Akamai Technologies, Inc.

David Senecal

Prajakta Bhurke

Tu Vuong

Ory Segal

Elad Shuster

Andrew Kahn

Duc Nguyen

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as 'TLS fingerprinting.' Preferably, TLS fingerprinting herein comprises combining different parameters from the initial “Hello” packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the “TLS signature”) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Bot detection in an edge network using transport layer security (TLS) fingerprint

A server interacts with a bot detection service to provide bot detection as a requesting client interacts with the server. In an asynchronous mode, the server injects into a page a data collection script configured to record interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data to the server. After the client receives the page, the sensor data is collected and forwarded to the server through a series of posts. The server forwards the posts to the detection service. During this data collection, the server also may receive a request from the client for a protected endpoint. When this occurs, and in a synchronous mode, the server issues a query to the detection service to obtain a threat score based in part on the collected sensor data that has been received and forwarded by the server. Based on the threat score returned, the server then determines whether the request for the endpoint should be forwarded onward for handling.

Low touch integration of a bot detection service in association with a content delivery network

Content delivery network (CDN)-based bot detection service with stop and reset protocols

Content delivery network (CDN) edge server-based bot detection with session cookie support handling

A method of bot detection in a computer network leverages a machine learning system. The machine learning system receives a fingerprint derived at a server, the server having extracted a set of transport layer security parameters received from a client and processed the set parameters into the fingerprint. Based at least in part on the fingerprint, the learning system determines whether the client is likely to be a bot as opposed to a human user. The system generates and returns to the server as score having a first value when the fingerprint is determined to be associated with a good client, and having a second value when the fingerprint is determined to be associated with a bot. Based on the score received from the machine learning system, the server takes a configured action with respect to the client.

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as 'TLS fingerprinting.' Preferably, TLS fingerprinting herein comprises combining different parameters from the initial 'Hello' packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the &#x201c;TLS signature&#x201d;) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Growing community of inventors

Santa Clara, CA, United States of America

David Senecal