Method for identifying device users based on user-related metrics analysis

Abstract

Methods, network traffic management devices, non-transitory computer-readable media, and network traffic management systems for identifying device users based on user-related metrics analysis include identifying a user at a client in response to a received request request, retrieving user profile data associated with the user. Calculating a user confidence score based on a determined baseline user profile score for the user and a determined current user profile score for the user, the determined baseline user profile score being based on a previous value associated with an indicator in a category obtained from the retrieved user profile data, the determined current user profile score is based on a current value associated with an indicator in a category obtained from the retrieved user profile data. The calculated user confidence score is compared to a stored threshold range including a minimum threshold score and a maximum threshold score. Based on the comparison, an action is performed on the user in response to the request.

Description

[0001] The present technology relates to methods and systems for identifying device users based on analysis of user-related metrics (such as analysis of user-related movement metrics or user touch screen interactions at a client device) to prevent fraudulent or erroneous users from gaining access or to prevent theft or robotic attacks. Background Art

[0002] Before obtaining permission to access applications or other resources at a server device, the client device will first need to be identified. This identification is used to prevent fraudulent or erroneous users from gaining access rights, and is also used to prevent theft or robot attacks. Typically, such identification has been performed through authentication based on usernames and passwords or through the use of biometric records. Although authentication based on usernames and passwords or the use of biometric records are effective identification technologies, in view of the growing number of different types of devices seeking access to server devices and associated web applications and other resources, other methods are needed. Summary of the invention

[0003] A method implemented by a network traffic management system, the network traffic management system including one or more server devices, host devices, or client devices, which retrieves user profile data associated with a user at a client in response to a received request to identify a client. Calculate a user confidence score based on a determined baseline user profile score for the user at the client and a determined current user profile score for the user at the client, the determined baseline user profile score being based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, and the determined current user profile score being based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data. Compare the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score. Perform an action on the user at the client in response to the received request based on the comparison of the calculated user confidence score to the stored threshold range.

[0004] A network traffic management device includes a memory including programming instructions stored thereon; and one or more processors configured to be capable of executing the stored programming instructions to retrieve user profile data associated with a user at the client in response to a received request to identify a client. Calculate a user confidence score based on a determined baseline user profile score for the user at the client and a determined current user profile score for the user at the client, the determined baseline user profile score being based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, and the determined current user profile score being based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data. Compare the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score. Perform an action on the user at the client in response to the received request based on the comparison of the calculated user confidence score to the stored threshold range.

[0005] A non-transitory computer-readable medium having instructions stored thereon, the instructions including executable code that, when executed by one or more processors, causes the processors to identify a client in response to a received request, retrieve user profile data associated with a user at the client, calculate a user confidence score based on a determined baseline user profile score for the user at the client and a determined current user profile score for the user at the client, the determined baseline user profile score being based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, and the determined current user profile score being based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, compare the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score, and perform an action on the user at the client in response to the received request based on the comparison of the calculated user confidence score to the stored threshold range.

[0006] A network traffic management system includes one or more server devices, network traffic management devices, or client devices having a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to retrieve user profile data associated with a user at the client in response to a received request to identify a client. Calculate a user confidence score based on a determined baseline user profile score for the user at the client and a determined current user profile score for the user at the client, the determined baseline user profile score being based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, and the determined current user profile score being based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data. Compare the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score. Perform an action on the user at the client in response to the received request based on the comparison of the calculated user confidence score to the stored threshold range.

[0007] The present technology provides many advantages, including providing a method for more effectively and seamlessly identifying device users to manage further actions based on user-related indicator analysis, a non-transitory computer-readable medium, a network traffic management device, and a network traffic management system. Examples of the present technology create user profiles based on different indicators (such as human non-touch related indicators, human touch related interactions, environment related indicators, or device related indicators), but other types of indicators and / or indicator combinations can be used. In addition, examples of the present technology can be effectively used with both head devices and headless devices. Headed devices can accept direct input from users through some form of interaction with input mechanisms (such as touch screens, as an example), while headless devices lack any direct input, such as wearable band devices with only sensors but no touch screens or other user interaction buttons. In addition, examples of the present technology can be used for a variety of different applications, such as being able to identify users with a certain range of threshold confidences to: prevent theft of sensitive information or prevent unauthorized privileged access to sensitive information; establish confidence levels in sensitive transactions; identify age or profiles to facilitate parental sensitive content control; and prevent robot attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 is a block diagram of an exemplary network traffic management system having an exemplary network traffic management device configured to identify a device user at a client based on an analysis of user-related metrics;

[0009] Figure 2 yes Figure 1 A block diagram of an exemplary network traffic management device shown in;

[0010] Figure 3 is a flow chart of an exemplary method for identifying a device user at a client based on user-related metric analysis;

[0011] Figure 4 is a functional block diagram of an example of combinations of different indicator groups and subgroups for creating user profile data; and

[0012] Figure 5 is an exemplary table of categories, indicators, weights, and values ​​for calculating a score for identifying a device user at a client.

