# US 2019/0173900 A1 · Analyzing client application behavior to detect anomalies and prevent access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173900 A1 - Document ID: US20190173900A1 - Status: Published application - Kind: A1 - Application number: 16/241,984 - Filed: 2019-01-07 - Published: 2019-06-06 - Earliest claimed: 2014-09-15 - Assignees: Perimeterx, Inc. - Applicants: PerimeterX, Inc. - Inventors: Ido Safruti; Omri Iluz - Web page: https://patentgrep.com/patent/US20190173900A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A client device accesses content and performs actions at a remote application server via a user-agent application. The application server directs the user-agent application to a security verification system to retrieve and perform security tests. The security verification system receives information from the user-agent application describing characteristics of the user-agent application, and the security verification system selects a set of security tests to be performed by a security module executing in the user-agent application to verify that the user-agent application is accessing the application server consistent with the described user-agent application. The security verification system compares a set of test results with other user-agent applications and provides a token to the user-agent application to access the application server. The security module may also monitor and actions on the user-agent application to permit the security verification system to revise or revoke the token. ## Claims ### Claim 1 A method comprising: receiving, at a security verification system from a client device executing an application accessing a service from an application server, a set of test results reflecting the execution of a set of security tests by the application of the client device, the set of security tests associated with one or more characteristics of the application of the client device; comparing the set of test results to a set of expected test results associated with the one or more characteristics of the application to determine a security score based on differences between the set of test results and the set of expected test results; generating, by the security verification system, a security token for the application comprising the security score; and sending, by the security verification system, the security token to the client device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, at the security verification system from the client device, a request to verify security of the client device specifying characteristics of the application executing on the client device; identifying, at the security verification system, the set of security tests based on the one or more characteristics of the application; and sending, by the security verification system to the client device, the set of security tests for execution by the application on the client device. ### Claim 3 (depends on 2) The method of claim 2, wherein the one or more characteristics of the application comprise a type of the application and a version of the application and wherein identifying the set of security tests based on the one or more characteristics of the application comprises identifying the set of security tests from a plurality of sets of security tests, each associated with different combinations of applications and versions. ### Claim 4 (depends on 2) The method of claim 2, wherein sending the set of security tests comprises sending executable code which, when executed by the application, performs the set of security tests. ### Claim 5 (depends on 4) The method of claim 4, wherein the application is a web browser and the executable code is a script for execution by the web browser. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of security tests executed by the application of the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application. ### Claim 7 (depends on 1) The method of claim 1, further comprising: responsive to the security score being below a threshold: providing an additional set of security tests to the client device for execution by the application; and receiving, from the client device, an additional set of test results reflecting the execution of the additional set of security tests; and wherein generating the security token is further based on the additional set of test results. ### Claim 8 (depends on 1) The method of claim 1, wherein the security token for the application further comprises an identification of the set of security tests and the comparison of the set of test results to the set of expected test results. ### Claim 9 (depends on 1) The method of claim 1, wherein comparing the set of test results to a set of expected test results to determine a security score comprises determining, at the security verification system, the security score based on the comparison of the test results to one or more expected client characteristics, an expected profile of application content when accessed, and expected user activity. ### Claim 10 (depends on 1) The method of claim 1, wherein the tests are executed by a security module of the application, and wherein the method further comprises: receiving, responsive sending the security token to the client device, an application action identified by the security module; updating, at the security verification system, the security token based on the application action; and providing, by the security verification system, the updated security token to the application. ### Claim at position 11 11-29. (canceled) ### Claim 30 A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform steps comprising: receiving, at a security verification system from a client device executing an application accessing a service from an application server, a set of test results reflecting the execution of a set of security tests by the application of the client device, the set of security tests associated with one or more characteristics of the application of the client device; comparing the set of test results to a set of expected test results associated with the one or more characteristics of the application to determine a security score based on differences between the set of test results and the set of expected test results; generating, by the security verification system, a security token for the application comprising the security score; and sending, by the security verification system, the security token to the client device. ### Claim 31 (depends on 30) The non-transitory computer-readable storage medium of claim 30 further comprising instructions that cause the processor to perform the steps of: receiving, at the security verification system from the client device, a request to verify security of the client device specifying characteristics of the application executing on the client device; identifying, at the security verification system, the set of security tests based on the one or more characteristics of the application; and sending, by the security verification system to the client device, the set of security tests for execution by the application on the client device. ### Claim 32 (depends on 31) The non-transitory computer-readable storage medium of claim 31, wherein the one or more characteristics of the application comprise a type of the application and a version of the application and wherein identifying the set of security tests based on the one or more characteristics of the application comprises identifying the set of security tests from a plurality of sets of security tests, each associated with different combinations of applications and versions. ### Claim 33 (depends on 31) The non-transitory computer-readable storage medium of claim 31, wherein sending the set of security tests comprises sending executable code which, when executed by the application, performs the set of security tests. ### Claim 34 (depends on 33) The non-transitory computer-readable storage medium of claim 33, wherein the application is a web browser and the executable code is a script for execution by the web browser. ### Claim 35 (depends on 30) The non-transitory computer-readable storage medium of claim 30, wherein the set of security tests executed by the application of the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application. ### Claim 36 (depends on 30) The non-transitory computer-readable storage medium of claim 30, further comprising instructions that cause the processor to perform the steps of: responsive to the security score being below a threshold: providing an additional set of security tests to the client device for execution by the application; and receiving, from the client device, an additional set of test results reflecting the execution of the additional set of security tests; and wherein generating the security token is further based on the additional set of test results. ### Claim 37 (depends on 30) The non-transitory computer-readable storage medium of claim 30, wherein the security token for the application further comprises an identification of the set of security tests and the comparison of the set of test results to the set of expected test results. ### Claim 38 (depends on 30) The non-transitory computer-readable storage medium of claim 30, wherein comparing the set of test results to a set of expected test results to determine a security score comprises determining, at the security verification system, the security score based on the comparison of the test results to one or more expected client characteristics, an expected profile of application content when accessed, and expected user activity. ### Claim 39 (depends on 30) The non-transitory computer-readable storage medium of claim 30, wherein the tests are executed by a security module of the application, and wherein the non-transitory computer-readable storage medium further comprises instructions that cause the processor to perform the steps of: receiving, responsive sending the security token to the client device, an application action identified by the security module; updating, at the security verification system, the security token based on the application action; and providing, by the security verification system, the updated security token to the application.