US 2026/0230481 A1Published application

Automated bot and weaponization activity detection and mitigation

AssigneeIntuit Inc.

InventorsAbhishek TATTI, Luiza NACSHON, Claire DE SAINT PHALLE, Marshall J. VANDERHOOF, Jason Dee Troy MARLEY, Scott Cruickshanks KENNEDY

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

At least one processor may receive network traffic data and group at least a portion of the network traffic data into at least one session according to time correlation of activity by a network entity. The at least one processor may extract a plurality of features indicative of malicious network activity from the at least one session and/or determine at least one entropy feature of the at least one session. The at least one processor may classify the plurality of features and/or the at least one entropy feature with a clustering machine learning (ML) model. In response to the classifying indicating that the at least one session included malicious activity and/or activity corresponding to at least one of a plurality of bot classifications, the at least one processor may block at least a portion of ongoing network traffic from the network entity from reaching at least one destination.

Claims20

Dependent claims

A method comprising:

receiving, by at least one processor, network traffic data;
grouping, by the at least one processor, at least a portion of the network traffic data into at least one session according to time correlation of activity by a network entity;
extracting, by the at least one processor, a plurality of features indicative of malicious network activity from the at least one session;
determining, by the at least one processor, at least one entropy feature of the at least one session;
classifying, by the at least one processor, the plurality of features with a first clustering machine learning (ML) model including a plurality of predefined clusters each respectively indicating a respective one of a plurality of bot classifications, the classifying indicating that the at least one session included activity corresponding to at least one of the plurality of bot classifications;
classifying, by the at least one processor, the plurality of features and the at least one entropy feature with a second clustering ML model, the classifying indicating that the at least one session included malicious activity;
and
in response to at least one of the classifying with the first clustering ML model and the classifying with the second clustering ML model, blocking, by the at least one processor, at least a portion of ongoing network traffic from the network entity from reaching at least one destination.

5 more elements

A method comprising:

receiving, by at least one processor, network traffic data;
grouping, by the at least one processor, at least a portion of the network traffic data into at least one session according to time correlation of activity by a network entity;
extracting, by the at least one processor, a plurality of features indicative of malicious network activity from the at least one session;
classifying, by the at least one processor, the plurality of features with a clustering machine learning (ML) model including a plurality of predefined clusters each respectively indicating a respective one of a plurality of bot classifications, the classifying indicating that the at least one session included activity corresponding to at least one of the plurality of bot classifications;
and
in response to the classifying, blocking, by the at least one processor, at least a portion of ongoing network traffic from the network entity from reaching at least one destination.

3 more elements

A method comprising:

receiving, by at least one processor, network traffic data;
grouping, by the at least one processor, at least a portion of the network traffic data into at least one session according to time correlation of activity by a network entity;
extracting, by the at least one processor, a plurality of features indicative of malicious network activity from the at least one session;
determining, by the at least one processor, at least one entropy feature of the at least one session;
classifying, by the at least one processor, the plurality of features and the at least one entropy feature with a clustering machine learning (ML) model, the classifying indicating that the at least one session included malicious activity;
and
in response to the classifying, blocking, by the at least one processor, at least a portion of ongoing network traffic from the network entity from reaching at least one destination.

4 more elements

Dependencies are inferred from the claim text.