60 results about "Web traffic" patented technology

The invention discloses a bad traffic monitoring method and system based on an LSTM and a clustering algorithm, belongs to the technical field of network security, and efficiently converges network traffic by using a BPF technology. The method comprises the following steps: accurately identifying fragmented traffic through an LSTM network, and capturing a complex dependency relationship by using a special memory unit structure of the LSTM network; performing session recombination by adopting an FCM clustering algorithm, restoring a complete network session, and quickly identifying malicious traffic through feature matching; and finally, timely treatment measures are taken for the confirmed malicious traffic. According to the method, rapid and accurate detection and identification of bad website traffic fragmentation behaviors are realized, and the technical problem that a traditional method is difficult to deal with is solved; through efficient caching and recombination mechanisms, the efficiency and accuracy of malicious traffic processing are improved; intelligent disposal measures are adopted, and it is ensured that malicious traffic is effectively restrained in time; the overall protection capability of network security is improved, and enterprise network resources and user data security are protected.

Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.

A computer system implemented method includes receiving flow data associated with web traffic from one or more requesters for a website, analyzing the flow data associated with the web traffic for the website, determining whether the flow data associated with the web traffic for the website indicates a likelihood of a malicious enumeration attack, and alerting an administrator of the website of the likelihood of the malicious enumeration attack. Further disclosed is computer systems and computer program products configured to perform the disclosed methods.

Disclosed herein are network information collectors, methods, computer-readable media, and systems for generating network traffic statistics. For example, the network appliance is to receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device; receive, via the network, additional accumulating maps from other network appliance devices; populate an accumulation map database with the accumulating map and the additional accumulating maps; and generate a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

The invention relates to the technical field of data analysis, and discloses a website traffic management method and system based on a load balancer, and the method comprises the steps: obtaining real-time state information and real-time load information of a plurality of servers, inputting the real-time state information and the real-time load information into a preset load decision model, and obtaining real-time load decision data; the load balancer is configured according to the real-time load decision data, and the network flow borne by each server is determined; periodically acquiring performance index data of the website system under the real-time load decision data, and evaluating and optimizing the performance of the preset load decision model based on the performance index data of the website system. According to the method, the configuration of the load balancer is dynamically adjusted by using the preset load decision model, the load balancing accuracy and the resource utilization rate are improved, decision and implementation results are periodically evaluated and optimized, the high efficiency and robustness of the system are ensured, and the flow load balancing requirement of effectively managing large websites or applications is met.

The invention discloses a few-sample increment website fingerprint identification method and system based on QUIC specific characteristics and a graph structure, a medium and a program product, and aims to solve the problem that QUIC encrypted traffic is difficult to effectively identify by a traditional method. According to the system, firstly, multi-dimensional features of QUIC traffic are extracted and constructed into a graph structure, and the global relevance between the traffic features is captured; then, deep mining is carried out on the features by utilizing a graph analysis technology, and the expression ability of the model to the traffic features is enhanced; and finally, through an incremental learning mechanism, the system can quickly adapt to newly appearing QUIC website traffic, and dynamic updating of a website recognition model is realized, so that the recognition precision and the real-time response capability are remarkably improved. According to the method and the device, through feature extraction and incremental learning for the QUIC traffic, efficient identification of the newly appearing website traffic is realized, and the accuracy and adaptability of website identification in an encrypted traffic environment are remarkably improved.

A system and method for automated bulk creation of Universal Resource Locators (URLs) with embedded Urchin Tracking Module (UTM) parameters is disclosed. The method processes input data, including endpoint URLs and UTM parameters, through pre-processing steps such as data cleansing and format standardization. The method appends UTM parameter-value pairs to endpoint URLs, optionally encoding the parameters. The generated tracking URLs are stored in a structured database for seamless integration with analytics tools, enabling reliable tracking and actionable insights into web traffic and user behavior.

There is disclosed a computer-implemented system and method for categorizing unclassified websites, including computing a data sketch of an unclassified website, wherein the data sketch is a probabilistic data structure that represents text of the unclassified website; computing an intersection value between the data sketch and a comparison set, wherein the comparison set comprises data sketches of known, classified websites; assigning matches for a subset of websites from the comparison set, wherein the subset includes intersections above an intersection threshold; classifying the website into a category of a website from the subset; and performing web traffic management based on the classification.

