Browser Impersonator Detection With Dynamic False-Positive Tuning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser impersonation detection systems are inflexible and prone to high false positives, lacking dynamic adaptation to changing traffic patterns and lacking automated methods for scoring rule contributions and evaluating false positives.
Innovation Solution
A bot detection service with a control plane and data plane architecture that uses machine learning models and dynamic lookup tables to continuously adapt to new traffic patterns, reducing false positives by applying dynamic BID rules and selectively overriding classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If static scoring models with hardcoded rules are used, then the system structure is simple, but the system lacks flexibility to adapt to changing traffic patterns
Solution Approach 1:
The patent implements dynamic scoring models that can be updated and retrained offline without requiring code changes in the data plane. The control plane generates updated scoring contributions from training data and pushes them to the data plane, allowing the system to adapt to changing traffic patterns dynamically while keeping the data plane structure simple and unchanged.
Solution Approach 2:
The patent performs offline training and scoring model generation in advance before deployment. The control plane trains scoring models on historical traffic data, generates scoring contributions, and prepares updated rules before pushing them to the data plane. This preliminary action enables the system to adapt to new patterns without real-time complexity or code changes.
2Measurement precision
If more detection rules are added to improve detection accuracy, then bot detection capability improves, but false positives increase
Solution Approach 1:
The patent implements a feedback mechanism where the control plane continuously monitors detection performance and uses labeled traffic data to retrain scoring models. The system generates updated scoring contributions based on performance feedback, allowing it to learn from false positives and adjust detection thresholds dynamically to maintain high accuracy while reducing false positives.
Solution Approach 2:
The patent dynamically adjusts scoring parameters and thresholds based on traffic patterns and performance metrics. The control plane modifies scoring contributions, weights, and thresholds offline based on analyzed traffic data, enabling the system to optimize detection sensitivity and specificity without changing the underlying rule structure or requiring code modifications.
3Reliability
If manual evaluation and tuning of detection rules is performed, then false positives can be reduced, but the process is time-consuming and inefficient
Solution Approach 1:
The patent enables the control plane to automatically perform rule evaluation, scoring model generation, and parameter tuning without manual intervention. The system self-adjusts by training on traffic data, generating optimized scoring contributions, and pushing updated rules to the data plane automatically, eliminating time-consuming manual processes while maintaining high reliability.
Solution Approach 2:
The patent replaces manual mechanical processes of rule tuning and evaluation with automated machine learning algorithms. The control plane uses ML models to automatically analyze traffic patterns, evaluate rule performance, and generate optimized scoring contributions, substituting human effort with automated computational processes that are faster and more scalable.
4Adaptability or versatility
If code changes are made in the data plane to implement new detection features, then functionality improves, but deployment complexity and time increase
Solution Approach 1:
The patent separates the system into two independent planes: the control plane that handles all training, model generation, and rule updates, and the data plane that executes detection using pushed rules. This segmentation allows new detection features to be developed and tested in the control plane, then deployed to the data plane as pre-compiled scoring models without requiring code changes or recompilation in the data plane.
Solution Approach 2:
The patent creates copyable scoring models and detection rules in the control plane that can be replicated and pushed to multiple data plane instances. The control plane generates standardized scoring contributions and rule sets that can be copied across the network infrastructure, enabling consistent deployment of new detection functionality without modifying data plane code or requiring complex integration processes.
Data Source
AI summary
A bot detection service associated with an overlay network and configured as a centralized control plane, and a data plane that operates in an overlay network entity, e.g., an edge server. The control plane performs analytics continuously to generate a machine learning (ML) model, a set of device anomaly (DAN) patterns, and false positive (FP) tuning data. During a request processing workflow at the edge server, a request is received. A subset of detector rules triggered by the request are identified, optionally using the DAN patterns. The ML model is then applied to the subset to classify the request as a bot or human. When the request is classified as a bot, the FP tuning data is applied to determine whether to selectively override the classification as being a false positive. When the request is classified as a bot and not overridden, an action is taken, e.g., denying the request.