# US 11,451,583 B2 · System and method to detect and block bot traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,583 B2
- Document ID: US11451583B2
- Status: Granted
- Kind: B2
- Application number: 16/364,710
- Filed: 2019-03-26
- Published: 2019-07-18
- Granted: 2022-09-20
- Earliest claimed: 2016-10-05
- Assignees: Radware, Ltd.
- Applicants: Kaalbi Technologies Private Limited
- Inventors: Rakesh Thatha; Jyoti Kakatkar
- Web page: https://patentgrep.com/patent/US11451583B2

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00)
- G06F 15/16: Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs {(coordinating program control therefor G06F9/52; in regulating and control system G05B)}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 63/168: {above the transport layer}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)}
- G06Q 10/00: Administration; Management
- H04L 2463/144: Detection or countermeasures against botnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system and method for bot detection utilizing storage variables are presented. The storage variables generated is used to analyze user behavior and distinguish human traffic from bot traffic. The system for detecting bot traffic using storage variables includes a client application, a computer network, a bot detector, a bot computer, a storage variable generator, and a server. The client device enables a user to access information through the client application. The storage variable generator is configured to generates a plurality of storage variables including counter storage variable. The bot detector analyses the presence of bots in incoming traffic.

## Claims

### Claim 1

A computer implemented method for detecting and blocking bots, comprising:
receiving a HTTP request from a client application by a connector;
generating a plurality of storage variables corresponding to the HTTP request by a storage variable generator;
initiating an API call by a connector to a bot detection computer for every HTTP request received from the client application;
injecting storage variables in an HTTP response sent from a web server to the client application by the connector;
injecting a preset snippet into the HTTP response sent to the client application, and wherein the code snippet is configured to execute at the client application and further transmit client-side parameters to the bot detection server;
analyzing the plurality of storage variables and client-side parameters in the HTTP response by the bot detection computer to detect bots;
generating a bot signature based on detection of a bot and storing the generated bot signature in a database in the bot detection computer, wherein the bot signature database is stored in the bot detection computer and a replica of the bot signature database is stored in the web server; and
performing a preset action on the HTTP requests emerging from the client application in response to detection of a bot, wherein the preset action comprises one of blocking subsequent HTTP requests, displaying a captcha on the client application.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of storage variables includes a ‘A’ storage variable, ‘D’ storage variable, ‘C’ storage variable and ‘B’ storage variable, and wherein ‘A’ storage variable is a HTTP storage variable used for uniquely identifying a session, and wherein ‘D’ is a HTTP storage variable used for uniquely identifying a timestamp of a first request, and wherein ‘C’ is a HTTP storage variable used for identifying the number of pages accessed in the session, and wherein ‘B’ is a HTTP storage variable used for uniquely identifying the timestamp of a current request.

### Claim 3 (depends on 2)

The method of claim 2, wherein analyzing the plurality of storage variables comprises:
tracking visitors accessing the client application using ‘A’ storage variable and IP address of the client application;
incrementing the ‘C’ storage variable on each HTTP request from the client application; and
determining a visitor as a bot when the ‘C’ storage variable is detected to be not incremented.

### Claim 4 (depends on 2)

The method of claim 2, wherein the step of analyzing the plurality of storage variables comprises:
analyzing the ‘A’ and ‘C’ storage variables across a plurality of HTTP requests; and
determining a spoofing of storage variable when the ‘C’ storage variable remains same for the plurality of HTTP requests.

### Claim 5 (depends on 1)

The method of claim 1, wherein the API call initiates generation of a ‘A’ storage variable, ‘C’ storage variable, and timestamp storage variables ‘B’ and ‘D’ using a storage variable generator.

### Claim 6 (depends on 1)

The method of claim 1, wherein the preset snippet is a Javascript code snippet, and wherein the Javascript code snippet is configured to collect client-side parameters.

### Claim 7 (depends on 1)

The method of claim 1, wherein analyzing the plurality of storage variables comprises determining a visitor as a distributed bot when a single ‘A’ storage variable is received from multiple IP address.

### Claim 8 (depends on 1)

The method of claim 1, wherein analyzing the plurality of storage variables comprises determining a visitor as a bot when a single ‘A’ storage or IP address makes requests at a rate higher than a specified threshold.

### Claim 9 (depends on 1)

The method of claim 1, wherein analyzing the plurality of storage variables comprises:
analyzing time series anomalies between the plurality of HTTP requests; and
determining interarrival time between successive requests from a same IP address or ‘A’ has a standard deviation that is substantially zero.

### Claim 10 (depends on 1)

The method of claim 1, wherein performing preset action by blocking subsequent requests further comprises:
blocking requests by analysis with the replica of bot signature database; and
blocking requests by using an asynchronous feed.

### Claim 11 (depends on 1)

The method of claim 1, wherein blocking subsequent requests by analysis with the replica of bot signature database further comprises:
comparing the HTTP request at the connector with the replica of bot signature database before initiating API call;
providing the HTTP response to the client application immediately after analysis, thereby reducing a delay involved in providing HTTP response; and
blocking the HTTP request when a bot is detected after comparison with the bot signature database.

