Techniques for efficient network security for a web server using anomaly detection

A system comprising:

• a processor;
• and
• a non-transitory computer-readable medium comprising instructions that are executable by the processor to cause the processor to perform operations comprising:
• accessing transaction data describing network traffic associated with a web server during an interval;
• determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data;
• applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions;
• detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity;
• and
• remediating the anomaly in the network traffic associated with the web server.

A non-transitory computer-readable storage medium having program code that is executable by a processor device to cause the processing device to perform operations comprising:

• accessing transaction data describing network traffic associated with a web server during an interval;
• determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data;
• applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions;
• detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity;
• and
• implementing an access control between the online entity and the web server responsive to detecting the anomaly.