Edge Request Analysis for Detecting Malicious Client Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security solutions fail to effectively detect and mitigate attacks that target website functionality, such as content scraping and credential stuffing, beyond typical DDOS attacks by analyzing request volume alone.
Innovation Solution
Analyze session metrics and request attributes, including duration, request content-type distribution, and inter-request timings, using machine learning to generate a confidence value indicating malicious intent, and perform mitigation actions like blocking or challenging requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security solutions analyze only request volume and user agent fingerprints, then the solution is simple and fast, but it cannot effectively detect functional abuse attacks like content scraping and credential stuffing
Solution Approach 1:
The patent segments the request analysis into multiple independent components: request attributes (method, content-type, headers), session metrics (duration, inter-request timing, request count), and response characteristics. This segmentation allows each component to be analyzed separately and combined later, improving detection accuracy without requiring the entire system to be overly complex.
Solution Approach 2:
The patent transitions from two-dimensional analysis (request volume + user agent fingerprint) to multi-dimensional analysis by introducing session metrics dimension and request attribute dimension. This dimensional expansion enables detection of functional abuse patterns that were previously invisible to conventional two-dimensional approaches.
2Reliability
If the system analyzes multiple session metrics and request attributes to improve detection, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-defining the set of session metrics and request attributes to be analyzed, and pre-establishing the analysis framework. This allows the system to systematically process only the necessary dimensions without unnecessary computational overhead, balancing thoroughness with efficiency.
Solution Approach 2:
The patent dynamically adjusts analysis parameters based on the specific attack pattern being detected. Different weights and thresholds are applied to different session metrics and request attributes depending on the context, allowing the system to optimize processing time for each specific detection scenario rather than uniformly analyzing all parameters with equal intensity.
3Reliability
If the system blocks all requests with low confidence scores to be safe, then security improves, but legitimate traffic is also blocked reducing productivity
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors the effectiveness of blocking decisions and adjusts confidence score thresholds accordingly. This feedback loop allows the system to learn from actual traffic patterns and refine its blocking behavior, reducing false positives while maintaining security.
Solution Approach 2:
The patent makes the blocking threshold dynamic rather than static. The confidence score threshold can adjust based on the current security context, attack patterns detected, and historical data. This dynamic adjustment allows the system to be more aggressive when needed and more conservative when legitimate traffic patterns are detected, optimizing both security and productivity.
Data Source
AI summary
An edge server receives a plurality of requests from a client network application for actions to be performed on a resource that is hosted at an origin server. The edge server determines request attributes of the requests and associates the request attributes with a session identifying the client network application. The edge server generates a confidence value for the client network application based at least on the determined request attributes of the plurality of requests and computed session metrics of the session. When the confidence value indicates that the client network application is malicious, the edge server performs one or more mitigation actions.