Network Bot Detection via Behavioral Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems (IDS) are unable to effectively detect and respond to malicious automated software agents that perform attacks at the application layer of computer networks, such as denial of service (DoS) attacks and click fraud, as they rely on pattern matching and are not equipped to differentiate between normal user behavior and bot-like activity.
Innovation Solution
A network interface and method that analyze protocols across layers three to seven to compute metrics for network sessions, calculating scores to determine if a session is representative of normal user behavior or malicious automated software agents, with an aggregate score exceeding a threshold indicating a malicious session, triggering a programmed response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional IDS uses pattern matching to detect network attacks, then it can detect defined attack patterns, but it cannot differentiate between normal user behavior and bot-like activity at the application layer
Solution Approach 1:
The patent changes the detection parameters from simple pattern matching to multiple behavioral metrics including request rate, time between requests, diversity of requested URLs, and cookie handling behavior. These parameter changes enable the system to distinguish between normal users and bots by analyzing behavioral patterns rather than just matching attack signatures.
Solution Approach 2:
The patent adds new dimensions to the detection process by analyzing application-layer protocol behavior and multiple behavioral metrics simultaneously. This multi-dimensional approach includes examining request timing, URL diversity, cookie management, and other behavioral characteristics that normal users exhibit but bots do not, thereby enhancing detection capability beyond traditional pattern matching.
2Reliability
If IDS attempts to identify software application and protocol types to improve detection probability, then it can select appropriate patterns, but it increases system complexity
Solution Approach 1:
The patent segments the detection process into distinct modules: protocol identification module, metric calculation module, and anomaly detection module. Each module handles a specific aspect of the detection process, making the overall system more manageable and maintainable while improving reliability through specialized functionality in each segment.
Solution Approach 2:
The patent creates a universal detection framework that can handle multiple protocols and application types through a single multi-functional system. The protocol identification and metric calculation mechanisms work across different application layers, reducing the need for separate detection systems for each protocol type while maintaining high detection reliability.
3Measurement precision
If multiple metrics are calculated and aggregated to determine malicious activity, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent implements a tiered metric calculation approach where critical metrics are calculated for all sessions, while more computationally intensive metrics are calculated only when preliminary indicators suggest potential malicious activity. This partial action approach maintains high detection accuracy for suspicious sessions while reducing processing time for normal traffic.
Solution Approach 2:
The system uses feedback mechanisms where initial metric calculations inform subsequent analysis depth. Sessions showing normal behavioral patterns receive minimal processing, while sessions with anomalous metrics trigger more comprehensive multi-metric analysis, optimizing the balance between detection accuracy and processing time through adaptive resource allocation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure describes techniques for determining whether a network session originates from an automated software agent. In one example, a network device, such as a router, includes a network interface to receive packets of a network session, a bot detection module to calculate a plurality of scores for network session data based on a plurality of metrics, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, to produce an aggregate score from an aggregate of the plurality of scores, and to determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold, and an attack detection module to perform a programmed response when the network session is determined to be originated by an automated software agent. Each score represents a likelihood that the network session is originated by an automated software agent.