Unsupervised classification of web traffic users
AssigneeCequence Security, Inc.
InventorsSeiji Armstrong, Shreyans Mehta
Life of this patent
Estimating the term…
Abstract
Techniques to facilitate web traffic classification are disclosed herein. In at least one implementation, web traffic between a plurality of clients and at least one web server is monitored, and the web traffic is analyzed to determine attribute data points associated with each individual client of the plurality of clients. The attribute data points associated with each individual client are compared to define a plurality of client groups based on similarities in the attribute data points among each individual client. A client of the plurality of clients is identified as malicious when the client is included in more than one of the client groups.
Claims20
A method to facilitate web traffic classification, the method comprising:
- monitoring web traffic between a plurality of clients and at least one web server;
- analyzing the web traffic to determine attribute data points associated with each individual client of the plurality of clients;
- creating a plurality of client groups by comparing the attribute data points associated with each individual client, wherein the plurality of client groups are created based on similarities in the attribute data points among each individual client to allow classification and detection of malicious automation tools;
- assigning each individual client of the plurality of clients to one or more of the plurality of client groups;
- identifying a client of the plurality of clients as malicious when the client is included in more than one of the plurality of client groups;
- and
- blocking the client identified as malicious from connection to the at least one web server.
An apparatus comprising:
- one or more non-transitory computer-readable storage media;
- and
- program instructions stored on the one or more non-transitory computer-readable storage media that, when executed by a computing system, direct the computing system to at least:
- monitor web traffic between a plurality of clients and at least one web server;
- analyze the web traffic to determine attribute data points associated with each individual client of the plurality of clients;
- create a plurality of client groups by comparing the attribute data points associated with each individual client, wherein the plurality of client groups are created based on similarities in the attribute data points among each individual client to allow classification and detection of malicious automation tools;
- assign each individual client of the plurality of clients to one or more of the plurality of client groups;
- identify a client of the plurality of clients as malicious when the client is included in more than one of the plurality of client groups;
- and
- block the client identified as malicious from connecting to the at least one web server.
One or more non-transitory computer-readable storage media having program instructions stored thereon to facilitate web traffic classification, wherein the program instructions, when executed by a computing system, direct the computing system to at least:
- monitor web traffic between a plurality of clients and at least one web server;
- analyze the web traffic to determine attribute data points associated with each individual client of the plurality of clients;
- create a plurality of client groups by comparing the attribute data points associated with each individual client, wherein the plurality of client groups are created based on similarities in the attribute data points among each individual client to allow classification and detection of malicious automation tools;
- assign each individual client of the plurality of clients to one or more of the plurality of client groups;
- identify a client of the plurality of clients as malicious when the client is included in more than one of the plurality of client groups;
- and
- block the client identified as malicious from connecting to the at least one web server.
Dependencies are inferred from the claim text.