Content delivery network (CDN) bot detection using primitive and compound feature sets

Apparatus, comprising:

• a processor;
• computer memory holding computer program instructions configured to:
• receive a request from a client;
• compare primitive or compound feature set data derived from the request against a database, the database comprising a set of data structures, wherein a given data structure in the database associates a feature value with its relative percentage occurrence across a set of transaction data collected from prior transactions involving a set of clients other than the client;
• based on the comparison, characterizing the client as a bot when the primitive or compound feature set derived from the request is not found in the database, or when the primitive or compound feature derived from the request is found in the database but a frequency of occurrence associated with additional transactions associated with the client is inconsistent with the relative percentages set forth in the database;
• and
• upon a determination that the client is a bot, take a mitigation action with respect to the request.

An article, comprising program media holding machine-readable code executable by one or more processors, the machine-readable code comprising code configured to:

• as clients interact with the edge servers, collect transaction data;
• mine the transaction data against a set of primitive or compound features sets to generate a database, wherein a compound feature set is a concatenation of two or more primitive feature sets, wherein the database comprises a set of data structures, wherein a given data structure in the database associates a feature value with its relative percentage occurrence across the collected transaction data;
• provide the database to a machine running a server process;
• and
• upon receipt of a new transaction request at the server process and from a client, compare primitive or compound feature set data derived from the new transaction request against the database;
• and
• based on the comparison, characterize the client associated with the new transaction request as a bot when the primitive or compound feature set derived from the new transaction request is not found in the database, or when the primitive or compound feature derived from the new transaction request is found in the database but a frequency of occurrence associated with additional transactions associated with the client is inconsistent with the relative percentages set forth in the database.