Passive detection of forged web browsers
AssigneeCequence Security, Inc.
InventorsShreyans Mehta, Ameya Talwalkar
Life of this patent
Estimating the term…
Abstract
Techniques to facilitate passive detection of forged web browsers are disclosed herein. In at least one implementation, web traffic between a web server and a client is monitored, and a hypertext transfer protocol (HTTP) header transmitted by the client is processed to determine a type of web browser associated with the client. Attribute data points for the client are generated based on fields in the HTTP request header transmitted by the client and connection behavior of the client with the web server. The attribute data points for the client are then compared with predetermined attribute data points for the type of web browser associated with the client to determine if the client is a genuine web browser of the type of web browser associated with the client.
Claims20
A method to facilitate passive detection of forged web browsers, the method comprising:
- processing a hypertext transfer protocol (HTTP) request header transmitted by a client to a web server to determine a type of web browser associated with the client;
- monitoring behavior of the client in parsing hypertext markup language and other code when fetching a webpage from the web server, including identifying an order in which the client fetches elements of the webpage;
- generating attribute data points for the client based on fields in the HTTP request header transmitted by the client, the behavior of the client in parsing the hypertext markup language and other code, and connection behavior of the client with the web server;
- comparing the attribute data points for the client with predetermined attribute data points for the type of web browser associated with the client to determine if the client is a genuine web browser of the type of web browser associated with the client;
- and
- eliminating any web traffic from the client upon determining that the type of web browser associated with the client is not a genuine web browser.
An apparatus comprising:
- one or more non-transitory computer-readable storage media;
- and
- program instructions stored on the one or more non-transitory computer-readable storage media that, when executed by a computing system, direct the computing system to at least:
- monitor web traffic between a web server and a client;
- process a hypertext transfer protocol (HTTP) request header transmitted by the client to determine a type of web browser associated with the client;
- monitor behavior of the client in parsing hypertext markup language and other code when fetching a webpage from the web server, including identifying an order in which the client fetches elements of the webpage;
- generate attribute data points for the client based on fields in the HTTP request header transmitted by the client, the behavior of the client in parsing the hypertext markup language and other code, and connection behavior of the client with the web server;
- compare the attribute data points for the client with predetermined attribute data points for the type of web browser associated with the client to determine if the client is a genuine web browser of the type of web browser associated with the client;
- and
- eliminate any web traffic from the client upon determining that the type of web browser associated with the client is not a genuine web browser.
A system comprising
- means for monitoring web traffic between a web server and a client;
- means for processing a hypertext transfer protocol (HTTP) request header transmitted by the client to determine a type of web browser associated with the client;
- means for monitoring behavior of the client in parsing hypertext markup language and other code when fetching a webpage from the web server, including identifying an order in which the client fetches elements of the webpage;
- means for generating attribute data points for the client based on fields in the HTTP request header transmitted by the client, the behavior of the client in parsing the hypertext markup language and other code, and connection behavior of the client with the web server;
- means for comparing the attribute data points for the client with predetermined attribute data points for the type of web browser associated with the client to determine if the client is a genuine web browser of the type of web browser associated with the client;
- and
- means for eliminating any web traffic from the client upon determining that the type of web browser associated with the client is not a genuine web browser.
Dependencies are inferred from the claim text.