Intel Corporation

Akamai Technologies, Inc.

Cyberfend, Inc.

Sreenath Kurupati

Tu Vuong

Miguel A Guerrero

Venkata Sai Kishore Modalavalasa

Raju Hormis

Brian R Nickerson

Muraleedhara Herur Navada

Sridhar V Machiroutu

Jonathan W Liu

Prajakta Bhurke

Sunil B Chaudhari

Samuel Wong

Wujian Zhang

Oscar Nestares

Scott Ettinger

Horst Haussecker

Alok Kumar Mathur

Rony Kay

Kavitha Prasad

Yoram Gat

Tyson J Thomas

Ashwani Oberai

Inaki Berenguer

Kinyip Sit

Kuo-Ching Liang

Zixu Wang

A bot detection service associated with an overlay network operates to score traffic as a probability of being a bot, as opposed to returning a binary classification (i.e., bot or human). According to the approach herein, scoring is determined through probability estimates, wherein a score (the probability) is based on considering a set of detections concurrently. In one embodiment, all (or substantially all) triggered (current) threat detections contribute to the score. The preferred approach penalizes requests that fail all (or substantially all) combinations of detection algorithms. According to a further feature, an automated tuning (autotuning) is also applied, e.g., using real-time empirical statistical models, to adapt the measurement of false positive probability for one or more threat detection algorithms to suit customer traffic trends. The approach herein is also extensible to include any number of future threat detection algorithms.

Combining multiple detection algorithms into a confidence score for bot detection

A non-transitory computer readable storage medium including instructions that, when executed by a computing system, cause the computing system to perform operations. The operations include collecting, by a processing device, raw data regarding a user action. The operations also include converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents behavior characteristics of a current user. The operations also include identifying, by the processing device, a characteristic model corresponding to the behavior characteristics represented by the CTD. The operations also include generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action came from an authenticated user.

Intrusion detection on computing devices

This disclosure describes a technique to determine whether a client computing device accessing an API is masquerading its device type (i.e., pretending to be a device that it is not). To this end, and according to this disclosure, the client performs certain processing requested by the server to reveal its actual processing capabilities and thereby its true device type, whereupon—once the server learns the true nature of the client device—it can take appropriate actions to mitigate or prevent further damage. To this end, during the API transaction the server returns information to the client device that causes the client device to perform certain computations or actions. The resulting activity is captured on the client computing and then transmitted back to the server, which then analyzes the data to inform its decision about the true client device type. Thus, when the server detects the true client device type (as opposed to the device type that the device is masquerading to be), it can take appropriate action to defend the site.

Detecting device masquerading in application programming interface (API) transactions

Methods and systems for malicious non-human user detection on computing devices are described. The method includes collecting, by a processing device, raw data corresponding to a user action, converting, by the processing device, the raw data to features, wherein the features represent characteristics of a human user or a malicious code acting as if it were the human user, and comparing, by the processing device, at least one of the features against a corresponding portion of a characteristic model to differentiate the human user from the malicious code acting as if it were the human user.

Method and apparatus to detect non-human users on computer systems

This disclosure describes a bot detection system that leverages deep learning to facilitate bot detection and mitigation, and that works even when an attacker changes an attack script. The approach herein provides for a system that rapidly and automatically (without human intervention) retrains on new, updated or modified attack vectors.

Automated learning and detection of web bot transactions using deep learning

A method of detecting bots, preferably in an operating environment supported by a content delivery network (CDN) that comprises a shared infrastructure of distributed edge servers from which CDN customer content is delivered to requesting end users (clients). The method begins as clients interact with the edge servers. As such interactions occur, transaction data is collected. The transaction data is mined against a set of 'primitive' or 'compound' features sets to generate a database of information. In particular, preferably the database comprises one or more data structures, wherein a given data structure associates a feature value with its relative percentage occurrence across the collected transaction data. Thereafter, and upon receipt of a new transaction request, primitive or compound feature set data derived from the new transaction request are compared against the database. Based on the comparison, an end user client associated with the new transaction request is then characterized, e.g., as being associated with a human user, or a bot.

Content delivery network (CDN) bot detection using primitive and compound feature sets

This disclosure describes a technique to determine whether a client computing device accessing an API is masquerading its device type (i.e., pretending to be a device that it is not). To this end, and according to this disclosure, the client performs certain processing requested by the server to reveal its actual processing capabilities and thereby its true device type, whereupon&#x2014;once the server learns the true nature of the client device&#x2014;it can take appropriate actions to mitigate or prevent further damage. To this end, during the API transaction the server returns information to the client device that causes the client device to perform certain computations or actions. The resulting activity is captured on the client computing and then transmitted back to the server, which then analyzes the data to inform its decision about the true client device type. Thus, when the server detects the true client device type (as opposed to the device type that the device is masquerading to be), it can take appropriate action to defend the site.

This disclosure describes a technique to slow down or block creation of automated attack scripts by configuring a detector to discriminate whether particular attack-like activity is a true attack, or simply a hacker 'testing' his or her automated attack script, and then permitting any such test script to continue working (attacking) the site, albeit on a limited basis. In this manner, the hacker receives an indication that his or her automated attack script is already working. Thereafter, when the detector later detects a launch of an actual attack based on or otherwise associated with the automated attack script (previously under test), the attack fails either because the script was not a working script in the first instance, or because information learned about the script is used to adjust the site as necessary to then prepare adequately for a true attack.

Mitigating automated attacks in a computer network environment

This disclosure describes a bot detection system that distinguishes bot transactions from human transactions. The system utilizes an anomaly-based filter process to reduce the number of false positives as determined by the system. The filter process includes maintaining a database of anomaly patterns, wherein the patterns are encoded as anomaly pattern strings. As anomalies are detected, they are encoded in the anomaly pattern strings, and the database is updated by maintaining counts on the occurrences of the strings. When a particular pattern string as reflected in the database has a count that exceeds a threshold, the string is determined to be associated with a bot as opposed to a human user.

Reducing false positives in bot detection

Growing community of inventors

Santa Clara, CA, United States of America

Sreenath Kurupati