[0013] Although each of the drawings shows a specific example for the purpose of clearly showing the examples, other examples may omit, add, reorder or modify any of the elements shown in the drawings. For the purpose of clearly showing the examples, one or more figures may be described with reference to one or more other figures, but the specific arrangements shown in one or more other figures are not required to be used in the examples. DETAILED DESCRIPTION

[0014] Examples of the present technology may relate to methods for identifying device users based on user profiles created from analysis of user-related metrics, non-transitory computer-readable media, network traffic management devices, and network traffic management systems. Additionally, examples of the present technology can be effectively used with both headed devices and headless devices. As previously described, headed devices are capable of accepting direct input from a user through some form of interaction with an input device (such as a touch screen, as an example), while headless devices lack any direct input, such as a wearable band device that only has sensors and no touch screen or other user interaction buttons.

[0015] Examples of the present technology may create user profiles based on different indicators in different categories (such as human non-touch related categories, human touch related interaction categories, environment related categories, or device related categories), but other types of categories and / or indicators may be used. In response to the received request requiring identification of the client, such created user profile data associated with a specific user at the client may be retrieved. The user profile data may include values ​​determined for different indicators in different categories associated with the user.

[0016] When user profile data for a particular user at a client has been retrieved, a user profile score for the user at the client is calculated based on the values ​​associated with the indicators in one or more categories obtained from the retrieved user profile data. In this example, the composite score of the calculated user score is the indicator score calculated based on the values ​​associated with the indicators in the category combination. In addition, the categories may include a combination of human non-touch related categories, human touch related categories, environment related categories, and device related categories, but other types of categories in other combinations may be used. In addition, a specified storage weight may be applied to each value associated with an indicator in the category combination being used. Specific indicators known to have higher sensitivity may be assigned higher weights.

[0017] Once the user profile score has been calculated, the user profile score can be compared to a set stored threshold to provide an indication of whether the user at the client is a known client or an unknown client. Next, based on the comparison and the determined designation as a known client or an unknown client, an action can then be performed on the user at the client. A variety of different actions can be performed, such as, by way of example only, allowing access to the user at the client, denying access to the user at the client, or redirecting the user at the client.

[0018] In the following description, for the purpose of explanation, several specific details are set forth in order to provide a thorough understanding of examples of the present technology. However, it is apparent that examples of the technology can be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form to avoid unnecessarily obscuring examples of the technology.

[0019] It should also be understood that: unless expressly stated otherwise, the term "or" can be inclusive or exclusive; the term "set" can include zero, one, or two or more elements; the terms "first", "second", "some" and "particular" are used as naming conventions to distinguish elements from each other, and unless otherwise stated, do not imply the order, timing or any characteristics of the referenced items; the terms "such as", "eg", "for example", etc. describe one or more examples, but are not limited to the examples described; the terms "comprises" and / or "comprising" specify the presence of the stated features, but do not exclude the presence or addition of one or more other features.

[0020] A "computer system" refers to one or more computers, such as one or more physical computers, virtual computers, and / or computing devices. As an example, a computer system may be or may include one or more server computers, cloud-based computers, cloud-based computer clusters, virtual machine instances, or virtual machine computer elements, such as virtual processors, storage devices and memory, data centers, storage devices, desktop computers, laptop computers, mobile devices, or any other special-purpose computing devices. Unless otherwise expressly stated, any reference to a "computer system" herein may refer to one or more computers. When a computer system performs an action, the action is performed by one or more computers of the computer system.

[0021] A "client" (also referred to as a "client device") refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources is configured to interact with one or more servers over a network, such as the Internet. A client may refer to a combination of components on one or more computers, or one or more computers.

[0022] A "server" (also referred to as a "server system," "server computer system," "server device," or "server apparatus") refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources provides a particular type of functionality on behalf of the server's clients. A server may refer to a combination of components on one or more computers, or one or more computers. A server may include multiple servers; that is, a server may include a first server computing device and a second server computing device, which may provide the same or different functionality to the same or different sets of clients.

[0023] refer to Figure 1, shows an exemplary network traffic management system 100, which is configured to identify a device user at a client of one of headed client devices 106(1) to 106(n) or headless client devices 108(1) to 108(n) based on user-related metric analysis. The network traffic management system 100 in this example includes a network traffic management device 102, which is coupled to server devices 104(1) to 104(n), headed client devices 106(1) to 106(n), and headless client devices 108(1) to 108(n) via a communication network 110, but the network traffic management device 102, server devices 104(1) to 104(n), headed client devices 106(1) to 106(n), and headless client devices 108(1) to 108(n) can be coupled together via other topologies. The network traffic management system 100 can also include other network devices that are well known in the art and will not be described herein. The present technology provides numerous advantages, including methods, non-transitory computer-readable media, network traffic management systems 100, and network traffic management devices 102 capable of identifying device users based on analysis of user-related metrics.

[0024] In this particular example, Figure 1 to Figure 2 As shown, the network traffic management system 100 includes a network traffic management device 102, server devices 104(1) to 104(n), headed client devices 106(1) to 106(n), and headless client devices 108(1) to 108(n), but the system may have other types of systems, devices, and / or other elements that may adopt other configurations. In some examples, one or more of the network traffic management device 102, server devices 104(1) to 104(n), headed client devices 106(1) to 106(n), and headless client devices 108(1) to 108(n), or portions thereof, may also be implemented in hardware and / or software in one or more other devices in the network traffic management system 100. Although the description herein is generally directed to a system distributed across multiple devices, it should be understood that it is contemplated that the techniques disclosed herein may alternatively be applied in other ways.

