Device Reputation Scoring via Network Signal Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in effectively detecting anonymous proxies and bots making requests to servers on the Internet, as they often fail to accurately distinguish between human and automated traffic, leading to security vulnerabilities in networks and applications.
Innovation Solution
The proposed solution involves analyzing signals such as instrumented response patterns, newbie signals, and DNS resolver usage to score the reputation of requesting devices, which helps in determining the likelihood of bot or proxy usage by comparing device characteristics with historical data across multiple web sites and network segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional defensive mechanisms are used to detect bots and anonymous proxies, then some level of detection capability is provided, but accuracy in distinguishing human and automated traffic is insufficient
Solution Approach 1:
The patent segments the detection process into multiple independent signal components (instrumented response patterns, newbie signals, DNS resolver usage) that are evaluated separately and then combined. This segmentation allows each component to be optimized independently while collectively providing robust bot detection capability that overcomes the limitations of traditional single-method approaches.
2Measurement precision
If multiple signal components are analyzed to improve detection accuracy, then bot identification capability is enhanced, but system complexity increases
Solution Approach 1:
The system divides complex bot detection into three manageable signal segments: instrumented response patterns, newbie signals, and DNS resolver usage. Each segment can be independently collected, processed, and weighted, reducing the complexity burden while maintaining high detection accuracy through their combined evaluation.
Solution Approach 2:
The patent creates a universal reputation scoring system that can evaluate multiple different signal types through a common framework. The detection engine uses a unified reputation score calculation that works across diverse signal components, making the system multi-functional without requiring separate complex analysis pipelines for each signal type.
3Reliability
If reputation scoring based on multiple signals is implemented, then security of cloud-based resources is enhanced, but computational resources and processing time increase
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing baseline reputation scores and signal patterns from historical data. When evaluating new requests, the system compares incoming signals against these pre-computed references, significantly reducing real-time processing requirements while maintaining security evaluation accuracy.
Solution Approach 2:
The patent implements partial action by selectively evaluating signal components based on request characteristics. Not all signal types are always processed for every request - the system can adjust which signals are collected and analyzed based on the specific context, reducing unnecessary computational overhead while maintaining adequate security coverage.
Data Source
AI summary
The technology disclosed relates to detection of anonymous proxies and bots making requests to a cloud based resource on the Internet, such as a web server or an App server. The technology can leverage one or more of: instrumentation of web pages that samples response times and other characteristics of communications by a requestor device over multiple network segments; lack of prior appearance of the requestor device across multiple, independently operated commercial web sites; and resolver usage by the requestor. These signals can be analyzed to score a requesting device's reputation. A location reported by a user device can be compared to a network characteristic determined location.