Methods, systems and computer program products for monitoring user behavior for a server application

A method for detecting abnormal activity of a server application user, the method comprising:

• (a) measuring a predetermined activity of a server application user over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of the server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises a server application request, and
• wherein the server application request is a hypertext transfer protocol (HTTP) request.

A method for detecting abnormal activity of a server application user, the method comprising:

• (a) measuring a predetermined activity of a server application user over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of the server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises failed web page requests.

A system for detecting abnormal activity of a server application user, the system comprising:

• (a) a network interface for receiving communication data of a predetermined activity of a server application user over a first and second predetermined time, respectively;
• and
• (b) a detector operable to generate a first and second measurement of the predetermined activity for the first and second predetermined times, respectively, and operable to determine whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises web page requests.

A system for detecting abnormal activity of a server application user, the system comprising:

• (a) a network interface for receiving communication data of a predetermined activity of a server application user over a first and second predetermined time, respectively;
• and
• (b) a detector operable to generate a first and second measurement of the predetermined activity for the first and second predetermined times, respectively, and operable to determine whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises a server application request, and
• wherein the server application request is a hypertext transfer protocol (HTTP) request.

A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

• (a) measuring a predetermined activity of a server application user over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of the server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises web page requests.

A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

• (a) measuring a predetermined activity of a server application user over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of the server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the server application user,
• wherein the predetermined activity comprises a server application request, and
• wherein the server application request is a hypertext transfer protocol (HTTP) request.

A method for detecting abnormal activity of a server application user, the method comprising:

• (a) measuring a predetermined activity of a plurality of server application users over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of a first server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the first server application user,
• wherein the predetermined activity comprises web page requests.

A system for detecting abnormal activity of a server application user, the system comprising:

• (a) a network interface for receiving communication data of a predetermined activity of a first server application user and a selected plurality of server application users over a first and second predetermined time, respectively;
• and
• (b) a detector operable to generate a first and second measurement of the predetermined activity for the first and second predetermined times, respectively, and operable to determine whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the first server application user,
• wherein the predetermined activity comprises web page requests.

A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

• (a) measuring a predetermined activity of a plurality of server application users over a first predetermined time for generating a first measurement;
• (b) measuring the predetermined activity of a first server application user over a second predetermined time for generating a second measurement;
• and
• (c) determining whether the first and second measurements deviate a predetermined amount to detect abnormal activity for the first server application user
• wherein the predetermined activity comprises web page requests.