Client application fingerprinting based on analysis of client requests
AssigneeVerizon Media Inc.
InventorsWilliam Salusky, Mark Ellzey Thomas
Life of this patent
Estimating the term…
Abstract
Processes are disclosed for fingerprinting and identifying client applications based on the analysis of client requests. In an HTTP-based embodiment, a fingerprint is constructed based on the presence and order of HTTP headers included in a request from a client application or device. This fingerprint may then be compared to known fingerprints associated with particular client applications to identify the particular client application and/or to assess whether the client application is malicious. The results of this analysis may, for example, be used to determine how to respond to the current request and/or subsequent requests.
Claims20
A computer system for generating a fingerprint corresponding to a browser request comprising header values, the computer system comprising:
- a database that stores instructions for generating a fingerprint corresponding to a browser request comprising header values and that stores data corresponding to a correlation between one or more header values in the browser request and one or more stored known header values;
- and
- a hardware processor implementing the instructions to perform a plurality of steps comprising:
- retrieving data packets corresponding to a Hypertext Transfer Protocol (HTTP) request over a network, the HTTP request comprising a uniform resource identifier and a plurality of headers;
- generating a fingerprint of the request, the fingerprint based at least partly on a subset of the plurality of headers;
- comparing information corresponding to the fingerprint to information corresponding to a look up table in order to identify a type of client application that generated the browser request;
- and
- determining an appropriate response to the HTTP request based at least partly on the information corresponding to the type of the client application.
A computer-implemented method for generating a fingerprint corresponding to a browser request comprising header values, the computer-implemented method comprising:
- storing, in a database, data corresponding to a correlation between one or more header values in the browser request and one or more stored known header values;
- receiving data packets corresponding to a Hypertext Transfer Protocol (HTTP) request over a network, the HTTP request comprising a uniform resource identifier and a plurality of headers;
- generating a fingerprint of the request, the fingerprint based at least partly on a subset of the plurality of headers;
- comparing information corresponding to the fingerprint to information corresponding to a look up table in order to identify a type of client application that generated the browser request;
- and
- determining an appropriate response to the HTTP request based at least partly on the information corresponding to the type of the client application.
A non-transitory computer-readable medium for generating a fingerprint corresponding to a browser request comprising header values, storing instructions that, when executed, enable one or more processors to:
- store data corresponding to a correlation between one or more header values in the browser request and one or more stored known header values;
- receive data packets corresponding to a Hypertext Transfer Protocol (HTTP) request over a network, the HTTP request comprising a uniform resource identifier and a plurality of headers;
- generate a fingerprint of the request, the fingerprint based at least partly on a subset of the plurality of headers;
- compare information corresponding to the fingerprint to information corresponding to a look up table in order to identify a type of client application that generated the browser request;
- and
- determine an appropriate response to the HTTP request based at least partly on the information corresponding to the type of the client application.
Dependencies are inferred from the claim text.