The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Nov. 15, 2022

Filed:

Dec. 19, 2019
Applicant:

Radware, Ltd., Tel Aviv, IL;

Inventors:

Lev Medvedovsky, Netanya, IL;

David Aviv, Tel Aviv, IL;

Ehud Doron, Moddi'in, IL;

Assignee:

Radware, Ltd., Tel Aviv, IL;

Attorney:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
H04L 9/40 (2022.01);
U.S. Cl.
CPC ...
H04L 63/1425 (2013.01); H04L 63/1416 (2013.01); H04L 63/1433 (2013.01); H04L 63/1466 (2013.01);
Abstract

A system and method for detecting anomalous hypertext transfer protocol secure (HTTPS) traffic are provided. The method includes receiving samples of at least rate-based features, wherein the rate-based features demonstrate a normal behavior of at least HTTPS traffic directed to a protected entity; computing a short-term baseline and a long-term baseline based on the received samples, wherein the short-term baseline is adapted to relatively rapid changes in the HTTPS traffic and the long-term baseline is adapted to relatively slow changes in the HTTPS traffic; computing at least one short-term threshold respective of the short-term baseline and at least one long-term threshold respective of the long-term baseline; evaluating each of the at least one threshold against real-time samples of HTTPS traffic to determine whether behavior of the HTTPS traffic is anomalous; and generating alarm when anomaly is detected.


Find Patent Forward Citations

Loading…