinct message components that collectively indicate distinctive characteristics of response messages that correspond to the success status of the particular operation type. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein: the first expression pattern is associated with one or more constraints, and matching the first expression pattern to web code for web page content served by the web server system comprises determining that the one or more constraints are satisfied by the web code. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the intermediary computing system is configured as a proxy to the web server system such that incoming and outgoing messages from the web server system are routed through the intermediary computing system for processing before the incoming messages are provided to the web server system or before the outgoing messages are delivered to the client computing devices. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein: the intermediary computer system applies a set of one or more security countermeasures to web code received from the web server system that is directed to the client computing devices before transmitting the web code from the intermediary computing system to the client computing devices for execution at the client computing devices. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the appropriate action comprises adjusting the set of one or more security countermeasures based on the aggregate status information for the particular operation type. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the set of security countermeasures is adjusted based on aggregate status information corresponding to unsuccessful operations of the particular operation type over a period of time. ### Claim 15 (depends on 1) The computer-implemented method of claim 1, wherein the particular operation type is a login operation type. ### Claim 16 (depends on 1) The computer-implemented method of claim 1, further comprising generating one or more log entries describing status information for the operations of the particular operation type. ### Claim 17 (depends on 1) The computer-implemented method of claim 1, wherein udating the aggregate status information corresponding to the particular operation type comprises maintaining a first counter that indicates a number of operations with the success status for the particular operation type and maintain a second counter that indicates a number of operations with the non-success status for the particular operation type. ### Claim 18 (depends on 2) The computer-implemented method of claim 2, further comprising: based on the aggregate status information, determining that an occurrence of unsuccessful operations of the particular operation type exceeds a threshold; and providing, by the intermediate computing system, a notification to the web server system indicating that the threshold was exceeded. ### Claim 19 A computer system for identifying and blocking unauthorized requests based on request volume comprising: one or more hardware processors; a memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to: intercept, at an intermediary computing system, first response messages comprising web code for web page content served by a web server system to one or more client computing devices in response to first, operations of a particular operation type when the first operations have a successful completion state; determine a first expression pattern with at least one wildcard value that occurs in the web code of the web page content of each of the first response messages served in response to the first operations when the first operations have the successful completion state; store a first mapping from the first expression pattern to a success status for the particular operation type; intercepting, at the intermediary computing system, second response messages comprising web code for page content served by the web server system to the client computing devices in response to second operations of the particular operation type when the second operations have an unsuccessful completion state; determine a second expression pattern with at least one wildcard value that occurs in the web code of the web page content of each of the second response messages served in response to the second operations when the second operations have the unsuccessful completion state; store a second mapping from the second expression pattern to a non-success status for the particular operation type; based on a set of mappings comprising the first mapping and the second mapping, determine a status for each operation of a set of operations of the particular operation type based on matching one or more expression patterns in the set of mappings to web code for one or more web page content served by the web server system in response to the set of operations; updating aggregate status information for the particular operation type based on the status for the set of operations; and corresponding to and based on the aggregate status information for the particular operation type, performing an appropriate action. ### Claim 20 (depends on 19) The system of claim 19, wherein the appropriate action is performed based on determining that a volume of unsuccessful operations of the particular operation type over a period of time exceeds a threshold volume of unsuccessful operations. ### Claim 21 (depends on 19) The system of claim 19, wherein the appropriate action is performed based on determining that a volume of unsuccessful operations of the particular operation type is changed over a period of time by an amount that exceeds a threshold amount. ### Claim 22 (depends on 21) The system of claim 21, wherein the appropriate action comprises adjusting security parameters based on credentials for login operations with a non-success status. ### Claim 23 (depends on 19) The system of claim 19, wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to: intercepting, at the intermediary computing system, third response messages comprising web code for web page content served by the web server system to the client computing devices in response to one or more third operations of the particular operation type when the third operations have a third completion state; determine a third expression pattern that occurs in the web code of the web page content of each of the third response messages served in response to the third operations when the third operations have the third completion state; store a third mapping from the third expression pattern to a third status for the particular operation type, wherein the set of mappings includes the third mapping; wherein the third status indicates a pending operation. ### Claim 24 (depends on 19) The system of claim 19, wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to receive, at the intermediary computing system, user-defined configuration data that specifies the first expression pattern and the second expression pattern. ### Claim 25 (depends on 19) The system of claim 19, wherein identifying the first expression pattern and identifying the second expression pattern comprises generating the first expression pattern and the second expression pattern based on a model that automatically determines distinctive characteristics of model web page content served by the web server system regarding the particular operation type that describe different statuses for the particular operation type, wherein the model web page content includes web code that corresponds to the success status for the particular operation type web code that corresponds to the non-success status for the particular operation type. ### Claim 26 (depends on 19) The system of claim 19, wherein the intermediary computing system is configured as a proxy to the web server system such that incoming and outgoing messages from the web server system are routed through the intermediary computing system for processing before the incoming messages are provided to the web server system or before the outgoing messages are delivered to the client computing devices. ### Claim 27 (depends on 19) The system of claim 19, wherein: the intermediary computer system applies a set of one or more security countermeasures to the web code received from the web server system that is directed to the client computing devices before transmitting the web code from the intermediary computing system to the client computing devices for execution at the client computing devices. ### Claim 28 (depends on 27) The system of claim 27, wherein the one appropriate action comprises adjusting the set of one or more security countermeasures based on the aggregate status information for the particular operation type. ### Claim 29 (depends on 28) The system of claim 28, wherein the set of security countermeasures is adjusted based on aggregate status information corresponding to unsuccessful operations of the particular operation type over a period of time. ### Claim 30 (depends on 19) The system of claim 19, wherein the particular operation type is a login operation type. ### Claim 31 (depends on 19) The system of claim 19, wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to generate one or more log entries describing status information for the operations of the particular operation type. ### Claim 32 (depends on 19) The system of claim 19, wherein updating the aggregate status information corresponding to the particular operation type comprises maintaining a first counter that indicates a number of operations with the success status for the particular operation type and maintain a second counter that indicates a number of operations with the non-success status for the particular operation type. ### Claim 33 (depends on 20) The system of claim 20, wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to: based on the aggregate status information, determine that an occurrence of unsuccessful operations of the particular operation type exceeds a threshold; and provide, by the intermediate computing system, a notification to the web server system indicating that the threshold was exceeded.