[0025] refer to Figure 1 to Figure 2, the network traffic management device 102 of the network traffic management device system 100 can perform any number of functions, such as, for example, identifying a device user at one of the headed client devices 106(1) to 106(n) or one of the headless client devices 108(1) to 108(n) based on analysis of user-related metrics. The network traffic management device 102 in this example includes a processor 202, a memory 204, and a communication interface 206 coupled together by a bus, but the network traffic management device 102 may include other types or numbers of elements in other configurations.

[0026] The processor 202 of the network traffic management device 102 can execute programmed instructions stored in the memory 204 of the network traffic management device 102 to implement any number of functions as described and illustrated by way of example herein. The processor 202 of the network traffic management device 102 can include, for example, one or more central processing units (CPUs) or general purpose processors having one or more processing cores, although other types of processors can also be used.

[0027] The memory 204 of the network traffic management device 102 stores these programming instructions for one or more aspects of the present technology as described and illustrated herein, but some or all of the programming instructions may be stored elsewhere. Various different types of memory storage devices (such as RAM, ROM, hard disk, solid state drive, flash memory, or other computer readable media that is read from and written to by a magnetic, optical or other read-write system coupled to a processor) can be used for the memory.

[0028] Thus, the memory of the network traffic management device 102 may store one or more modules that may include computer executable instructions that, when executed by the network traffic management device 102, cause the network traffic management device 102 to perform actions, such as those described below with reference to Figures 3 to 5 The actions described and shown. Modules can be implemented as components of other modules. In addition, modules can be implemented as applications, operating system extensions, plug-ins, etc.

[0029] Further, in some examples, the modules may operate in a cloud-based computing environment. The modules may execute within or as a virtual machine or virtual server that may be managed in a cloud-based computing environment. In addition, the modules, and even the network traffic manager device 102 itself, may be located in a virtual server that runs in a cloud-based computing environment rather than being tied to one or more specific physical network computing devices. In addition, the modules may run in one or more VMs executing on the network traffic management device 102. Additionally, in one or more examples of the present technology, the virtual machines running on the network traffic management device 102 may be managed or supervised by a hypervisor.

[0030] In this particular example, the memory 204 of the network traffic management device 102 includes a user profile module 210, a user scoring module 212, a user profile database 214, and a metric weight and value database 216, but the memory may include other types and numbers of modules, databases, and / or other storage elements. In some examples, the user profile module 210 may include software including programming instructions installed on the network traffic management device 102 that may create a user profile based on stored values ​​and other data related to various categories of metrics, but other ways may be used to create user profile data, such as those shown and described as examples herein. In some examples, the categories may include a combination of human non-touch related categories, human touch related categories, environment related categories, and device related categories, but other types of categories and / or underlying metrics may be used, such as those shown and described as examples herein. Additionally, in some examples, the user scoring module 212 may include software including programming instructions installed on the network traffic management device 102 that may calculate a user profile score based on values ​​associated with indicators in one or more categories obtained from the retrieved user profile data, although other means may be used to calculate the user profile score, such as those shown and described as examples herein. In some examples, the user profile database 214 may store user profile data for values ​​and assigned weights for indicators in different categories on the network traffic management device 102 based on previous historical monitoring of different users, as shown and described as examples herein, although user profile data may also be obtained in other ways. Additionally, in some examples, the indicator weights and values ​​database 216 may store determined values ​​and assigned weights for indicators in different categories for different users on the network traffic management device 102, as shown and described as examples herein. Figure 5 An exemplary format of a table for identifying categories, indicators, weights, and values ​​of user profile data for a device user is shown by way of example only.

[0031] like Figure 1 As shown, the network traffic management device 102 can be located between the headed client devices 106(1) to 106(n) and between the headless client devices 108(1) to 108(n) and the server devices 104(1) to 104(n), so that the network traffic management device 102 can determine the identity of a user at one of the headed client devices 106(1) to 106(n) or the headless client devices 108(1) to 108(n) before taking action in response to a request from a user at one of the headed client devices 106(1) to 106(n) or the headless client devices 108(1) to 108(n).

[0032] The communication interface 206 of the network traffic management device 102 is operably coupled and communicates between the network traffic management device 102, the headed client devices 106(1) to 106(n), the headless client devices 108(1) to 108(n), and the server devices 104(1) to 104(n) coupled together at least in part via the communication network 110, although other types and numbers of communication networks or systems having other types or numbers of connections or configurations to other devices or elements may also be used.

[0033] By way of example only, the communication network 110 may include a local area network (LAN) or a wide area network (WAN), and may use Ethernet-based TCP / IP and industry standard protocols, although other types or numbers of protocols or communication networks may be used. In this example, the communication network 110 may employ any suitable interface mechanism and network communication technology, including, for example, traffic in any suitable form (e.g., voice and modem), a public switched telephone network (PSTN), an Ethernet-based packet data network (PDN) hosting a hypertext transfer protocol (HTTP), combinations thereof, and the like. The communication network may also include local connections between the headed client devices 106(1) to 106(n), the headless client devices 108(1) to 108(n), and / or the server devices 104(1) to 104(n) and the network traffic management device 102, such as a direct Wi-Fi connection, a Bluetooth connection, near field communication, a direct wired connection, or any other method by which the headed client devices 106(1) to 106(n), the headless client devices 108(1) to 108(n), and / or the server devices 104(1) to 104(n) communicate directly or indirectly with the network traffic management device 102.

