# US 8,751,633 B2 · Recording internet visitor threat information through an internet-based proxy service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,633 B2
- Document ID: US8751633B2
- Status: Granted
- Kind: B2
- Application number: 12/939,935
- Filed: 2010-11-04
- Published: 2012-05-10
- Granted: 2014-06-10
- Earliest claimed: 2010-11-04
- Assignees: Cloudflare, Inc.
- Applicants: Lee Hahn Holloway; Matthew Browning Prince; Ian Gerald Pye
- Inventors: Lee Hahn Holloway; Matthew Browning Prince; Ian Gerald Pye
- Web page: https://patentgrep.com/patent/US8751633B2

## CPC

- H04L 63/0281: {Proxies}
- G06F 15/16: Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs {(coordinating program control therefor G06F9/52; in regulating and control system G05B)}
- G06F 16/95: Retrieval from the web
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 40/14: Tree-structured documents (parsing G06F40/205; validation G06F40/226)
- G06F 40/143: Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
- G06Q 10/107: Computer-aided management of electronic mailing [e-mailing]
- G06Q 30/0241: Advertisements
- G06Q 30/0251: Targeted advertisements
- G06Q 30/0277: {Online advertisement}
- H04L 47/745: {Reaction in network}
- H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes
- H04L 61/4511: using domain name system [DNS]
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0254: {Stateful filtering}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/102: {Entity profiles}
- H04L 63/126: {the source of the received data}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54)
- H04L 67/561: Adding application-functional data or data for application control, e.g. adding metadata
- H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching
- H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06)
- H04L 61/59: using proxies for addressing
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

An Internet-based proxy service server accesses a set of visitor characteristics for multiple visitors to a set of one or more domains operated by a customer. The set of visitor characteristics are reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains. The service server causes the set of visitor characteristics to be displayed through a threat reporting interface that allows the customer to report visitors as posing an Internet security threat. The service server receives input from the customer through the threat reporting interface that at least one of the visitors poses an Internet security threat, and records that visitor as an Internet security threat in one or more threat databases that are used by the proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.

## Claims

### Claim 1

A method in an Internet-based proxy service server to record Internet visitor threat information, the method comprising:
accessing a set of one or more visitor characteristics for a plurality of visitors to a set of one or more domains owned or operated by a first customer, the set of visitor characteristics being reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains;
causing the set of visitor characteristics to be displayed through a threat reporting interface of the Internet-based proxy service server that allows the first customer to report visitors as posing an Internet security threat;
receiving input from the first customer through the threat reporting interface that at least one of the visitors poses an Internet security threat; and
recording the at least one of the visitors poses an Internet security threat in one or more threat databases that are used by the set of proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.

### Claim 2 (depends on 1)

The method of claim 1, wherein the set of visitor characteristics include one or more of: IP address, User-Agent, country of the visitor, number of previous visited, identification of pages visited, and information posted.

### Claim 3 (depends on 1)

The method of claim 1, wherein the at least one of the visitors that poses an Internet security threat is recorded on a local restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer.

### Claim 4 (depends on 1)

The method of claim 1, wherein recording the at least one of the visitors that poses an Internet security threat in one or more threat databases includes performing the following for each of the at least one visitors:
recording in an event log database a record for that visitor that includes an indication that the first customer has indicated that the visitor poses an Internet security threat, wherein the record also includes at least one other rating originating from a set of one or more second customers that each indicate whether that visitor poses an Internet security threat;
responsive to determining that there has been a sufficient number of ratings of the visitor from the customers, assigning that visitor a threat score based on each of the ratings of the visitor from each customer;
responsive to determining that the threat score is sufficient to record the visitor as a global Internet security threat, recording the visitor on a global restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a plurality of origin servers including a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer and a second set of one or more origin servers belonging to one or more domains owned or operated by the set of second customers.

### Claim 5 (depends on 4)

The method of claim 4, wherein each customer that has rated the visitor is associated with a customer reputation score that indicates a relative trustworthiness of that customer, and wherein determining that there has been a sufficient number of ratings of the visitor from the customers includes:
adding the customer reputation scores of those customers together; and
determining that the sum of those customer reputation scores is above a customer reputations threshold that indicates that there is a sufficient amount of data to make a global rating for the visitor.

### Claim 6 (depends on 5)

The method of claim 5, wherein each customer reputation score is based at least in part on whether the rating for the visitor aligns with other ratings from different customers.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
receiving input from the first customer through the threat reporting interface that indicates a type of Internet security threat that the at least one visitor poses.

### Claim 8

An Internet-based proxy service server, comprising:
a memory to store instructions;
a processor coupled with the memory to process the stored instructions to:
access a set of one or more visitor characteristics for a plurality of visitors to a set of one or more domains owned or operated by a first customer, the set of visitor characteristics being reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains;
cause the set of visitor characteristics to be displayed through a threat reporting interface of the Internet-based proxy service server that allows the first customer to report visitors as posing an Internet security threat;
receive input from the first customer through the threat reporting interface that at least one of the visitors poses an Internet security threat; and
record the at least one of the visitors poses an Internet security threat in one or more threat databases that are used by the set of proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.

