Fast device classification
AssigneeSpidercrunch Limited
InventorsDouglas de Jager, Simon Overell
Life of this patent
Estimating the term…
Abstract
In a system in which one or more client devices 10 access web servers 20 over a network 40, a classification server 30 is provided to assist in identifying the nature of the agent controlling the client devices 10. In particular, the classification server 30 monitors events that occur as a client device 10 accesses content on a web server 20, and uses a record of these events to classify the client device 10. This classification occurs when a classification time, generated in dependence on the events that have already taken place, is reached. The classification time represents the earliest time at which a classification can be made with a predetermined level of confidence.
Claims12
A computer-implemented method for classifying an agent controlling a client device requesting content from a server, comprising:
- generating a probability look-up table, comprising a plurality of abnormal probability values, each abnormal probability value corresponding to a sequence of events at a corresponding time;
- receiving, from a server, a first event identifying a first request for content made by a client device to the server;
- storing the received first event in an evidence vector, together with the time the first request was made;
- receiving, from the server, a second event identifying a second request for content made by the client device to the server;
- storing the received second event in the evidence vector, together with the time the second request was made;
- processing the evidence vector to derive a sequence of events;
- selecting, from the probability look-up table, a list of abnormal probability values, each abnormal probability value corresponding to the sequence of events;
- finding an abnormal probability value from the selected list that has a lowest corresponding time among every abnormal probability value in the list that are greater than a predetermined level of confidence;
- setting a classification time to a time corresponding to the found abnormal probability value, the classification time representing a time at which a probability that an agent controlling the client device is illegitimate exceeds a predetermined threshold;
- and
- classifying the agent controlling the client device requesting content from the server as illegitimate, when the time period represented by the difference between the classification time and the time of the first request has elapsed.
The method of 1, further comprising:
- carrying out ancillary analysis on a behavioral event associate with at least one of the events that has occurred;
- and
- storing results of the ancillary analysis in the evidence vector.
An apparatus for classifying a client device requesting content from a server, the apparatus comprising:
- a classification server computer;
- and
- a data storage device operably connected to the classification server computer, the data storage device storing instructions configured to direct the classification server computer to:
- generate a probability look-up table, comprising a plurality of abnormal probability values, each abnormal probability value corresponding to a sequence of events at a corresponding time;
- receive, from a server, a first event identifying a first request for content made by a client device to the server;
- store the received first event in an evidence vector, together with the time the first request was made;
- receive, from the server, a second event identifying a second request for content made by the client device to the server;
- store the received second event in the evidence vector, together with the time the second request was made;
- process the evidence vector to derive a sequence of events;
- select, from the probability look-up table, a list of abnormal probability values, each abnormal probability value corresponding to the sequence of events;
- find an abnormal probability value from the selected list that has a lowest corresponding time among every abnormal probability value in the list that are greater than a predetermined level of confidence;
- set a classification time to a time corresponding to the found abnormal probability value, the classification time representing a time at which a probability that an agent controlling the client device is illegitimate exceeds a predetermined threshold;
- and
- classify an agent controlling the client device requesting content from the server as illegitimate, when the time period represented by the difference between the classification time and the time of the first request has elapsed.
Dependencies are inferred from the claim text.