[0034] According to other examples, the network traffic management device 102 can be any type of computing device, such as, for example, a server device. In this example, the network traffic management device 102 is shown as a single device, but in other examples, multiple devices may be included, each device having a processor (each processor having a processing core) that implements the steps of the present technology. In these examples, one or more of the devices may have a dedicated communication interface or memory. Alternatively, one or more of the devices may utilize the memory 204, the communication interface 206, or other hardware or software components of one or more other devices in the device included in the network traffic management device 102.

[0035] Thus, one or more of the devices that collectively comprise the network traffic management device 102 may be a standalone device or integrated with one or more other devices or apparatuses, such as, for example, one or more of the server devices 104(1) to 104(n). In addition, one or more of the devices of the network traffic management device 102 may be in the same or different communication networks, including, for example, one or more public, private, or cloud networks. In yet other examples, multiple network traffic management devices 102 may be deployed within and / or outside of a local area network associated with the server devices 104(1) to 104(n), which communicate with any number of application servers or end station computers and have other network topologies.

[0036] Reference again Figure 1 , the server devices 104(1) to 104(n) of the network traffic management system 100 in this example may be, for example, commercial web servers that host one or more associated web applications or other resources accessible by the headed client devices 106(1) to 106(n) and / or the headless client devices 108(1) to 108(n). The web pages may request web resources from any number of other domains. According to some examples, the server devices 104(1) to 104(n) may be secure servers that only authorized users can access. For example, it may first be necessary to identify the headed client device 106(1) to 106(n) and / or the headless client device 108(1) to 108(n) requesting access to one of the server devices 104(1) to 104(n) before an action regarding the request can be determined.

[0037] Each of the server devices 104(1)-104(n) includes a processor, memory, and communication interface coupled together via a bus or other communication link (not shown), although other numbers or types of components and other elements may be used in other configurations. The server devices 104(1)-104(n) in this example may include, for example, application servers or database servers, although other types of server devices 104(1)-104(n) may also be included in the network traffic management system 100.

[0038] Although server devices 104(1)-104(n) are shown as a single device, in other examples, one of server devices 104(1)-104(n) may include multiple servers distributed across one or more different network computing devices of common server device 104. Furthermore, server devices 104(1)-104(n) are not limited to a particular configuration. Thus, server devices 104(1)-104(n) may include network computing devices that operate using a master / slave approach, whereby one of the network computing devices of server devices 104(1)-104(n) operates to manage or otherwise coordinate the operations of the other network computing devices. One of server devices 104(1)-104(n) may function as multiple network computing devices within, for example, a cluster architecture, a peer-to-peer architecture, within a virtual machine, or within a cloud architecture.

[0039] Thus, the techniques disclosed herein should not be construed as limited to a single environment, and other configurations and architectures are also contemplated. Thus, any number of network traffic management devices 102, headed client devices 106(1) to 106(n), headless client devices 108(1) to 108(n), and server devices 104(1) to 104(n) may be used. For purposes of providing illustrative examples only, Figure 1 1 , multiple network traffic management devices 102, headed client devices 106(1) to 106(n), headless client devices 108(1) to 108(n), and server devices 104(1) to 104(n) are shown.

[0040] Each of the headed client devices 106(1)-106(n) of the network traffic management system 100 in this example includes any type of computing device that can accept direct input from a user through some form of interaction with an input mechanism (such as a touch screen, as an example), such as a mobile, desktop, laptop, or tablet computing device or other computing device. Each of the headless computing devices 108(1)-108(n) of the network traffic management system 100 in this example includes any type of computing device that lacks any direct input, such as a wearable band device that has only sensors and no touch screen or other user interaction buttons. Each of the headed client devices 106(1)-106(n) and each of the headless client devices 108(1)-108(n) in this example includes a processor, memory, and communication interface coupled together by a bus or other communication link (not shown), although other numbers or types of components may also be used.

[0041] The headed client devices 106(1)-106(n) and the headless computing devices 108(1)-108(n) may run an interface application that may provide an interface to make requests to and receive content stored on one or more of the server devices 104(1)-104(n) via the network 110. The headed client devices 106(1)-106(n) may include an input mechanism or other system to receive input from a user, such as, by way of example only, a keyboard, a mouse, and / or an interactive screen. The headed client devices 106(1)-106(n) and the headless computing devices 108(1)-108(n) may also include a display device, such as a display screen or a touch screen, or an input device, such as, for example, a keyboard (not shown).

[0042] Although an exemplary network environment 100 having a network traffic management device 102, server devices 104(1)-104(n), headed client devices 106(1)-106(n), headless computing devices 108(1)-108(n), and a communication network 110 is described and shown herein, other types or numbers of systems, devices, components, or elements in other topologies may be used. It should be understood that the example systems described herein are for exemplary purposes, as many variations of the specific hardware and software used to implement these examples are possible, as will be appreciated by those skilled in the relevant art.

[0043] In some examples, two or more computing systems or devices may be replaced with any of the systems or devices in any of the examples. Therefore, the principles and advantages of distributed processing, such as redundancy and replication, may also be implemented as needed to improve the robustness and performance of the devices and systems of the examples. These examples may also be implemented on a computer system extended on any suitable network using any suitable interface mechanism and traffic technology, which, by way of example only, include wireless traffic networks, cellular traffic networks, packet data networks (PDNs), the Internet, intranets, and combinations thereof.

