# US 12,192,222 B2 · Techniques for efficient network security for a web server using anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,222 B2 - Document ID: US12192222B2 - Status: Granted - Kind: B2 - Application number: 18/301,862 - Filed: 2023-04-17 - Published: 2023-08-10 - Granted: 2025-01-07 - Earliest claimed: 2020-08-07 - Assignees: Kount Inc. - Applicants: Kount Inc. - Inventors: Joshua Michael Johnston; Matthew Lewis Jones; Nathan Daniel Monnig; Divyanshu Rohit Murli - Web page: https://patentgrep.com/patent/US12192222B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 41/142: using statistical or mathematical methods - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method described herein involves various operations directed toward network security. The operations include accessing transaction data describing network traffic associated with a web server during an interval. Based on a count of new transactions involving an online entity during the interval according to the transaction data, a short-term trend is determined for the online entity. The operations further include applying exponential smoothing to a history of transactions of the online entity to compute a long-term trend for the online entity. Based on a comparison between the short-term trend and the long-term trend for the online entity, an anomaly is detected with respect to the online entity in the network traffic associated with the web server. Responsive to detecting the anomaly, an access control is implemented between the online entity and the web server. ## Claims ### Claim 1 A method comprising: accessing transaction data describing network traffic associated with a web server during an interval; determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data; applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions; detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity; and implementing an access control between the online entity and the web server responsive to detecting the anomaly. ### Claim 2 (depends on 1) The method of claim 1, wherein the exponentially smoothed average of the count of transactions comprises: a long-term moving average of the count of transactions involving the online entity computed using a long-term exponential time window; and wherein the exponentially smoothed standard deviation of the count of transactions comprises: a long-term moving standard deviation of the count of transactions involving the online entity computed using the long-term exponential time window. ### Claim 3 (depends on 2) The method of claim 2, wherein determining the short-term trend for the online entity comprises computing a short-term moving average for the count of transactions involving the online entity using a short-term exponential time window. ### Claim 4 (depends on 3) The method of claim 3, wherein: the short-term exponential time window is determined by a short-term smoothing factor for weighting transactions occurring prior to the interval; the long-term exponential time window is determined by a long-term smoothing factor for weighting transactions prior to the interval; and the long-term smoothing factor differs from the short-term smoothing factor. ### Claim 5 (depends on 3) The method of claim 3, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity comprises computing a difference between the short-term moving average and the long-term moving average. ### Claim 6 (depends on 5) The method of claim 5, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity further comprises: computing a score for the online entity based on dividing by long-term moving standard deviation the difference between the short-term moving average and the long-term moving average; and comparing the score for the online entity to a threshold. ### Claim 7 (depends on 2) The method of claim 2, wherein determining the short-term trend for the online entity comprises assigning to the short-term trend a value equal to the count of new transactions involving the online entity in the transaction data. ### Claim 8 (depends on 7) The method of claim 7, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity comprises: computing a difference between the short-term moving average and the long-term moving average; computing a score for the online entity based on dividing by long-term moving standard deviation the difference between the short-term moving average and the long-term moving average; and comparing the score for the online entity to a threshold. ### Claim 9 A system comprising: a processor; and a non-transitory computer-readable medium comprising instructions that are executable by the processor to cause the processor to perform operations comprising: accessing transaction data describing network traffic associated with a web server during an interval; determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data; applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions; detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity; and remediating the anomaly in the network traffic associated with the web server. ### Claim 10 (depends on 9) The system of claim 9, wherein the exponentially smoothed average of the count of transactions comprises: a long-term moving average of the count of transactions involving the online entity computed using a long-term exponential time window; and wherein the exponentially smoothed standard deviation of the count of transactions comprises: a long-term moving standard deviation of the count of transactions involving the online entity computed using the long-term exponential time window. ### Claim 11 (depends on 10) The system of claim 10, wherein determining the short-term trend for the online entity comprises computing a short-term moving average for the count of transactions involving the online entity using a short-term exponential time window. ### Claim 12 (depends on 11) The system of claim 11, wherein: the short-term exponential time window is determined by a short-term smoothing factor for weighting transactions occurring prior to the interval; the long-term exponential time window is determined by a long-term smoothing factor for weighting transactions prior to the interval; and the long-term smoothing factor differs from the short-term smoothing factor. ### Claim 13 (depends on 11) The system of claim 11, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity comprises computing a difference between the short-term moving average and the long-term moving average. ### Claim 14 (depends on 13) The system of claim 13, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity further comprises: computing a score for the online entity based on dividing by long-term moving standard deviation the difference between the short-term moving average and the long-term moving average; and comparing the score for the online entity to a threshold. ### Claim 15 A non-transitory computer-readable storage medium having program code that is executable by a processor device to cause the processing device to perform operations comprising: accessing transaction data describing network traffic associated with a web server during an interval; determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data; applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions; detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity; and implementing an access control between the online entity and the web server responsive to detecting the anomaly. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity comprises: computing a score for the online entity based on the comparison between the short-term trend and the long-term trend; and comparing the score for the online entity to a threshold. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein: applying exponential smoothing to the history of transactions of the online entity to compute the long-term trend for the online entity comprises computing a long-term moving average of the count of transactions involving the online entity using a long-term exponential time window; and determining the short-term trend for the online entity comprises computing a short-term moving average for the count of transactions involving the online entity using a short-term exponential time window. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein: the short-term exponential time window is determined by a short-term smoothing factor for weighting transactions occurring prior to the interval; the long-term exponential time window is determined by a long-term smoothing factor for weighting transactions prior to the interval; and the long-term smoothing factor differs from the short-term smoothing factor. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein determining the short-term trend for the online entity comprises assigning to the short-term trend a value equal to the count of new transactions involving the online entity in the transaction data. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein detecting that the anomaly exists with respect to the online entity in the network traffic based on the comparison between the short-term trend and the long-term trend for the online entity comprises: computing a difference between the short-term moving average and the long-term moving average; computing a score for the online entity based on dividing by long-term moving standard deviation the difference between the short-term moving average and the long-term moving average; and comparing the score for the online entity to a threshold.