# US 12,120,133 B1 · Request header anomaly detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,120,133 B1
- Document ID: US12120133B1
- Status: Granted
- Kind: B1
- Application number: 16/894,496
- Filed: 2020-06-05
- Granted: 2024-10-15
- Earliest claimed: 2016-11-07
- Assignees: United Services Automobile Association (USAA)
- Applicants: United Services Automobile Association (Usaa)
- Inventors: Duane E. Weldon
- Web page: https://patentgrep.com/patent/US12120133B1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 63/101: {Access control lists [ACL]}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and a method are disclosed for detecting an unacceptable HTTP requests by scanning the headers of the HTTP requests.

## Claims

### Claim 1

A method for detecting suspicious clients seeking access to a website comprising:
providing a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;
receiving at the web server a plurality of incoming HTTP request headers from a browser of a client, the plurality of incoming HTTP request headers are in an order of appearance from top to bottom and include a USER_AGENT header and an ACCEPT_LANGUAGE header, the USER_AGENT header identifies the client browser type and the ACCEPT_LANGUAGE header identifies a q value, wherein the q value is unique to a browser type;
comparing the browser type identified in the USER_AGENT header received from the browser of the client with the browser type associated with the q value identified in the ACCEPT LANGUAGE header received from the browser of the client; and
denying, based on the comparison, the client access to the website.

### Claim 2 (depends on 1)

The method of claim 1 wherein the plurality of HTTP request headers include ACCEPT, ACCEPT_ENCODING, CONNECTION, HOST, REFERER, UPGRADE_INSECURE_REQUESTS, and USER_AGENT.

### Claim 3 (depends on 2)

The method of claim 2 wherein there are a plurality of browser type including Internet Explorer, FIREFOX, OPERA, CHROME, MOZILLA, NETSCAPE, and SAFARI.

### Claim 4 (depends on 3)

The method of claim 3 further comprising the step of providing an example of a correct set of HTTP request headers for the browser type identified in the USER_AGENT header including a correct order of appearance of the correct set of HTTP request headers.

### Claim 5 (depends on 4)

The method of claim 4 further comprising the step of comparing the order of appearance of the incoming HTTP request headers of the client browser with the correct order of appearance and if in a different order of appearance an anomaly is detected.

### Claim 6

A system for detecting suspicious clients seeking access to a website comprising:
providing a server for receiving communications from a user over an electronic network, the server having a processor and a memory storing software instructions when executed by the processor performs the following steps:
providing a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;
receiving at the web server a plurality of incoming HTTP request headers from a browser of a client, the plurality of incoming HTTP request headers are in an order of appearance from top to bottom and include a USER_AGENT header and an ACCEPT_LANGUAGE header, the USER_AGENT header identifies the client browser type and the ACCEPT_LANGUAGE header identifies a q value, wherein the q value is unique to a browser type;
comparing the browser type identified in the USER_AGENT header received from the browser of the client with the browser type associated with the q value identified in the ACCEPT LANGUAGE header received from the browser of the client; and
denying, based on the comparison, the client access to the website.

### Claim 7 (depends on 6)

The system of claim 6 wherein the plurality of HTTP request headers include ACCEPT, ACCEPT_ENCODING, CONNECTION, HOST, REFERER, UPGRADE_INSECURE_REQUESTS, and USER_AGENT.

### Claim 8 (depends on 6)

The system of claim 6 wherein there are a plurality of browser type including Internet Explorer, FIREFOX, OPERA, CHROME, MOZILLA, NETSCAPE, SAFARI, and others.

### Claim 9 (depends on 6)

The system of claim 6 further comprising the step of providing an example of a correct set of HTTP request headers for the browser type identified in the USER_AGENT header including a correct order of appearance of the correct set of HTTP request headers.

### Claim 10 (depends on 9)

The system of claim 9 further comprising the step of comparing the order of appearance of the incoming HTTP request headers of the client browser with the correct order of appearance and if in a different order of appearance an anomaly is detected.

### Claim 11

A non-transitory machine-readable set of instructions stored on a medium for detecting suspicious clients seeking access to a website when executed by a processor perform the steps comprising:
receiving at the website communications from a user over an electronic network;
providing a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;
receiving at the web server a plurality of incoming HTTP request headers from a browser of a client, the plurality of incoming HTTP request headers are in an order of appearance from top to bottom and include a USER_AGENT header and an ACCEPT_LANGUAGE header, the USER_AGENT header identifies the client browser type and the ACCEPT_LANGUAGE header identifies a q value, wherein the q value is unique to a browser type;
comparing the browser type identified in the USER_AGENT header received from the browser of the client with the browser type associated with the q value identified in the ACCEPT LANGUAGE header received from the browser of the client; and
denying, based on the comparison, the client access to the website.

### Claim 12 (depends on 11)

The medium of claim 11 wherein the plurality of HTTP request headers include ACCEPT, ACCEPT_ENCODING, CONNECTION, HOST, REFERER, UPGRADE_INSECURE_REQUESTS, and USER_AGENT.

### Claim 13 (depends on 11)

The medium of claim 11 wherein there are a plurality of browser type including Internet Explorer, FIREFOX, OPERA, CHROME, MOZILLA, NETSCAPE, SAFARI, and others.

### Claim 14 (depends on 11)

The medium of claim 11 further comprising the step of providing an example of a correct set of HTTP request headers for the browser type identified in the USER_AGENT header including a correct order of appearance of the correct set of HTTP request headers.

### Claim 15 (depends on 14)

The medium of claim 14 further comprising the step of comparing the order of appearance of the incoming HTTP request headers of the client browser with the correct order of appearance and if in a different order of appearance an anomaly is detected.