System and method for processing user interface events

• US 8,296,427 B2
• Filed: 11/02/2011
• Issued: 10/23/2012
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Suboti, LLC
• Inventors: Hauser, Robert R
• Primary Examiner(s): Gillis, Brian J
• Application Number:
  US13/287,274
• Publication Number:
  US 20120047257A1
• Time in Patent Office: 356 Days
• Field of Search: 709/206, 709/223, 709/224, 709/231, 726/22
• US Class Current: 709/224
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method to detect and prevent non-human interaction between a client and a web server invokes an effect to change the event generation behavior at the client. Subsequent event streams from the client to the server are analyzed to determine whether the event streams contain events corresponding to expected reactions of a human operator at the client to the effect. Indications of non-human behavior may invoke more direct human testing, for example using a dynamic CAPTCHA application, or may cause a termination of the client/URL interaction.

Claims

1. A method of processing an event stream, the method comprising:

receiving at least one event stream message;

recording an arrival time of the at least one event stream message;

determining whether a sampling function, which specifies times at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and

when it is determined that a client is using the sampling function, recording the at least one event stream message in a message stream buffer.

2. The method of claim 1, wherein determining whether the sampling function is being used further comprises:

determining that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.

3. The method of claim 1, wherein determining whether the sampling function is being used further comprises:

determining that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function;

setting a flag to indicate a failure to use the sampling function; and

recording at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to buffering the events of the at least one event stream message in the message stream buffer.

4. The method of claim 1, wherein determining whether the sampling function is being used further comprises:

determining whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.

5. The method of claim 4, further comprising:

determining the message rate of the buffered messages exceeds a message rate associated with the sampling function; and

setting a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.

6. The method of claim 5, wherein the message rate mismatch is indicative of a non-human interaction.

7. The method of claim 5, wherein the message rate mismatch is indicative of a malicious computer program attack.

8. An apparatus configured to process an event stream, the apparatus comprising:

a receiver that receives at least one event stream message;

a memory that records an arrival time of the at least one event stream message; and

a processor that;

determines whether a sampling function, which specifies times at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and

when it is determined that a client is using the sampling function, records the at least one event stream message in a message stream buffer.

9. The apparatus of claim 8, wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to determine that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.

10. The apparatus of claim 8, wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to

determine that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function,

set a flag to indicate a failure to use the sampling function, and

record at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to the events of the at least one event stream message being buffered in the message stream buffer.

11. The apparatus of claim 8, wherein the processor being configured to determine whether the sampling function is being used further comprises the processor being configured to determine whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.

12. The apparatus of claim 11, wherein the processor is further configured to determine whether the message rate of the buffered messages exceeds a message rate associated with the sampling function, and set a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.

13. The apparatus of claim 12, wherein the message rate mismatch is indicative of a non-human interaction.

14. The apparatus of claim 12, wherein the message rate mismatch is indicative of a malicious computer program attack.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform processing an event stream, the processor being further configured to perform:

receiving at least one event stream message;

recording an arrival time of the at least one event stream message;

determining whether a sampling function, which specifies time at which an event will be recorded, is being used to determine arrival times of corresponding events included in the at least one event stream message; and

when it is determined that a client is using the sampling function, recording the at least one event stream message in a message stream buffer.

16. The non-transitory computer readable storage medium of claim 15, wherein determining whether the sampling function is being used further comprises:

determining that a corresponding timestamp for at least one event matches a valid sample time determined by the sampling function.

17. The non-transitory computer readable storage medium of claim 15, wherein determining whether the sampling function is being used further comprises:

determining that a corresponding timestamp for at least one event does not match a valid sample time provided by the sampling function;

setting a flag to indicate a failure to use the sampling function; and

recording at least one of the corresponding timestamp for the event and the arrival time of the event stream message prior to buffering the events of the at least one event stream message in the message stream buffer.

18. The non-transitory computer readable storage medium of claim 15, wherein determining whether the sampling function is being used further comprises:

determining whether a message rate of the messages in the message stream buffer match a message rate specified by a sampling function, the message rate based on a timestamp analysis of the received event stream messages.

19. The non-transitory computer readable storage medium of claim 18, wherein the processor is further configured to perform:

determining the message rate of the buffered messages exceeds a message rate associated with the sampling function; and

setting a flag for each of the events analyzed in the event stream message to indicate a message rate mismatch.

20. The non-transitory computer readable storage medium of claim 19, wherein the message rate mismatch is indicative of a non-human interaction.