Detecting automated attacks on computer systems using real-time clustering

Abstract

A bot detection service is enhanced by providing improved threat scoring using dynamic clustering of telemetry data received from a server. The detection approach leverages the notion that bot traffic is statistically anomalous compared to empirical models of human traffic. In particular, bots have more similar and repeating network patterns (i.e., lists of field values derived from client telemetry) that lend themselves to tighter clustering than random human traffic. The technique herein leverages this notion by providing a bot detection service with a network pattern clustering algorithm that differentiates bot-versus-human traffic by searching for similar and repeating network patterns that cluster together by virtue of having lesser variation (as compared to human traffic) in their field value sets.