44 results about "Web traffic" patented technology

A computer system implemented method includes receiving flow data associated with web traffic from one or more requesters for a website, analyzing the flow data associated with the web traffic for the website, determining whether the flow data associated with the web traffic for the website indicates a likelihood of a malicious enumeration attack, and alerting an administrator of the website of the likelihood of the malicious enumeration attack. Further disclosed is computer systems and computer program products configured to perform the disclosed methods.

Disclosed herein are network information collectors, methods, computer-readable media, and systems for generating network traffic statistics. For example, the network appliance is to receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device; receive, via the network, additional accumulating maps from other network appliance devices; populate an accumulation map database with the accumulating map and the additional accumulating maps; and generate a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

The invention relates to the technical field of data analysis, and discloses a website traffic management method and system based on a load balancer, and the method comprises the steps: obtaining real-time state information and real-time load information of a plurality of servers, inputting the real-time state information and the real-time load information into a preset load decision model, and obtaining real-time load decision data; the load balancer is configured according to the real-time load decision data, and the network flow borne by each server is determined; periodically acquiring performance index data of the website system under the real-time load decision data, and evaluating and optimizing the performance of the preset load decision model based on the performance index data of the website system. According to the method, the configuration of the load balancer is dynamically adjusted by using the preset load decision model, the load balancing accuracy and the resource utilization rate are improved, decision and implementation results are periodically evaluated and optimized, the high efficiency and robustness of the system are ensured, and the flow load balancing requirement of effectively managing large websites or applications is met.

The invention discloses a few-sample increment website fingerprint identification method and system based on QUIC specific characteristics and a graph structure, a medium and a program product, and aims to solve the problem that QUIC encrypted traffic is difficult to effectively identify by a traditional method. According to the system, firstly, multi-dimensional features of QUIC traffic are extracted and constructed into a graph structure, and the global relevance between the traffic features is captured; then, deep mining is carried out on the features by utilizing a graph analysis technology, and the expression ability of the model to the traffic features is enhanced; and finally, through an incremental learning mechanism, the system can quickly adapt to newly appearing QUIC website traffic, and dynamic updating of a website recognition model is realized, so that the recognition precision and the real-time response capability are remarkably improved. According to the method and the device, through feature extraction and incremental learning for the QUIC traffic, efficient identification of the newly appearing website traffic is realized, and the accuracy and adaptability of website identification in an encrypted traffic environment are remarkably improved.

A system and method for automated bulk creation of Universal Resource Locators (URLs) with embedded Urchin Tracking Module (UTM) parameters is disclosed. The method processes input data, including endpoint URLs and UTM parameters, through pre-processing steps such as data cleansing and format standardization. The method appends UTM parameter-value pairs to endpoint URLs, optionally encoding the parameters. The generated tracking URLs are stored in a structured database for seamless integration with analytics tools, enabling reliable tracking and actionable insights into web traffic and user behavior.

The present invention discloses a method and system for generating a technical trade measure questionnaire based on big data, including obtaining and preprocessing information text data and web traffic data of a trade service platform, performing keyword analysis on the information text data to obtain keyword semantic importance, performing interest analysis on the web traffic data to obtain user interest, constructing a bias analysis function based on the keyword semantic importance and user interest, constructing a question sequence model, embedding the bias analysis function into the question sequence model, simulating the question sequence model, calculating the contribution degree of questions based on the simulation results, determining a questionnaire generation scheme according to the contribution degree of questions, and generating a questionnaire based on the questionnaire generation scheme. This method can not only improve the generation efficiency and quality of the questionnaire, but also has good interpretability and can be directly applied to the technical trade measure questionnaire evaluation system.

A system and method for defending against AI-driven web traffic interference is provided. The system and method include: receiving, by an agent, a secret device ID and a web token provided by an authentication server; receiving an instruction to modify a request to a web service stored in a web server; embedding within a WebAssembly (WASM) component executed by the agent, a first portion of an encryption key and a second portion of the encryption key; transmitting the second portion of the encryption key to the authentication server; assembling, at runtime within the WASM component, an actual encryption key by combining the first portion and the second portion of the encryption key; encrypting, using the actual encryption key, the web token in the WASM component to generate a plurality of authentication tokens; and sending a request with the generated plurality of authentication tokens to the authentication server.

