Periodicity detection

A system constructed and arranged to identify suspect access to a web server in a computing environment, the system comprising a testing server including a controller, the controller including memory and controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to:

• receive a stream of clicks from a client machine, each click of the stream i) being assigned a timestamp upon receipt by the testing server and ii) indicating a request from a web client on the client machine to the web server;
• generate a list of multiple candidate periods at which to test the stream of clicks for temporal periodicity;
• for each of the list of multiple candidate periods:
• i) set a duration of a sampling window to an interval that includes an integer multiple of the respective candidate period;
• and
• ii) test whether the stream of clicks is temporally periodic at the respective candidate period based on locations of clicks within the sampling window;
• and
• send, in response to the testing indicating that the stream of clicks is periodic at one or more of the multiple candidate periods, an alert to a security entity to indicate that suspect activity has been identified,
• wherein the system further comprises a splitter located on the same local network as the web server, the spotter being configured to provide duplicates of each of the clicks of the stream to both i) the web server and ii) the testing server.

A computer program product comprising a non-transitory, computer-readable storage medium which stores executable code, which when executed by a testing server, causes the testing server to perform a method of identifying suspect access to a web server in a computing environment, the method comprising:

• receiving, by a testing server, a stream of clicks from a client machine, each click of the stream i) being assigned a timestamp upon receipt by the testing server and ii) indicating a request from a web client on the client machine to the web server;
• generating, by the testing server, a list of multiple candidate periods at which to test the stream of clicks for temporal periodicity;
• for each of the list of multiple candidate periods:
• i) setting, by the testing server, a duration of a sampling window to an interval that includes an integer multiple of the respective candidate period;
• and
• ii) testing, by the testing server, whether the stream of clicks is temporally periodic at the respective candidate period based on locations of clicks within the sampling window;
• and
• sending, by the testing server in response to the testing indicating that the stream of clicks is periodic at one or more of the multiple candidate periods, an alert to a security entity to indicate that suspect activity has been identified,
• wherein receiving the stream of clicks includes obtaining the stream of clicks from a splitter located on a same local network as the web server, the splitter providing duplicates of each of the clicks of the stream to both i) the web server and ii) the testing server.