# US 11,445,003 B1 · Systems and methods for autonomous program detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,445,003 B1 - Document ID: US11445003B1 - Status: Granted - Kind: B1 - Application number: 17/354,983 - Filed: 2021-06-22 - Granted: 2022-09-13 - Earliest claimed: 2021-06-22 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Rama Rao Katta - Web page: https://patentgrep.com/patent/US11445003B1 ## CPC - H04L 63/1458: {Denial of Service} - H04L 67/01: Protocols - G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries - G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links} - G06F 21/554: {involving event detection and direct action} - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/101: {Access control lists [ACL]} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 67/143: Termination or inactivation of sessions, e.g. event-controlled end of session - H04L 61/30: Managing network names, e.g. use of aliases or nicknames (name-to-address mapping H04L61/45) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for autonomous program management include a device which receives a request from a client responsive to execution of a script on the client. The request may include a location corresponding to the script and an identifier. The device may determine that activity of the client is activity of an autonomous program based on a comparison of the location to a reference being generated by the device for the client and determined using the identifier from the request. The device may block a subsequent request from the client to a server responsive to the determination. ## Claims ### Claim 1 A method comprising: receiving, by a device, a request from a client responsive to execution of a script on the client, the request including a first uniform resource locator (URL) corresponding to the script and a session identifier; determining, by the device, that activity of the client as activity of an autonomous program based on a comparison of the first URL to a reference URL, the reference URL being generated by the device for the client using the session identifier from the request; and blocking, by the device, responsive to the determination, a subsequent request from the client to a server. ### Claim 2 (depends on 1) The method of claim 1, wherein the reference URL is generated by the device for the client, and include data corresponding to at least one of the client, a session of the client, or the request. ### Claim 3 (depends on 2) The method of claim 2, further comprising storing, by the device, the reference URL in a distributed hash table in association with the session identifier. ### Claim 4 (depends on 1) The method of claim 1, further comprising identifying, by the device, the reference URL using the session identifier from the request. ### Claim 5 (depends on 1) The method of claim 1, further comprising generating, by the device, the script for the client using the reference URL and data corresponding to at least one of the client, a session of the client, or the request. ### Claim 6 (depends on 1) The method of claim 1, wherein the request is a second request, and wherein the reference URL comprises data corresponding to at least one of: a domain name for a first request received prior to the first request from the client; a cluster node identifier corresponding to the device; a packet engine identifier corresponding to the device; a transaction number for the first request; a timestamp for the first request; or a domain name URL for the first request. ### Claim 7 (depends on 6) The method of claim 6, wherein the reference URL is a hashed value of the data. ### Claim 8 (depends on 1) The method of claim 1, wherein the request is a second request, the method further comprising: receiving, by the device from the client, a first request prior to the second request; and transmitting, by the device to the client, a response including data to obtain the script from the device and the session identifier identifying a session between the client and a server, wherein the response to the first request causes the client to set the session identifier as a cookie. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving, by the device from the client, a third request subsequent to receiving the first request and prior to receiving the second request, the third request requesting the script, the second request including the session identifier; transmitting, by the device, the script to the client, the script generated by the device based on the client, the session, or the first request. ### Claim 10 (depends on 1) The method of claim 1, wherein the device determines that the activity of the client is autonomous program activity responsive to the session identifier from the request not matching the session identifier generated for the session, or the first URL not matching the reference URL corresponding to the session identifier. ### Claim 11 A device comprising: one or more processors configured to: receive a request from a client responsive to execution of a script on the client, the request including a first uniform resource locator (URL) corresponding to the script and a session identifier; determine that activity of the client activity of an autonomous program based on a comparison of the first URL to a reference URL being generated by the device for the client and determined using the session identifier from the request; and block, responsive to the determination, a subsequent request from the client to a server. ### Claim 12 (depends on 11) The device of claim 11, wherein the reference URL is generated by the device for the client, and include data corresponding to at least one of the client, a session of the client, or the request. ### Claim 13 (depends on 12) The device of claim 12, wherein the one or more processors are further configured to store the reference URL in a distributed hash table in association with the session identifier. ### Claim 14 (depends on 11) The device of claim 11, wherein the one or more processors are further configured to identify the reference URL using the session identifier from the request. ### Claim 15 (depends on 11) The device of claim 11, wherein the one or more processors are further configured to generate the script for the client using the reference URL and data corresponding to at least one of the client, a session of the client, or the request. ### Claim 16 (depends on 11) The device of claim 11, wherein the request is a second request, and wherein the reference URL comprises a hashed value of data corresponding to at least one of: a domain name for a first request received prior to the first request from the client; a cluster node identifier corresponding to the device; a packet engine identifier corresponding to the device; a transaction number for the first request; a timestamp for the first request; or a domain name URL for the first request. ### Claim 17 (depends on 11) The device of claim 11, wherein the request is a second request, and wherein the one or more processors are further configured to: receive, from the client, a first request prior to the second request; and transmit, to the client, a response including data to obtain a script from the device and the session identifier identifying a session between the client and a server, wherein the response to the first request causes the client to set the session identifier as a cookie. ### Claim 18 (depends on 17) The device of claim 17, wherein the one or more processors are further configured to: receive, from the client, a third request subsequent to receiving the first request and prior to receiving the second request, the third request requesting the script executable on the client, the second request including the session identifier; transmit the script to the client, the script generated based on the client, the session, or the first request. ### Claim 19 (depends on 11) The device of claim 11, wherein the one or more processors are configured to determine that the activity of the client is autonomous program activity responsive to the session identifier from the request not matching the session identifier generated for the session, or the first URL not matching the reference URL corresponding to the session identifier. ### Claim 20 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: receive a request from a client responsive to execution of a script on the client, the request including a first uniform resource locator (URL) corresponding to the script and a session identifier; determine that activity of the client is activity of an autonomous program based on a comparison of the first URL to a reference URL generated by the device for the client and determined using the session identifier from the request; and block, responsive to the determination, a subsequent request from the client to a server.