### Claim 12 (depends on 1)

The method of claim 1, wherein blocking subsequent requests by using an asynchronous feed further comprises:
providing the HTTP response to the client application immediately in response to the HTTP request;
analyzing data received through the API calls at the bot detection computer to compute bot signatures;
providing the computed bot signatures asynchronously through a feed to the web server;
storing the computed bot signatures in one of a Content Delivery Network (CDN), Web Application Firewall (WAF), and hardware appliance present at the web server; and
blocking consecutive HTTP request from a bot at one of a CDN, WAF, and hardware appliance using the computed bot signatures.

### Claim 13

A system for detecting and blocking bots, comprising:
a bot detection computer; and
a connector connected to a web server, wherein the connector is comprised of at least processing hardware adapted to receive an HTTP request of a client application sent from a client computing device, wherein the connector is further adapted to initiate an API call to the bot detection computer for every HTTP request received from the client application, and wherein the connector comprises a storage variable generator, and wherein the storage variable generator comprises at least processing hardware adapted to generate a plurality of storage variables corresponding to the HTTP request;
wherein the bot detection computer is coupled to the web server over a computer network, and wherein the bot detection computer is adapted to perform a preset action on every HTTP request emerging from the client application in response to detection of a bot;
wherein the bot detection computer is further adapted to: analyze the plurality of storage variables and client-side parameters in an HTTP response to detect bots, and generate a bot signature based on detection of a bot and storing the generated bot signature in a database in the bot detection computer, wherein the bot signature database is stored in the bot detection computer and a replica of the bot signature database is stored in the web server.

### Claim 14 (depends on 13)

The system of claim 13, wherein the preset action comprises one of blocking subsequent HTTP requests, and displaying a captcha on the client computing device.

### Claim 15 (depends on 14)

The system of claim 14, wherein the bot detection computer comprises a bot detector and a bot signature database.

### Claim 16 (depends on 13)

The system of claim 13, wherein the connector is configured to:
inject storage variables in the HTTP response sent from web server to the client application;
inject a code snippet into the HTTP response sent to the client application, wherein the JavaScript code snippet is configured to collect client-side parameters;
inject storage variables in an HTTP response sent from web server to the client application; and
block HTTP requests from the client application in response to detection of a bot.

### Claim 17 (depends on 13)

The system of claim 13, wherein the bot detection computer is further configured to:
track visitors accessing the client application using ‘A’ storage variable and IP address of the client application;
increment a ‘C’ storage variable on each HTTP request from the client application; and
determine a visitor as a bot when the ‘C’ storage variable is detected to be not incremented, wherein the ‘C’ storage variable is a HTTP storage variable used for identifying the number of pages accessed in a session.

### Claim 18 (depends on 13)

The system of claim 13, wherein the bot detection computer is further configured to:
analyze a ‘A’ storage variable and a ‘C’ storage variable across a plurality of HTTP requests; and
determine a spoofing of storage variables if the ‘C’ storage variables remains same for the plurality of HTTP requests.

### Claim 19 (depends on 13)

The system of claim 13, wherein the bot detection computer is configured to analyze the plurality of storage variables by determining a visitor as a distributed bot when a constant ‘A’ storage variable is received from multiple IP address, wherein the ‘A’ storage variable is a HTTP storage variable used for uniquely identifying a session.

### Claim 20 (depends on 13)

The system of claim 13, wherein the bot detection computer is configured to analyze the plurality of storage variables by determining a visitor as a bot when a single ‘A’ storage or IP address makes requests at a rate higher than a specified threshold.

### Claim 21 (depends on 13)

The system of claim 13, wherein the bot detection computer is configured to:
analyze time series anomalies between the plurality of HTTP requests; and
determine interarrival time between successive requests from a same IP address or ‘A’ has a standard deviation that is substantially zero.

### Claim 22 (depends on 13)

The system of claim 13, wherein the connector is configured to perform a preset action of blocking subsequent requests by analysis with the replica of bot signature database and blocking requests by using an asynchronous feed.

### Claim 23 (depends on 13)

The system of claim 13, wherein the connector is further configured to:
compare the HTTP request at the connector with the replica of bot signature database before initiating the API call;
provide the HTTP response to the client application immediately after analysis, thereby reducing a delay involved in providing the HTTP response; and
block the HTTP request when a bot is detected after comparison with the bot signature database.

### Claim 24 (depends on 13)

The system of claim 13, wherein the connector is further configured to:
provide the HTTP response to the client application immediately in response to the HTTP request;
analyze data received through the API calls at the bot detection computer to compute bot signatures;
provide the computed bot signatures asynchronously through a feed to the web server;
store the computed bot signatures in one of a Content Delivery Network (CDN), Web Application Firewall (WAF), and hardware appliance present at the web server; and
block consecutive HTTP request from a bot at one of a CDN, WAF, and hardware appliance using the computed bot signatures.