[0044] For one or more aspects of the present technology, these examples may also be embodied as one or more non-transitory computer-readable media having executable or programming instructions stored thereon (such as, for example, stored in the memory 204 of the network traffic management device 102), as described and shown by the examples herein. The instructions in some examples include executable code that, when executed by the processor 202 of the network traffic management device 102, causes the processor 202 to perform the steps required to implement the methods of the examples of the present technology described and shown herein.

[0045] refer to Figures 1 to 5, illustrates an example method for identifying a device user based on user-related metric analysis to identify and then initiate executable actions with respect to a received request. More specifically, with reference to Figure 3 , at step 300, the example method begins in response to a request intercepted by the network traffic management device 102 from one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) to access an application or other resource at one of the server devices 104(1)-104(n) in this example.

[0046] At step 302, the network traffic management device 102 determines whether the user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) transmitting the request has associated user profile data stored in the user profile database 214. If, at step 302, the network traffic management device 102 determines that the user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) does not have associated user profile data stored in the user profile database 214 or the user profile data is incomplete, the “no” branch is taken to step 304.

[0047] At step 304, the network traffic management device 102 executes the user profile module 210 to obtain and establish user profile data for a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n), as described in the example below, although the user profile data for the user may be established or otherwise obtained in other ways. In addition, the network traffic management device 102 may store such user profile data for the user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) in a user profile database 214 in the network traffic management device 102, although the user profile data may be stored in other locations.

[0048] As an example, the network traffic management device 102 may execute the user profile module 210 to establish user profile data for a user of one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n) by sampling and capturing data for indicators in one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4) within a set previous time period, although other types and / or numbers of categories may be used. By way of example only, the set time period may be two months ago, although other time periods or methods may be used, such as a minimum number of sampled interactions. Additionally, in other examples, the user profile data may be continuously updated by the network traffic management device 102.

[0049] like Figures 4 to 5 As shown in FIG. 1 , exemplary human non-touch related categories 402 (1), human touch related categories 402 (2), environment related categories 402 (3), and device related categories 402 (4) used when creating user profile data are shown. Specifically, in Figure 5 In the stored table shown, categories, indicators and corresponding abbreviations of the indicators, weights applied to each of the categories, individual weights applied to each of the indicators in each of the categories, and values ​​captured or otherwise determined for each of the indicators are shown as examples. For each of the values ​​of each of the indicators, the network traffic management device 102 may determine an average value from multiple sessions over a set time period or a value determined in another manner, but other methods for determining values ​​based on the obtained data may be used.

[0050] In this example, the human non-touch related category 402(1) includes indicators obtained from one or more headless devices (such as wearable band devices that only have sensors but no touch screen or other user interaction buttons). Specifically, in this example, Figure 4As shown, the indicators of the human body non-touch related category 402(1) may include: a step sound (SS) indicator 404(1), which includes a determined value of the user's step sound; a breathing sound indicator 404(2), which includes a determined value of the user's breathing sound; a heart rate (HR) indicator 404(3), which includes a determined value of the user's heart rate; an energy / calorie count (CC) indicator 404(4), which includes a determined value of the energy / calorie count consumed by the user; a stride length indicator 404(5), which includes a determined value of the user's stride length; a speed (V) indicator 404(6), which includes a determined value of the user's current speed or movement rate; and a step count (SC) indicator 404(7), which captures the user's current step count, but this category may have other indicators of other types and / or quantities.

[0051] In addition, in this example, human touch-related category 402(2) includes indicators obtained from one or more headed devices that are capable of accepting direct input from a user through some form of interaction with an input mechanism (such as a touch screen, for example). Specifically, in this example, the indicators of human touch-related category 402(2) may include: swipe speed (SV) indicator 406(1), which includes a determined value of the user's swipe speed; touch force (TF) indicator 406(2), which includes a determined value of the user's touch force; touch event duration (TD) indicator 406(3), which includes a determined value of the user's touch event duration; touch finger point area (TA) indicator 406(4), which includes a determined value of the user's touch finger point area; touch source (TS) indicator 406(5), which captures the user's touch source, such as, for example, such as whether the source is a finger or a stylus; typing pattern (TP) metrics 406(6), which include determined values ​​of the user's typing pattern, such as typing rate, language used, vocabulary used, as examples; and gesture analysis (GA) metrics 406(7), which include determined values ​​of gesture analysis of the user, such as, for example, specific gestures, such as pinch-to-zoom or the location on the screen that the user typically touches for a swipe gesture, the distance between touch points in a multi-touch gesture, such as two-finger swipe down / up or more than two-finger swipe down / up, but this category may have other indicators of other types and / or quantities.

[0052] Additionally, in this example, environment-related category 402(3) includes metrics obtained from one or more environment sensing devices, such as, for example, ambient light, air temperature, air pressure, and humidity. Specifically, in this example, the metrics of environment-related category 402(3) may include: ambient light (AL) metric 408(1) including a determined value of ambient light surrounding a user; air temperature (AT) metric 408(2) including a determined value of air temperature surrounding a user; air pressure metric 408(3) including a determined value of air pressure (AP) surrounding a user; and humidity (H) metric 408(4) including a determined value of humidity surrounding a user, although this category may have other metrics of other types and / or quantities.

