Provisional Bot Activity Recognition
AssigneeCisco Technology, Inc.
InventorsTirumaleswar Reddy, Prashanth Patil, Daniel Wing
Life of this patent
Estimating the term…
Abstract
In one implementation, a network device is configured to monitor communications associated with an endpoint and identify domain name service messages in the communications. Subsequently, the network device receives a hypertext transfer protocol (HTTP) request and determines whether a destination internet protocol (IP) address of the HTTP request is present in or absent from the domain name service messages. When the IP address is absent from the domain name service messages, the HTTP request is modified to trigger increased security.
Claims22
A method comprising:
- monitoring communications associated with an endpoint;
- identifying domain name service messages in the communications;
- receiving a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address;
- determining whether the IP address is present in or absent from the domain name service messages;
- and
- inserting an inline header in the HTTP request in response to the IP address being absent from the domain name service messages
- wherein the inline header is outside of the control portion of the HTTP request modifiable by a network address translation device.
(canceled)
An apparatus comprising:
- a communication interface configured to receive, from an endpoint, a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address;
- and
- a controller configured to determine whether the IP address is present in or absent from a table of domain name service messages associated with the endpoint and insert an inline header in the HTTP request, wherein the inline header includes data indicative of a high security level in response to the IP address being absent from the domain name service messages and the inline header includes data indicative of a low security level in response to the IP address being included in the domain name service messages.
(canceled)
A non-transitory computer readable medium including instructions that when executed on a computer are operable to:
- monitor domain name messages sent from an endpoint;
- store addresses from the domain name messages in a table;
- receive a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address;
- determine whether the IP address is present in or absent from the addresses in the table;
- insert metadata in the HTTP request in response to the IP address being absent from the table;
- and
- forward the HTTP request to a security server according to the metadata in the HTTP request, wherein the security server examines the HTTP request based on the metadata inserted in the HTTP request.
Dependencies are inferred from the claim text.