AI Network Traffic Filtering for Automated Scanner Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to accurately differentiate between interactions generated by automated scanners and human interactions in marketing emails, leading to skewed engagement metrics and difficulties in blocking automated security scanners at a network level.
Innovation Solution
An artificial intelligence system implements algorithms to classify network traffic by monitoring incoming traffic, developing signals based on interaction data, and temporarily throttling traffic from identified automated scanners, ensuring accurate differentiation and filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If automated scanners are blocked at network level, then engagement metrics accuracy is improved, but legitimate user access may be affected
Solution Approach 1:
The patent segments network traffic into distinct categories by analyzing interaction patterns, timing, and behavior characteristics. The system divides traffic into automated scanner traffic and legitimate user traffic based on multiple differentiated features, allowing selective filtering without blocking legitimate users.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring interaction data and adjusting classification decisions based on observed patterns. The engagement metrics feed back into the classification algorithm to improve accuracy over time, enabling dynamic adaptation to distinguish scanners from legitimate users.
2Measurement precision
If network traffic monitoring is implemented to identify automated scanners, then engagement metrics accuracy is improved, but system complexity increases
Solution Approach 1:
The patent implements a multi-functional classification system that simultaneously performs multiple tasks: traffic monitoring, pattern recognition, classification, and filtering. The same system infrastructure handles various types of interactions (email opens, link clicks, form submissions) using a unified approach, reducing overall system complexity despite the sophisticated analysis required.
Solution Approach 2:
The system employs self-service mechanisms by automatically learning from interaction data and adapting its classification rules without requiring manual configuration. The algorithm autonomously identifies patterns and adjusts its behavior based on observed traffic characteristics, reducing the complexity burden on system operators.
3Measurement precision
If classification algorithms analyze interaction data in real-time, then automated scanner detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and storing interaction data in structured formats before classification is needed. Interaction patterns, timing information, and behavioral features are captured and organized in advance, allowing the classification algorithm to make rapid decisions when actual traffic needs to be filtered.
Solution Approach 2:
The patent applies partial action by analyzing only the most discriminative features of interaction data rather than processing every detail. The classification system focuses on key indicators such as interaction frequency, timing patterns, and behavioral signatures that are sufficient for accurate scanner detection, reducing processing time while maintaining detection accuracy.
Data Source
AI summary
Methods, systems, and devices for filtering network traffic from automated scanner are described. A device (e.g., an application server) may receive an activity message associated with an interaction with an electronic communication message and identify, from the activity message, at least a source identifier of the activity message and one or more attributes associated with the electronic communication message. The device may then add the activity message to a mapping of source identifiers and attributes associated with previously received activity messages and classify the activity message as being associated with an automated scanner based on a comparison of the received activity message to the mapping over a previous time window. Upon classifying the activity message, the device may transmit a classification result to an external server.