[0053] Further, in this example, device-related category 402 ( 4 ) includes metrics obtained from one or more sensors or imagers, such as gyroscopes, proximity sensors, barometer sensors, imaging devices or other cameras, and accelerometers, as examples. Specifically, in this example, the indicators of the device-related category 402(4) may include: a gyroscope (GS) indicator 410(1) including a determined value of gyroscope data related to the user; a proximity sensor (PS) data indicator 410(2) including a determined value of the proximity of the user to one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n); a barometer sensor (BS) indicator 410(3) including a determined value of barometric pressure data in the vicinity of the user; a camera image frame (CI) indicator 410(4) including a determined value of camera image frame data related to the user; and an accelerometer (AS) indicator 410(5) including a determined value of accelerometer data related to the user, but this category may have other indicators of other types and / or quantities.

[0054] Thus and by way of example, when a user performs any operation on one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n), for each of these sessions, a value for the corresponding metric is determined or otherwise obtained and stored as user profile data in the user profile module 210 associated with the user's stored identification information, although in other examples the user profile data may be stored in other locations.

[0055] In addition, in step 304, the network traffic management device 102 calculates a baseline category score and a baseline composite score based on the captured value data for different indicators in different categories in a set time period before the currently received request in the user profile data of the user of one of the headed client devices 106(1) to 106(n) or the user of one of the headless computing devices 108(1) to 108(n) in this example. The baseline category score and the baseline composite score can be pre-calculated by the network traffic management device 102, or can be calculated in real time based on the latest set of stored user profile data. Specifically, in this example, the network traffic management device 102 calculates a baseline category score for one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4), but other types and / or numbers of category scores can be created. Multiple different types of categories help to more accurately identify the current user. Once baseline category scores for one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4) are calculated, the network traffic management device 102 can calculate a baseline composite score based on these calculated baseline category scores, which can be used to identify the user of one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n) from which the request is received.

[0056] By way of example only, the network traffic management device 102 may use executable instructions to calculate a baseline category score and a baseline composite score for one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4) as follows, although other methods may be used to calculate other indicators and / or combinations of category scores:

[0057] Human non-touch related category (no head) score

[0058]

[0059]

[0060] Human touch related category (with head) score

[0061]

[0062] Environmental-related category scores

[0063]

[0064] Device-related score

[0065]

[0066] Comprehensive score = human body (without head) score + human body touch (with head) score + environment score + other

[0067] =W human body + W interaction + W environment + W other

[0068] Specifically, in this example, for each of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4), the Figure 5 The network traffic management device 102 shown in the table shown in FIG. 1 can execute programming instructions to use the above formula to determine the calculated baseline category score of the user of one of the headed client devices 106 (1) to 106 (n) or one of the headless computing devices 108 (1) to 108 (n) that transmits the request and determine the baseline composite score based on the calculated baseline category score. As shown in the above example, the network traffic management device 102 can also use individual weights W in these calculations. A To W W The obtained value V applied to each of the indicators for each of the human non-touch related category 402 (1), the human touch related category 402 (2), the environment related category 402 (3), and the device related category 402 (4) A至 VW, then applies another assigned weight W1 to W4 to each of the calculated baseline category scores for each of the categories. A To W W Sum W1 - W4 may be based on historical data showing previous successful correlations with user identification, although other weights and / or approaches to determining scores may be used.

[0069] Referring back to step 302 , if the network traffic management device 102 determines that the user of one of the headed client devices 106 ( 1 ) to 106 ( n ) or one of the headless computing devices 108 ( 1 ) to 108 ( n ) transmitting the request does have associated user profile data stored in the user profile database 214 in this example, the “yes” branch is taken to step 306 .

[0070] At step 306, the network traffic management device 102 obtains current values ​​of selected exemplary metrics for one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4) for a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) from which the request was received. The current values ​​used by the network traffic management device 102 in these calculations may be compared to the values ​​of the selected exemplary metrics for one or more of the human non-touch related category 402(1), the human touch related category 402(2), the environment related category 402(3), and the device related category 402(4). Figure 5 The categories and indicators shown in are the same and may be the most recent current values ​​or values ​​obtained from user profile data in a most recent set time period that is earlier than a later set time period used to calculate a baseline category score and a baseline composite score for a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) from which the request is received.

[0071] Next, based on these current values ​​within the most recently set time period, the network traffic management device 102 calculates the current category scores for one or more of the human non-touch related category 402 (1), the human touch related category 402 (2), the environment related category 402 (3), and the device related category 402 (4) in the same manner as shown and described in the above examples based on the captured current data for different indicators in different categories, but other types of calculations may be used for them as long as the two correspond. Once the current category scores for one or more of the human non-touch related category 402 (1), the human touch related category 402 (2), the environment related category 402 (3), and the device related category 402 (4) are calculated, the network traffic management device 102 may calculate the current comprehensive score based on these calculated current category scores in the same manner as shown and described in the above examples, but other types of calculations may be used for them as long as the two correspond.

