Akamai Technologies, Inc.

Duc Nguyen

Ory Segal

David Senecal

Elad Shuster

Andrew Kahn

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as 'TLS fingerprinting.' Preferably, TLS fingerprinting herein comprises combining different parameters from the initial “Hello” packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the “TLS signature”) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Bot detection in an edge network using transport layer security (TLS) fingerprint

A method of bot detection in a computer network leverages a machine learning system. The machine learning system receives a fingerprint derived at a server, the server having extracted a set of transport layer security parameters received from a client and processed the set parameters into the fingerprint. Based at least in part on the fingerprint, the learning system determines whether the client is likely to be a bot as opposed to a human user. The system generates and returns to the server as score having a first value when the fingerprint is determined to be associated with a good client, and having a second value when the fingerprint is determined to be associated with a bot. Based on the score received from the machine learning system, the server takes a configured action with respect to the client.

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as 'TLS fingerprinting.' Preferably, TLS fingerprinting herein comprises combining different parameters from the initial 'Hello' packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the &#x201c;TLS signature&#x201d;) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Growing community of inventors

Santa Clara, CA, United States of America

Duc Nguyen