# US 11,122,067 B2 · Methods for detecting and mitigating malicious network behavior and devices thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,067 B2 - Document ID: US11122067B2 - Status: Granted - Kind: B2 - Application number: 16/534,126 - Filed: 2019-08-07 - Published: 2019-11-28 - Granted: 2021-09-14 - Earliest claimed: 2016-09-20 - Assignees: F5 Networks, Inc. - Applicants: F5 Networks, Inc. - Inventors: Shlomo Yona; Ron Talmor; Itsik Mantin; Yaniv Shemesh - Web page: https://patentgrep.com/patent/US11122067B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1458: {Denial of Service} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, non-transitory computer readable media, anomaly detection apparatuses, and network traffic management systems that generate, based on the application of one or more models and for a first flow associated with a received first set of network traffic, one or more likelihood scores and at least one flow score based on the likelihood scores. One or more of the one or more models are associated with one or more browsing patterns for a web application to which the first set of network traffic is directed. A determination is made when the flow score exceeds a threshold. A mitigation action is initiated, based on a stored policy, with respect to the first set of network traffic, when the determining indicates that the flow score exceeds the established threshold. ## Claims ### Claim 1 A method for network security implemented by a network traffic management system comprising one or more anomaly detection apparatuses, server devices, or client devices, the method comprising: applying a model to received network traffic to generate a likelihood score and a flow score based on the likelihood score, wherein of the model is associated with a browsing pattern for a web application to which the network traffic is directed; and initiating a mitigation action against the network traffic, when the flow score exceeds a threshold. ### Claim 2 (depends on 1) The method of claim 1, further comprising: updating a sub-model of the model based on an obtained raw feature associated with other received network traffic; and sending a client-side script to a client that originated the other network traffic, the client-side script configured to, when executed, return the raw feature associated with the other network traffic. ### Claim 3 (depends on 2) The method of claim 2, wherein the sub-model comprises a start node model, an end node model, a page hit model, a web resource hit model, a forward transition model, a backward transition model, a visit period model, a resource inclusion model, or an Asynchronous JavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model. ### Claim 4 (depends on 1) The method of claim 1, wherein the model comprises a web application model and an anomaly detection model and the method further comprises applying the web application model to the network traffic to generate the likelihood score and the anomaly detection model to the likelihood score to generate the flow score. ### Claim 5 (depends on 1) The method of claim 1, further comprising selecting the model from a plurality of stored models based on a current time or a platform corresponding to a flow associated with the network traffic. ### Claim 6 A non-transitory computer readable medium having stored thereon instructions for network security comprising executable code which when executed by one or more processors, causes the processors to: apply a model to received network traffic to generate a likelihood score and a flow score based on the likelihood score, wherein of the model is associated with a browsing pattern for a web application to which the network traffic is directed; and initiating a mitigation action against the network traffic, when the flow score exceeds a threshold. ### Claim 7 (depends on 6) The non-transitory computer readable medium of claim 6, wherein the executable code when executed by the processors further causes the processors to: update a sub-model of the model based on an obtained raw feature associated with other received network traffic; and send a client-side script to a client that originated the other network traffic, the client-side script configured to, when executed, return the raw feature associated with the other network traffic. ### Claim 8 (depends on 7) The non-transitory computer readable medium of claim 7, wherein the sub-model comprises of a start node model, an end node model, a page hit model, a web resource hit model, a forward transition model, a backward transition model, a visit period model, a resource inclusion model, or an Asynchronous JavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model. ### Claim 9 (depends on 6) The non-transitory computer readable medium of claim 6, wherein the model comprise a web application model and an anomaly detection model and the executable code when executed by the processors further causes the processors to apply the web application model to the network traffic to generate the likelihood score and the anomaly detection model to the likelihood score to generate the flow score. ### Claim 10 (depends on 6) The non-transitory computer readable medium of claim 6, wherein the executable code when executed by the processors further causes the processors to select the model from a plurality of stored models based on a current time or a platform corresponding to a flow associated with the network traffic. ### Claim 11 An anomaly detection apparatus comprising: a memory comprising programmed instructions stored thereon and one or more processors configured to execute the stored programmed instructions to: apply a model to received network traffic to generate a likelihood score and a flow score based on the likelihood score, wherein the model is associated with a browsing pattern for a web application to which the network traffic is directed; and initiating a mitigation action against the network traffic, when the flow score exceeds a threshold. ### Claim 12 (depends on 11) The anomaly detection apparatus of claim 11, wherein the processors are further configured to execute the stored programmed instructions to: update a sub-model of the model based on an obtained raw feature associated with other received network traffic; and send a client-side script to a client that originated the other network traffic, the client-side script configured to, when executed, return of the raw feature associated with the other network traffic. ### Claim 13 (depends on 12) The anomaly detection apparatus of claim 12, wherein the sub-model comprises a start node model, an end node model, a page hit model, a web resource hit model, a forward transition model, a backward transition model, a visit period model, a resource inclusion model, or an Asynchronous JavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model. ### Claim 14 (depends on 11) The anomaly detection apparatus of claim 11, wherein the model comprises a web application model and an anomaly detection model and the processors are further configured to execute the stored programmed instructions to apply the web application model to the network traffic to generate the likelihood score and the anomaly detection model to the likelihood score to generate the flow score. ### Claim 15 (depends on 11) The anomaly detection apparatus of claim 11, wherein the processors are further configured to execute the stored programmed instructions to select the model from a plurality of stored models based on a current time or a platform corresponding to a flow associated with the network traffic. ### Claim 16 A network traffic management system comprising: one or more anomaly detection apparatuses, server devices, or client devices with memory comprising programmed instructions stored thereon and one or more processors configured to execute the stored programmed instructions to: apply a model to received network traffic to generate a likelihood score and a flow score based on the likelihood score, wherein the model is associated with a browsing pattern for a web application to which the network traffic is directed; and initiating a mitigation action against the network traffic, when the flow score exceeds a threshold. ### Claim 17 (depends on 16) The network traffic management system of claim 16, wherein the processors are further configured to execute the stored programmed instructions to: update a sub-model of the model based on an obtained raw feature associated with other received network traffic; and send a client-side script to a client that originated the other network traffic, the client-side script configured to, when executed, return of the raw feature associated with the other network traffic. ### Claim 18 (depends on 17) The network traffic management system of claim 17, wherein the sub-model comprises a start node model, an end node model, a page hit model, a web resource hit model, a forward transition model, a backward transition model, a visit period model, a resource inclusion model, or an Asynchronous JavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model. ### Claim 19 (depends on 16) The network traffic management system of claim 16, wherein the model comprises a web application model and an anomaly detection model and the processors are further configured to execute the stored programmed instructions to apply the web application model to the network traffic to generate the likelihood score and the anomaly detection model to the likelihood score to generate the flow score. ### Claim 20 (depends on 16) The network traffic management system of claim 16, wherein the processors are further configured to execute the stored programmed instructions to select the model from a plurality of stored models based on a current time or a platform corresponding to a flow associated with the network traffic.