[0072] At step 308, the network traffic management device 102 determines whether the calculated user confidence score based on the currently calculated composite score and the baseline composite score of a user of one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n) is within the minimum threshold range and the maximum threshold range. However, other means can be used to determine the confidence of the user identification. As an example, if the calculated composite baseline score is US 1 and the calculated current composite score is C1, the network traffic management device 102 calculates the calculated user confidence score as (C1 / US1)%, but other methods can be used to determine the calculated user confidence score. Thus, for a use case where C1 > US1, or more specifically in an example where C1 is 94 and US1 is 85, the calculated user confidence score for accurately identifying the actual user is (C1 / US1)% = (C1 / US1) * 100 = (94 / 85) * 100 = 110.5%. In another example, for a use case where C1 < US1, or more specifically in an example where C1 is 65 and US1 is 85, the calculated user confidence score for accurately identifying the actual user is (C1 / US1)% = (C1 / US1) * 100 = (65 / 85) * 100 = 76.47%. As a result, in each of these examples, the network traffic management device 102 compares the calculated user confidence score with the stored minimum confidence threshold score and the maximum confidence threshold score. For example, the minimum confidence threshold score is 80% and the maximum confidence threshold score is 120%. Thus, in these examples, the calculated user confidence score of 110.5% will be within the confidence threshold range of 80% to 120%, but for another example, the calculated user confidence score of 76.47% will be outside the confidence threshold range of 80% to 120%. In these examples, this range helps to identify anomalies in identifying the user in either direction. For example, insufficient correlation or excessive correlation indicates the possibility of an automated device mimicking the user.

[0073] Next, if at step 308, the network traffic management device 102 determines that the calculated user confidence score of a user of one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n) transmitting the request is not within the set minimum threshold range and the maximum threshold range, then take the "No" branch and proceed to step 310.

[0074] At step 310, in this example, the network traffic management device 102 determines whether the data for the current values ​​of one or more metrics in one or more categories is insufficient to calculate additional data for one or more of the current category scores and values. If, in step 310, the network traffic management device 102 determines that the data for the current values ​​of one or more metrics in one or more categories is insufficient, the "yes" branch is taken back to step 306 as previously described, where more data for the current values ​​may be obtained as needed.

[0075] If, returning to step 310, the network traffic management device 102 determines that the data for the current values ​​of one or more metrics in one or more categories is sufficient to calculate the additional data for one or more of the current category scores and values, then the calculated user confidence score for the user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) that transmitted the request is accurate, and the "no" branch is taken to return to step 312. Thus, in this example, this additional step ensures that there are sufficient current data values ​​to determine the calculated user confidence score before designating a user with an unknown designation.

[0076] In this example, in step 312, the network traffic management device 102 designates the user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) transmitting the request as unknown, and may return to step 306 as previously described for further monitoring. Additionally, based on the designation as a currently unknown user, the network traffic management device 102 may also proceed to step 316 to perform one or more actions based on the unknown designation, such as, by way of example only, denying a request from a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n), marking a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n), blocking traffic from a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n), or adding a user of one of the headed client devices 106(1)-106(n) or one of the headless computing devices 108(1)-108(n) to a separate database of unknown users, although other types of operations may be performed to manage network traffic.

[0077] If returning to step 308, the network traffic management device 102 determines that the calculated user confidence score of the user of one of the headed client devices 106(1) to 106(n) or one of the headless computing devices 108(1) to 108(n) that transmits the request is within the set minimum threshold range and maximum threshold range, then the "yes" branch is taken to enter step 314.

[0078] At step 314, the network traffic management device 102 designates the user of the one of the headed client devices 106(1)-106(n) or the one of the headless computing devices 108(1)-108(n) that transmitted the request as known and may then proceed to step 316. At step 316, the network traffic management device 102 may perform one or more other actions based on the known designation, such as, for example, allowing the user of the one of the headed client devices 106(1)-106(n) or the one of the headless computing devices 108(1)-108(n) to issue the request, but other types of actions may be performed to manage network traffic.

[0079] Having thus described the basic concepts of the present invention, it will be quite apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented only by way of example and is not restrictive. Although not expressly stated herein, various changes, improvements and modifications will occur and are intended to be used by those skilled in the art. These changes, improvements and modifications are intended to be proposed accordingly and are within the spirit and scope of the present invention. In addition, except as may be specified in the claims, the order of the listed processing elements or sequences, or the use of numbers, letters or other designations is therefore not intended to limit the claimed process to any order. Therefore, the present invention is limited only by the appended claims and their equivalents.

Claims

1. A method implemented by a network traffic management system, the network traffic management system comprising one or more host devices, server devices, network traffic management devices or client devices, the method comprising: In response to the received request requiring identification of a client, retrieving user profile data associated with a user at the client; calculating a user confidence score based on a determined baseline user profile score for the user at the client that is based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data and a determined current user profile score for the user at the client that is based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data; comparing the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score; as well as Based on the comparison of the calculated user confidence score to the stored threshold range, an action is performed on the user at the client in response to the received request.

2. The method of claim 1, further comprising: determining, in response to the received request requiring identification, whether the user profile data associated with the user at the client has been generated; as well as When the determination indicates that the user profile data associated with the user at the client is not present, the user profile data for the indicator in at least one of the categories is generated. 3 . The method of claim 1 , wherein the categories include human non-touch related categories, human touch related categories, environment related categories, and device related categories.

4. The method of claim 1, wherein the determined baseline user profile score and the determined current user profile score are each further determined by applying the assigned storage weight to at least one value associated with the indicator in the combination of the categories.

5. The method of claim 1, further comprising: determining whether additional data from at least one of the metrics in the retrieved user profile data is needed when the calculated user confidence score is outside of the threshold range; Wherein when the determination indicates that the additional data is required, then: obtaining the additional data; recalculating the current user profile score based on the current value associated with the indicator in one of the categories obtained from the retrieved user profile data and the additional data; Wherein when the determination indicates that the additional data is not required, then: identifying the user as having an unknown designation; The identifying action is performed on the user at the client based on the unknown designation.