This invention discloses a method and apparatus for identifying dark web websites in scenarios with concurrent access across multiple tabs. The method includes: acquiring network traffic packets of a website being viewed and extracting directional sequence features from the network traffic packets; dividing the directional sequence features into multiple sub-sequence features based on a multi-sliding window, and inputting the multiple sub-sequence features into a neural network model to extract preset pattern features; analyzing the correlation of the preset pattern features using a target website identification model to obtain a probability calculation result of the target website being accessed; and obtaining the target website identification result from the website being identified based on the probability calculation result and a preset classification model. This invention can effectively extract key information of accessed dark web websites from obfuscated dark web traffic, achieve accurate website identification across multiple tabs, and exhibit good robustness in dynamic and defensive scenarios.

A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.

In one embodiment, a method includes receiving a first request message associated with the online application, where the online application is provided by one or more application servers within the network domain, where the online application manages data, determining that a first suspicion score associated with the first request message exceeds a pre-determined threshold, inserting an indication into the first request message in response to the determination, where the indication specifies that the first request message is to be routed to a sandbox environment that is configured to mimic the one or more application servers, and where the sandbox environment is configured to not update the data managed by the online application, determining first routing policies based at least on the first suspicion score, and forwarding the indication-inserted first request message to a first computing device in the network domain based on the first routing policies.

The application provides a dark web traffic classifier based on natural scene statistics and an anti-attack defense method, and belongs to the technical field of network security. The method comprises the following steps: obtaining dark web traffic original data to form an original data set; using four attack algorithms to attack each data in the original data set to obtain four kinds of adversarial attack samples; using a natural scene statistics method to characterize the dark web traffic original data and the adversarial attack samples generated by one of the four attack algorithms to obtain a parameter set of a generalized Gaussian distribution and an asymmetric generalized Gaussian distribution; training a detector using each parameter set; adding Gaussian noise to the data in the original data set, and training an autoencoder using the data after the Gaussian noise is added; combining the detector and the autoencoder into a two-layer defense mechanism; and identifying unknown traffic data by using the two-layer defense mechanism, feeding unknown traffic data with a classification result of attack traffic to the autoencoder for reconstruction to obtain benign data.

The invention provides an adaptive updating Web abnormal traffic detection method and system. The method comprises the following steps: 1) collecting and extracting target domain name traffic data from a Web application program; 2) obtaining three types of features including category features, statistical features and abnormal score features through traffic field contents; 3) training an abnormal traffic detection baseline model for the target domain name by using a multi-class machine learning fusion algorithm; 4) setting an event triggering mechanism, and realizing self-adaptive updating of the detection model based on an integrated learning framework; and 5) performing classification detection on the Web flow data of the target domain name by using the detection model. According to the method, the defect of insufficient adaptability of a traditional detection method is overcome, continuous learning and dynamic updating of abnormal traffic detection are realized, and the system can adapt to a new attack mode.

The invention concerns increasing the efficiency of the traditional rule-based WAF (200) (Web Application Firewall - Web Application Firewall) by detecting anomalies in web traffic in real time, thus reducing the frequently produced false positives, integrating machine learning algorithms for real-time web traffic anomaly detection, reduction of false positives, and effective detection of new attack vectors, thereby enhancing the efficiency of WAF (200).

A computer system, method, or program includes receiving flow data associated with web traffic from one or more requesters for a website, analyzing the flow data associated with the web traffic for the website 510, determining whether the flow data associated with the web traffic for the website indicates a likelihood of a malicious enumeration attack, and alerting (450, fig.4) an administrator of the website of the likelihood of the malicious enumeration attack. Flow data can be stored in a da tabase (420, fig.4). The likelihood of enumeration attack can be calculated based on agent name 570, number or volume of requests in a time period 540, and threshold percentage of requests matching a word list of common web pages 560, or on a weighted combination of these factors (fig.6). Analysis may be performed at predetermined intervals 580. Preferably the system does not perform deep packet analysis, i.e. packet inspection, when determining if there is an enumeration attack. Instead relying on metadata such as IP address, MAC address, host names, web page names, packet headers and the like. Such a system may protect internet-of-things (IoT) devices.

The application relates to the technical field of data analysis, and discloses a website traffic management method and system based on a load balancer, which comprises the following steps: acquiring real-time state information and real-time load information of a plurality of servers, inputting the real-time state information and the real-time load information into a preset load decision model to obtain real-time load decision data; configuring the load balancer according to the real-time load decision data to determine network traffic borne by each server; periodically acquiring performance index data of a website system under the real-time load decision data, and evaluating and optimizing the performance of the preset load decision model based on the performance index data of the website system. The preset load decision model is used to dynamically adjust the configuration of the load balancer, the load balancing accuracy and the resource utilization rate are improved, the decision and implementation results are periodically evaluated and optimized, the efficiency and robustness of the system are ensured, and the traffic load balancing demand of effectively managing a large website or application is met.