### Claim 9 (depends on 8)

The Internet-based proxy service server of claim 8, wherein the set of visitor characteristics include one or more of: IP address, User-Agent, country of the visitor, number of previous visited, identification of pages visited, and information posted.

### Claim 10 (depends on 8)

The Internet-based proxy service server of claim 8, wherein the at least one of the visitors that poses an Internet security threat is recorded on a local restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer.

### Claim 11 (depends on 8)

The Internet-based proxy service server of claim 8, wherein recordation of the at least one of the visitors that poses an Internet security threat in one or more threat databases includes the processor to process the stored instructions to perform the following for each of the at least one visitors:
record in an event log database a record for that visitor that includes an indication that the first customer has indicated that the visitor poses an Internet security threat, wherein the record also includes at least one other rating originating from a set of one or more second customers that each indicate whether that visitor poses an Internet security threat;
responsive to a determination that there has been a sufficient number of ratings of the visitor from the customers, assign that visitor a threat score based on each of the ratings of the visitor from each customer;
responsive to a determination that the threat score is sufficient to record the visitor as a global Internet security threat, record the visitor on a global restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a plurality of origin servers including a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer and a second set of one or more origin servers belonging to one or more domains owned or operated by the set of second customers.

### Claim 12 (depends on 11)

The Internet-based proxy service server of claim 11, wherein each customer that has rated the visitor is associated with a customer reputation score that indicates a relative trustworthiness of that customer, and wherein the determination that there has been a sufficient number of ratings of the visitor from the customers includes the processor to process the stored instructions to:
add the customer reputation scores of those customers together; and
determine that the sum of those customer reputation scores is above a customer reputations threshold that indicates that there is a sufficient amount of data to make a global rating for the visitor.

### Claim 13 (depends on 12)

The Internet-based proxy service server of claim 12, wherein each customer reputation score is based at least in part on whether the rating for the visitor aligns with other ratings from different customers.

### Claim 14 (depends on 8)

The Internet-based proxy service server of claim 8, wherein the processor is further to process the stored instructions to:
receive input from the first customer through the threat reporting interface that indicates a type of Internet security threat that the at least one visitor poses.

### Claim 15

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of an Internet-based proxy service server, cause said processor to perform operations comprising:
accessing a set of one or more visitor characteristics for a plurality of visitors to a set of one or more domains owned or operated by a first customer, the set of visitor characteristics being reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains;
causing the set of visitor characteristics to be displayed through a threat reporting interface of the Internet-based proxy service server that allows the first customer to report visitors as posing an Internet security threat;
receiving input from the first customer through the threat reporting interface that at least one of the visitors poses an Internet security threat; and
recording the at least one of the visitors poses an Internet security threat in one or more threat databases that are used by the set of proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.

### Claim 16 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the set of visitor characteristics include one or more of: IP address, User-Agent, country of the visitor, number of previous visited, identification of pages visited, and information posted.

### Claim 17 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the at least one of the visitors that poses an Internet security threat is recorded on a local restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer.

### Claim 18 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein recording the at least one of the visitors that poses an Internet security threat in one or more threat databases includes performing the following for each of the at least one visitors:
recording in an event log database a record for that visitor that includes an indication that the first customer has indicated that the visitor poses an Internet security threat, wherein the record also includes at least one other rating originating from a set of one or more second customers that each indicate whether that visitor poses an Internet security threat;
responsive to determining that there has been a sufficient number of ratings of the visitor from the customers, assigning that visitor a threat score based on each of the ratings of the visitor from each customer;
responsive to determining that the threat score is sufficient to record the visitor as a global Internet security threat, recording the visitor on a global restricted IP address list in the one or more threat databases that identifies IP addresses that are not allowed access to content hosted by a plurality of origin servers including a first set of one or more origin servers belonging to the set of domains owned or operated by the first customer and a second set of one or more origin servers belonging to one or more domains owned or operated by the set of second customers.

### Claim 19 (depends on 18)

The non-transitory machine-readable storage medium of claim 18, wherein each customer that has rated the visitor is associated with a customer reputation score that indicates a relative trustworthiness of that customer, and wherein determining that there has been a sufficient number of ratings of the visitor from the customers includes:
adding the customer reputation scores of those customers together; and
determining that the sum of those customer reputation scores is above a customer reputations threshold that indicates that there is a sufficient amount of data to make a global rating for the visitor.

### Claim 20 (depends on 19)

The non-transitory machine-readable storage medium of claim 19, wherein each customer reputation score is based at least in part on whether the rating for the visitor aligns with other ratings from different customers.

### Claim 21 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, further comprising:
receiving input from the first customer through the threat reporting interface that indicates a type of Internet security threat that the at least one visitor poses.