6. A network traffic management device, comprising: Memory, The memory includes programming instructions stored thereon; and one or more processors configured to execute stored programming instructions to: In response to the received request requiring identification of a client, retrieving user profile data associated with a user at the client; calculating a user confidence score based on a determined baseline user profile score for the user at the client that is based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data and a determined current user profile score for the user at the client that is based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data; comparing the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score; as well as Based on the comparison of the calculated user confidence score to the stored threshold range, an action is performed on the user at the client in response to the received request.

7. The apparatus of claim 6, wherein the programming instructions are further configured to cause the one or more processors to: determining, in response to the received request requiring identification, whether the user profile data associated with the user at the client has been generated; and When the determination indicates that the user profile data associated with the user at the client is not present, the user profile data for the indicator in at least one of the categories is generated.

8. The device of claim 6, wherein the categories include human non-touch related categories, human touch related categories, environment related categories, and device related categories.

9. The apparatus of claim 6, wherein the determined baseline user profile score and the determined current user profile score are each further determined by applying the assigned storage weight to at least one value associated with the indicator in the combination of the categories.

10. The apparatus of claim 6, wherein the programming instructions are further configured to cause the one or more processors to: determining whether additional data from at least one of the metrics in the retrieved user profile data is needed when the calculated user confidence score is outside of the threshold range; Wherein when the determination indicates that the additional data is required, then: obtaining the additional data; recalculating the current user profile score based on the current value associated with the indicator in one of the categories obtained from the retrieved user profile data and the additional data; Wherein when the determination indicates that the additional data is not required, then: identifying the user as having an unknown designation; The identifying action is performed on the user at the client based on the unknown designation.

11. A non-transitory computer readable medium having stored thereon instructions, the instructions comprising executable code that, when executed by one or more processors, causes the one or more processors to: In response to the received request requiring identification of a client, retrieving user profile data associated with a user at the client; calculating a user confidence score based on a determined baseline user profile score for the user at the client that is based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data and a determined current user profile score for the user at the client that is based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data; comparing the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score; as well as Based on the comparison of the calculated user confidence score to the stored threshold range, an action is performed on the user at the client in response to the received request.

12. The non-transitory computer readable medium of claim 11, wherein the programming instructions are further configured to cause the one or more processors to: determining, in response to the received request requiring identification, whether the user profile data associated with the user at the client has been generated; and When the determination indicates that the user profile data associated with the user at the client is not present, the user profile data for the indicator in at least one of the categories is generated. 13 . The non-transitory computer-readable medium of claim 11 , wherein the categories include a human non-touch related category, a human touch related category, an environment related category, and a device related category.

14. The non-transitory computer-readable medium of claim 11, wherein the determined baseline user profile score and the determined current user profile score are each further determined by applying the assigned storage weight to at least one value associated with the indicator in the combination of the categories.

15. The non-transitory computer readable medium of claim 11, wherein the programming instructions are further configured to cause the one or more processors to: determining whether additional data from at least one of the metrics in the retrieved user profile data is needed when the calculated user confidence score is outside of the threshold range; Wherein when the determination indicates that the additional data is required, then: obtaining the additional data; recalculating the current user profile score based on the current value associated with the indicator in one of the categories obtained from the retrieved user profile data and the additional data; Wherein when the determination indicates that the additional data is not required, then: identifying the user as having an unknown designation; The identifying action is performed on the user at the client based on the unknown designation.

16. A network traffic management system comprising one or more server devices, network traffic management devices, or client devices having: a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to: In response to the received request requiring identification of a client, retrieving user profile data associated with a user at the client; calculating a user confidence score based on a determined baseline user profile score for the user at the client that is based on previous values ​​associated with indicators in one or more categories obtained from the retrieved user profile data and a determined current user profile score for the user at the client that is based on current values ​​associated with indicators in one or more categories obtained from the retrieved user profile data; comparing the calculated user confidence score to a stored threshold range including a minimum confidence threshold score and a maximum confidence threshold score; as well as Based on the comparison of the calculated user confidence score to the stored threshold range, an action is performed on the user at the client in response to the received request.

17. The system of claim 16, wherein the programming instructions are further configured to cause the one or more processors to: determining, in response to the received request requiring identification, whether the user profile data associated with the user at the client has been generated; and When the determination indicates that the user profile data associated with the user at the client is not present, the user profile data for the indicator in at least one of the categories is generated.

18. The system of claim 16, wherein the categories include human non-touch related categories, human touch related categories, environment related categories, and device related categories.

19. The system of claim 16, wherein the determined baseline user profile score and the determined current user profile score are each further determined by applying the assigned storage weight to at least one value associated with the indicator in the combination of the categories.

20. The system of claim 16, wherein the programming instructions are further configured to cause the one or more processors to determining whether additional data from at least one of the metrics in the retrieved user profile data is needed when the calculated user confidence score is outside of the threshold range; Wherein when the determination indicates that the additional data is required, then: obtaining the additional data; recalculating the current user profile score based on the current value associated with the indicator in one of the categories obtained from the retrieved user profile data and the additional data; Wherein when the determination indicates that the additional data is not required, then: identifying the user as having an unknown designation; The identifying action is performed on the user at the client based on the unknown designation.

Images