Disclosed herein is a technique for detecting potential phishing attacks by monitoring outbound web traffic from an endpoint, along with inbound electronic mail traffic addressed to a user of the endpoint. With this information, a search can be performed for possible sources in the web traffic of a request for a hyperlink located in the inbound mail traffic, and when no source is located, phishing remediation can be performed, including restrictions on access to the hyperlink at an endpoint operated by the user.

In one embodiment, a device in a network receives a set of known user identifiers used in the network. The device receives web traffic log data regarding web traffic in the network. The web traffic log data includes header information captured from the web traffic and a plurality of client addresses associated with the web traffic. The device detects a particular one of the set of known user identifiers in the header information captured from the web traffic associated with a particular one of the plurality of client addresses. The device makes an association between the particular detected user identifier and the particular client address.

Systems and methods to manage and efficiently perform authorization of multiple proxy clients are disclosed. Furthermore, systems and methods to measure and check whether the web traffic of one or more client devices has reached a permissible limit of web traffic assigned by the proxy service provider. Specifically, a proxy is configured to gather and save authorization information of one or more clients within its memory. Therefore, the proxy server can verify and authorize one or more clients by utilizing the data from its memory. Furthermore, the proxy is configured to measure and report the utilized web traffic of one or more client devices to a messaging platform. In another aspect, systems and methods to check whether one or more client devices have reached a permissible amount of web traffic limit are disclosed.

Aspects of the disclosure provide for methods, systems, and apparatuses, including computer storage media, for adaptively routing web traffic. A system can receive from a user computing device accessing a web resource, a content request, including data characterizing user interaction by the user computing device with the web resource before or after receiving the first content request. The system can identify a policy from a plurality of policies to execute in accordance with one or more objectives, wherein the plurality of policies are generated using data from a plurality of content requests and data characterizing user interaction with the web resource after serving a respective response to each of the plurality of content requests. The system can perform, in response to the content request, one or more actions of the ranked list of actions of the identified policy.

The invention provides a Web traffic monitoring method and device, and relates to the technical field of computers. The method comprises the following steps: acquiring target interface identification information carried in a received hyper text transfer protocol HTTP request based on section processing logic; according to the target interface identification information, judging whether a target HTTP interface corresponding to the HTTP request completes flow monitoring strategy configuration or not; in response to the fact that the target HTTP interface does not complete the flow monitoring strategy configuration, target interface identification information is sent to a configuration center for flow monitoring strategy configuration; and performing traffic monitoring on the target HTTP interface according to the traffic monitoring strategy configured by the configuration center. The method is realized in a aspect-oriented programming mode, is decoupled from business logic, is convenient to split and iterate for multiple times, conforms to agile development rules, is convenient for engineering management and risk control, automatically completes interface capture and acquisition, avoids manual intervention, reduces omission, reduces labor cost, improves automation degree, and reduces system maintenance cost.

Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.

A computer-implemented method for digital fingerprint obfuscation is disclosed. The computer-implemented method includes training a machine learning model to classify web traffic data into one or more personas. The computer-implemented method further includes identifying, using the trained machine learning model, a particular persona of a user based, at least in part, on a user's real traffic data generated during a current user session. The computer-implemented method further includes generating synthetic traffic data based, at least in part, on the identified particular persona of the user.

Techniques for a deep learning approach for real-time scanning attack Uniform Resource Locaters (URLs) detection using Innocent Until Proven Guilty (IUPG) learning framework and custom web traffic volume features are disclosed. In some embodiments, a method for a deep learning approach for real-time scanning attack URLs detection using an IUPG learning framework and custom web traffic volume features includes pre-filtering network traffic associated with a URL for an inline scanning attack detection service, determining a plurality of features for the URL, applying the plurality of features for the URL to an IUPG-trained deep learning model for inline detection of scanning URLs, and performing an action in response to a determination that the URL is a scanning URL is disclosed herein.

The invention discloses a website statistical analysis method, device and equipment and a storage medium, one-button deployment is carried out based on a Docker containerization technology, firstly, a lightweight script in a website page is deployed, basic visitor behavior data not related to the personal identity of a user is collected, the volume of the lightweight script is smaller than 3 KB, and the lightweight script is loaded and executed in an asynchronous mode; encrypting and compressing the acquired basic visitor behavior data, sending the data to a server, storing the data in a database configured by a website host, and analyzing and calculating the data stored in the database to obtain a website traffic core index; and displaying the website traffic core indexes through a visual billboard. Quick installation and configuration can be realized by adopting one-button Docker deployment, extremely low influence on website performance is ensured by embedding an asynchronous script smaller than 3KB, and user privacy and data security can be thoroughly protected only by collecting non-personal identity data and encrypting, compressing and transmitting the non-personal identity data.

