CDN Bot Detection Using Primitive and Compound Feature Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing bot detection systems in content delivery networks (CDNs) face challenges in identifying sophisticated botnets that adapt by randomly modifying device fingerprint parameters, rendering traditional fingerprinting techniques ineffective.
Innovation Solution
The method involves collecting and analyzing transaction data to generate a database of primitive and compound feature sets, which are used to characterize clients as human or bot, employing a rule-based system that flags deviations from established patterns in device parameters like user agent, device size, and canvas fingerprint.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional device fingerprinting is used to detect bots, then bot detection capability is provided, but sophisticated botnets can adapt by randomly modifying device fingerprint parameters, rendering the detection ineffective
Solution Approach 1:
The patent implements a dynamic bot detection system that continuously adapts to changing bot behaviors. The system collects transaction data over time, dynamically builds feature sets, and updates detection models to track evolving bot patterns. This dynamic approach allows the system to maintain detection accuracy even as botnets adapt their fingerprinting parameters, directly resolving the contradiction between reliable detection and bot adaptability.
2Measurement precision
If device fingerprint parameters are collected and analyzed, then bot identification is possible, but bot operators can randomize these parameters to appear as multiple distinct clients
Solution Approach 1:
The patent combines multiple device fingerprint parameters (user agent, device size, fonts, canvas fingerprint, audio fingerprint, plugins) into a comprehensive feature set. By merging these diverse parameters and analyzing their collective patterns across transactions, the system can identify bots even when individual parameters are randomized. This combination approach restores information loss by examining the holistic fingerprint pattern rather than relying on single parameters.
Solution Approach 2:
The system implements feedback loops where transaction data is continuously collected, analyzed, and used to refine detection models. The system learns from observed patterns in both legitimate and malicious traffic, adjusting its understanding of normal versus abnormal fingerprint combinations. This feedback mechanism enables the system to maintain measurement precision despite parameter randomization by adapting to the actual distribution of fingerprint values in the wild.
3Reliability
If comprehensive transaction data is collected and mined against feature sets, then sophisticated bot detection is achieved, but system complexity increases
Solution Approach 1:
The patent segments the bot detection system into distinct functional modules: data collection components that gather transaction information, feature extraction modules that process raw data into characteristic sets, analysis engines that compare features against known patterns, and decision-making components that classify traffic as legitimate or malicious. This segmentation allows each module to be optimized independently and simplifies the overall complexity by creating a modular architecture where complex tasks are broken down into manageable, specialized sub-tasks.
Data Source
AI summary
A method of detecting bots, preferably in an operating environment supported by a content delivery network (CDN) that comprises a shared infrastructure of distributed edge servers from which CDN customer content is delivered to requesting end users (clients). The method begins as clients interact with the edge servers. As such interactions occur, transaction data is collected. The transaction data is mined against a set of “primitive” or “compound” features sets to generate a database of information. In particular, preferably the database comprises one or more data structures, wherein a given data structure associates a feature value with its relative percentage occurrence across the collected transaction data. Thereafter, and upon receipt of a new transaction request, primitive or compound feature set data derived from the new transaction request are compared against the database. Based on the comparison, an end user client associated with the new transaction request is then characterized, e.g., as being associated with a human user, or a bot.