A system for managing web traffic comprising a meta control operating on a first processor having a first control interface and configured to generate a request for content and to transmit the request for content over a digital data network to a meta control server. The meta control server operating on a second processor and configured to receive the request for content and to select data for one or more second control interfaces as a function of data associated with the first control interface and to transmit the data for the one or more second control interfaces over the digital data network to the first control interface. The first control interface displays the data for the one or more second control interfaces and monitors user activity associated with the data.

The present invention discloses a method and system for generating a technical trade measure questionnaire based on big data, including obtaining and preprocessing information text data and web traffic data of a trade service platform, performing keyword analysis on the information text data to obtain keyword semantic importance, performing interest analysis on the web traffic data to obtain user interest, constructing a bias analysis function based on the keyword semantic importance and user interest, constructing a question sequence model, embedding the bias analysis function into the question sequence model, simulating the question sequence model, calculating the contribution degree of questions based on the simulation results, determining a questionnaire generation scheme according to the contribution degree of questions, and generating a questionnaire based on the questionnaire generation scheme. This method can not only improve the generation efficiency and quality of the questionnaire, but also has good interpretability and can be directly applied to the technical trade measure questionnaire evaluation system.

A system and method for defending against AI-driven web traffic interference is provided. The system and method include: receiving, by an agent, a secret device ID and a web token provided by an authentication server; receiving an instruction to modify a request to a web service stored in a web server; embedding within a WebAssembly (WASM) component executed by the agent, a first portion of an encryption key and a second portion of the encryption key; transmitting the second portion of the encryption key to the authentication server; assembling, at runtime within the WASM component, an actual encryption key by combining the first portion and the second portion of the encryption key; encrypting, using the actual encryption key, the web token in the WASM component to generate a plurality of authentication tokens; and sending a request with the generated plurality of authentication tokens to the authentication server.

This invention discloses a method and apparatus for identifying dark web websites in scenarios with concurrent access across multiple tabs. The method includes: acquiring network traffic packets of a website being viewed and extracting directional sequence features from the network traffic packets; dividing the directional sequence features into multiple sub-sequence features based on a multi-sliding window, and inputting the multiple sub-sequence features into a neural network model to extract preset pattern features; analyzing the correlation of the preset pattern features using a target website identification model to obtain a probability calculation result of the target website being accessed; and obtaining the target website identification result from the website being identified based on the probability calculation result and a preset classification model. This invention can effectively extract key information of accessed dark web websites from obfuscated dark web traffic, achieve accurate website identification across multiple tabs, and exhibit good robustness in dynamic and defensive scenarios.

A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.

In one embodiment, a method includes receiving a first request message associated with the online application, where the online application is provided by one or more application servers within the network domain, where the online application manages data, determining that a first suspicion score associated with the first request message exceeds a pre-determined threshold, inserting an indication into the first request message in response to the determination, where the indication specifies that the first request message is to be routed to a sandbox environment that is configured to mimic the one or more application servers, and where the sandbox environment is configured to not update the data managed by the online application, determining first routing policies based at least on the first suspicion score, and forwarding the indication-inserted first request message to a first computing device in the network domain based on the first routing policies.

The application provides a dark web traffic classifier based on natural scene statistics and an anti-attack defense method, and belongs to the technical field of network security. The method comprises the following steps: obtaining dark web traffic original data to form an original data set; using four attack algorithms to attack each data in the original data set to obtain four kinds of adversarial attack samples; using a natural scene statistics method to characterize the dark web traffic original data and the adversarial attack samples generated by one of the four attack algorithms to obtain a parameter set of a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution; training a detector using each parameter set; adding Gaussian noise to the data in the original data set, and training an autoencoder using the data after the Gaussian noise is added; combining the detector and the autoencoder into a two-layer defense mechanism; and identifying unknown traffic data by using the two-layer defense mechanism, feeding unknown traffic data with a classification result of attack traffic to the autoencoder for reconstruction to obtain benign data.