Systems and methods to manage and efficiently perform authorization of multiple proxy clients are disclosed. Furthermore, systems and methods to measure and check whether the web traffic of one or more client devices has reached a permissible limit of web traffic assigned by the proxy service provider. Specifically, a proxy is configured to gather and save authorization information of one or more clients within its memory. Therefore, the proxy server can verify and authorize one or more clients by utilizing the data from its memory. Furthermore, the proxy is configured to measure and report the utilized web traffic of one or more client devices to a messaging platform. In another aspect, systems and methods to check whether one or more client devices have reached a permissible amount of web traffic limit are disclosed.

This invention relates to the field of network security technology and discloses a method and system for identifying malicious traffic in intelligent Web application firewalls based on a CNN-LSTM hybrid neural network, aiming to address the technical shortcomings of traditional WAFs and existing detection models. This invention constructs an end-to-end intelligent Web traffic detection system, achieving malicious payload deobfuscation through adaptive recursive decoding. It employs a hybrid model combining multi-scale CNN and cascaded LSTM to automate the extraction of local features and long-term semantic features. Combined with SMOTE resampling and data augmentation to optimize model training, and a probability threshold policy decision engine, it achieves accurate handling of malicious traffic. The system adopts a five-layer hierarchical architecture, with highly cohesive and loosely coupled modules that can be deployed in an engineered manner. This invention improves the detection capability against obfuscated attacks and unknown attacks, while reducing false positive rates and operational costs, making it suitable for malicious traffic identification scenarios in Web application firewalls.

The invention provides a network server security partition configuration method and system, and the method comprises the steps: receiving an access request, and determining the type of the access request; if the type is Web traffic, controlling the first network architecture to determine an IP address of the access request; if the type of the access request is non-Web traffic, controlling a second network architecture to determine an IP address of the access request; obtaining a request identifier of the IP address; and if the request identifier is in the preset white list, sending the access request to the first convergence switch and / or the second convergence switch to access the intranet server. According to the invention, the first network architecture and the second network architecture which are connected in parallel are arranged, and the optimal communication link is dynamically selected based on the type of the access request and according to the request type, so that the efficiency and the security of network communication are improved, and the problems of overhigh firewall load and large delay caused by access of more Web traffic and non-Web traffic are solved.

A system and method that automates trending data collection and timeseries predictions based on a coordinated system of emerging topics across social media, forums, news, media, search engine, web traffic, and other data sources. Using machine learning and natural language processing, trending data counts are cross referenced across each platform to inform representative conversational data collection, cultural classification, and timeseries predictions in order to identify emerging trends and predict trend trajectory over time. User interfaces provided by the system may be used to aid in evaluating emerging cultural trends as they may relate to business activity, law enforcement, and financial and other personal decisions, for example. The system may provide such data based on upon user configured searches that might focus the results on topics such as key consumer, economic, or political topics.

A software and / or hardware facility for scoring the quality of traffic to a site accessible via the Internet or other network. The facility may generate training set data and use the training set data to identify parameters indicative of fraudulent traffic to a site and reduce the effect of fraudulent traffic advertisers and publishers. The facility may score the quality of traffic and determine combinations of parameters that are indicative of the quality of traffic to the site. Traffic to the site may be scored based on the combination of parameters associated with the one or more sessions. Lower scores are indicative of traffic having little value to a publisher, advertiser, or third party; higher scores are indicative of traffic having greater value.

The application discloses an encrypted website traffic anti-noise identification method, system, device, medium and product, and relates to the field of digital information transmission. The method comprises the following steps: obtaining encrypted traffic generated when a user accesses a website, and saving the encrypted traffic into a PCAP file containing multiple data packets according to a set rule; cleaning the data packets in the PCAP file to obtain cleaned encrypted traffic; recombining the cleaned encrypted traffic based on the five-tuple information of the data packets to obtain multiple data streams; extracting website features from each data packet in each data stream to obtain website fingerprint extraction results; generating graph structure data based on the website fingerprint extraction results; performing a graph classification task on the graph structure data, and completing prediction of the user's access to the website according to the classification result. The application can effectively implement identification of website traffic on the premise that there is background noise.