The invention provides an adaptive updating Web abnormal traffic detection method and system. The method comprises the following steps: 1) collecting and extracting target domain name traffic data from a Web application program; 2) obtaining three types of features including category features, statistical features and abnormal score features through traffic field contents; 3) training an abnormal traffic detection baseline model for the target domain name by using a multi-class machine learning fusion algorithm; 4) setting an event triggering mechanism, and realizing self-adaptive updating of the detection model based on an integrated learning framework; and 5) performing classification detection on the Web flow data of the target domain name by using the detection model. According to the method, the defect of insufficient adaptability of a traditional detection method is overcome, continuous learning and dynamic updating of abnormal traffic detection are realized, and the system can adapt to a new attack mode.

The invention concerns increasing the efficiency of the traditional rule-based WAF (200) (Web Application Firewall - Web Application Firewall) by detecting anomalies in web traffic in real time, thus reducing the frequently produced false positives, integrating machine learning algorithms for real-time web traffic anomaly detection, reduction of false positives, and effective detection of new attack vectors, thereby enhancing the efficiency of WAF (200).

A computer system, method, or program includes receiving flow data associated with web traffic from one or more requesters for a website, analyzing the flow data associated with the web traffic for the website 510, determining whether the flow data associated with the web traffic for the website indicates a likelihood of a malicious enumeration attack, and alerting (450, fig.4) an administrator of the website of the likelihood of the malicious enumeration attack. Flow data can be stored in a da tabase (420, fig.4). The likelihood of enumeration attack can be calculated based on agent name 570, number or volume of requests in a time period 540, and threshold percentage of requests matching a word list of common web pages 560, or on a weighted combination of these factors (fig.6). Analysis may be performed at predetermined intervals 580. Preferably the system does not perform deep packet analysis, i.e. packet inspection, when determining if there is an enumeration attack. Instead relying on metadata such as IP address, MAC address, host names, web page names, packet headers and the like. Such a system may protect internet-of-things (IoT) devices.

Aspects of the disclosure provide for methods, systems, and apparatuses, including computer storage media, for adaptively routing web traffic. A system can receive from a user computing device accessing a web resource, a content request, including data characterizing user interaction by the user computing device with the web resource before or after receiving the first content request. The system can identify a policy from a plurality of policies to execute in accordance with one or more objectives, wherein the plurality of policies are generated using data from a plurality of content requests and data characterizing user interaction with the web resource after serving a respective response to each of the plurality of content requests. The system can perform, in response to the content request, one or more actions of the ranked list of actions of the identified policy.

The application relates to the technical field of data analysis, and discloses a website traffic management method and system based on a load balancer, which comprises the following steps: acquiring real-time state information and real-time load information of a plurality of servers, inputting the real-time state information and the real-time load information into a preset load decision model to obtain real-time load decision data; configuring the load balancer according to the real-time load decision data to determine network traffic borne by each server; periodically acquiring performance index data of a website system under the real-time load decision data, and evaluating and optimizing the performance of the preset load decision model based on the performance index data of the website system. The preset load decision model is used to dynamically adjust the configuration of the load balancer, the load balancing accuracy and the resource utilization rate are improved, the decision and implementation results are periodically evaluated and optimized, the efficiency and robustness of the system are ensured, and the traffic load balancing demand of effectively managing a large website or application is met.

Disclosed herein is a technique for detecting potential phishing attacks by monitoring outbound web traffic from an endpoint, along with inbound electronic mail traffic addressed to a user of the endpoint. With this information, a search can be performed for possible sources in the web traffic of a request for a hyperlink located in the inbound mail traffic, and when no source is located, phishing remediation can be performed, including restrictions on access to the hyperlink at an endpoint operated by the user.

In one embodiment, a device in a network receives a set of known user identifiers used in the network. The device receives web traffic log data regarding web traffic in the network. The web traffic log data includes header information captured from the web traffic and a plurality of client addresses associated with the web traffic. The device detects a particular one of the set of known user identifiers in the header information captured from the web traffic associated with a particular one of the plurality of client addresses. The device makes an association between the particular detected user identifier and the particular client address.

Systems and methods to manage and efficiently perform authorization of multiple proxy clients are disclosed. Furthermore, systems and methods to measure and check whether the web traffic of one or more client devices has reached a permissible limit of web traffic assigned by the proxy service provider. Specifically, a proxy is configured to gather and save authorization information of one or more clients within its memory. Therefore, the proxy server can verify and authorize one or more clients by utilizing the data from its memory. Furthermore, the proxy is configured to measure and report the utilized web traffic of one or more client devices to a messaging platform. In another aspect, systems and methods to check whether one or more client devices have reached a permissible amount of web traffic limit are disclosed.

Aspects of the disclosure provide for methods, systems, and apparatuses, including computer storage media, for adaptively routing web traffic. A system can receive from a user computing device accessing a web resource, a content request, including data characterizing user interaction by the user computing device with the web resource before or after receiving the first content request. The system can identify a policy from a plurality of policies to execute in accordance with one or more objectives, wherein the plurality of policies are generated using data from a plurality of content requests and data characterizing user interaction with the web resource after serving a respective response to each of the plurality of content requests. The system can perform, in response to the content request, one or more actions of the ranked list of actions of the identified policy.

The invention provides a Web traffic monitoring method and device, and relates to the technical field of computers. The method comprises the following steps: acquiring target interface identification information carried in a received hyper text transfer protocol HTTP request based on section processing logic; according to the target interface identification information, judging whether a target HTTP interface corresponding to the HTTP request completes flow monitoring strategy configuration or not; in response to the fact that the target HTTP interface does not complete the flow monitoring strategy configuration, target interface identification information is sent to a configuration center for flow monitoring strategy configuration; and performing traffic monitoring on the target HTTP interface according to the traffic monitoring strategy configured by the configuration center. The method is realized in a aspect-oriented programming mode, is decoupled from business logic, is convenient to split and iterate for multiple times, conforms to agile development rules, is convenient for engineering management and risk control, automatically completes interface capture and acquisition, avoids manual intervention, reduces omission, reduces labor cost, improves automation degree, and reduces system maintenance cost.

Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.

A computer-implemented method for digital fingerprint obfuscation is disclosed. The computer-implemented method includes training a machine learning model to classify web traffic data into one or more personas. The computer-implemented method further includes identifying, using the trained machine learning model, a particular persona of a user based, at least in part, on a user's real traffic data generated during a current user session. The computer-implemented method further includes generating synthetic traffic data based, at least in part, on the identified particular persona of the user.

A system for managing web traffic comprising a meta control operating on a first processor having a first control interface and configured to generate a request for content and to transmit the request for content over a digital data network to a meta control server. The meta control server operating on a second processor and configured to receive the request for content and to select data for one or more second control interfaces as a function of data associated with the first control interface and to transmit the data for the one or more second control interfaces over the digital data network to the first control interface. The first control interface displays the data for the one or more second control interfaces and monitors user activity associated with the data.

Techniques for a deep learning approach for real-time scanning attack Uniform Resource Locaters (URLs) detection using Innocent Until Proven Guilty (IUPG) learning framework and custom web traffic volume features are disclosed. In some embodiments, a method for a deep learning approach for real-time scanning attack URLs detection using an IUPG learning framework and custom web traffic volume features includes pre-filtering network traffic associated with a URL for an inline scanning attack detection service, determining a plurality of features for the URL, applying the plurality of features for the URL to an IUPG-trained deep learning model for inline detection of scanning URLs, and performing an action in response to a determination that the URL is a scanning URL is disclosed herein.

A method for network aware endpoint data loss protection (DLP) in Web transactions is performed by a system and device, the method including implementing the DLP on an endpoint device and concentrating on Web traffic events from a Web browser while also associating the events with a network source entity. File download and upload events are intercepted from an operating system by a file system filter that determines that a process that creates the event is a Web browser based on a process identifier and compares a process name with a process executable signature. A uniform resource locator (URL) from the current tag or session is retrieved for the Web browser. Policy of the event is evaluated via a policy server or via a cache, and additional data from the file is provided for policy decisions if necessary. DLP actions taken via a file system filter to block or allow events, including encrypted file data, are decided based on a policy.