Systems and methods of classifying sessions

• US 9,288,124 B1
• Filed: 04/01/2013
• Issued: 03/15/2016
• Est. Priority Date: 06/05/2008
• Status: Active Grant

• Current Assignee: A9.com Incorporated (Amazon.com, Inc.)
• Original Assignee: A9.com Incorporated (Amazon.com, Inc.)
• Inventors: Krynski, Tevye Rachelson
• Primary Examiner(s): Jhaveri, Jayesh
• Application Number:
  US13/854,922
• Time in Patent Office: 1,079 Days
• Field of Search: 726/4, 726/5, 726/17, 726/22, 726/23, 726 27- 30
• US Class Current: 1/1
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Systems and methods of classifying sessions are disclosed. A particular method monitors user activity at one or more servers accessible via a network and capturing event entries in an activity log for user activity that is detected. The event entries include descriptive information regarding a user action, a client identifier and a session identifier. The method also includes attempting to classify sessions associated with a plurality of event entries of the activity log as legitimate use or illegitimate use of resources of the one or more servers. The method further includes identifying unclassified sessions. The method also includes determining a count of a number of unclassified sessions associated with a particular client identifier and determining a total number of sessions associated with the particular client identifier. The method further includes classifying the unclassified sessions as legitimate use or illegitimate use of the resources of the one or more servers.

Claims

1. A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, cause the computing system to:

detect a plurality of communication sessions associated with user activity;

obtain information about the plurality of communication sessions, the information including at least one of a client identifier for individual sessions in the plurality of communication sessions, a session identifier for individual sessions in the plurality of communication sessions, or a session type for individual sessions in the plurality of communication sessions;

perform a comparison of the information about the plurality of communication sessions to data included in a sessions model, the data indicating session characteristics corresponding to at least one of human activity or automated activity;

attempt to classify individual sessions of the plurality of communication sessions as corresponding to human activity or to automated activity based, at least in part, on the comparison of the information to the data;

identify, in response to the attempt to classify individual sessions as corresponding to human activity or to automated activity, one or more individual unclassified sessions that are unable to be classified as corresponding to human activity or automated activity based, at least in part, on the comparison of the information to the data;

obtain information about a respective client identifier for the individual unclassified sessions previously identified, the information including a quantity of other unclassified sessions associated with the respective client identifier and a quantity of total sessions associated with the respective client identifier; and

classify the individual unclassified sessions previously identified based, at least in part, on the quantity of other unclassified sessions relative to the quantity of total sessions.

2. The non-transitory computer-readable storage medium of claim 1, wherein the instructions further cause the computing system to:

perform a probabilistic analysis of one or more historical logs associated with the user activity; and

generate the data included in the sessions model based, at least in part, on the probabilistic analysis.

3. The non-transitory computer-readable storage medium of claim 1, wherein the instructions further cause the computing system to:

obtain one or more classification statistics relating to the plurality of communication sessions; and

modify the data included in the sessions model based, at least in part, on the one or more classification statistics.

4. The non-transitory computer-readable storage medium of claim 1, wherein the data included in the sessions model indicates that sessions associated with a purchase transaction have a likelihood of corresponding to human activity, and wherein attempting to classify individual sessions further comprises:

determining, based at least in part on the information about the plurality of communication sessions, whether individual sessions are associated with a purchase transaction.

5. The non-transitory computer-readable storage medium of claim 1, wherein the data included in the sessions model indicates that sessions associated with activity occurring at a rate above a specified threshold have a likelihood of corresponding to automated activity, and wherein attempting to classify individual sessions further comprises:

determining, based at least in part on the information about the plurality of communication sessions, whether individual sessions are associated with respective activity that occurs at a respective rate above a specified threshold.

6. The non-transitory computer-readable storage medium of claim 1, wherein the sessions model corresponds to a probability model including at least a first probability that a first session type is associated with human activity and at least a second probability that a second session type is associated with automated activity.

7. The non-transitory computer-readable storage medium of claim 1, wherein the human activity is associated with legitimate activity, and wherein the automated activity is associated with illegitimate activity.

8. A computer-implemented method performed by a network monitor comprising:

under control of one or more computer systems configured with executable instructions,

detecting an event associated with user activity in a communication session at a networked computing system;

obtaining information about the event from an activity log having event entries, the information including at least one of a client identifier associated with the event, an event identifier for the event, or information about an event type corresponding to the event;

performing a comparison of the information about the event to data included in a sessions model, the data included in the sessions model indicating event characteristics having a likelihood of corresponding to at least one of human activity or automated activity;

performing an attempt to classify the event as corresponding to human activity or automated activity based, at least in part, on the comparison of the information about the event to the data included in the sessions model;

identifying the event as being an unclassified event as a result of the attempt to classify the event being unsuccessful; and

classifying the unclassified event based, at least in part, on information about the client identifier associated with the event by;

determining a quantity of other unclassified events associated with the client identifier;

determining a quantity of total events associated with the client identifier; and

classifying the unclassified event based, at least in part, on the quantity of other unclassified events and the quantity of total events.

9. The computer-implemented method of claim 8, further comprising:

obtaining historical data associated with the user activity; and

generating the sessions model based, at least in part, on the historical data.

10. The computer-implemented method of claim 8, further comprising:

obtaining classification data associated with the event; and

modifying the sessions model based, at least in part, on the classification data associated with the event.

11. The computer-implemented method of claim 8, wherein the sessions model corresponds to a probability model including at least a first probability that a first event type is associated with legitimate activity and at least a second probability that a second event type is associated with illegitimate activity.

12. The computer-implemented method of claim 8, wherein the client identifier includes at least one of a user identifier or a network address.

13. The computer-implemented method of claim 8, wherein the sessions model is associated with a cookie file.

14. A system comprising:

at least one processor; and

a memory device including instructions that, when executed by the at least one processor, cause the system to;

detect an event associated with user activity in a communication session at a networked computing system;

obtain information about the event from an activity log having event entries, the information including at least one of a client identifier associated with the event, an event identifier for the event, or information about an event type corresponding to the event;

perform a comparison of the information about the event to data included in a sessions model, the data included in the sessions model indicating event characteristics having a likelihood of being associated with human activity or automated activity;

perform an attempt to classify the event as being associated with human activity or automated activity based, at least in part, on the comparison of the information about the event to the data included in the sessions model;

identify the event as being an unclassified event as a result of the attempt to classify the event being unsuccessful; and

classify the unclassified event based, at least in part, on information about the client identifier associated with the event by causing the system to further;

determine a quantity of other unclassified events associated with the client identifier;

determine a quantity of total events associated with the client identifier; and

classify the unclassified event based, at least in part, on the quantity of other unclassified events and the quantity of total events.

15. The system of claim 14, wherein the instructions further cause the computing system to:

obtain historical data associated with the user activity; and

generate the sessions model based, at least in part, on the historical data.

16. The system of claim 14, wherein the instructions further cause the computing system to:

obtain classification data associated with the event; and

modify the sessions model based, at least in part, on the classification data associated with the event.

17. The system of claim 14, further comprising:

an activity log configured to store information relating to the event associated with the user activity.

18. The system of claim 14, wherein the event associated with the user activity includes a purchase transaction, and wherein the instructions cause the computing system to further:

communicate with an electronic marketplace to process the purchase transaction.

19. The system of claim 14, further comprising:

a search engine configured to provide search results, wherein the event associated with the user activity includes a search performed via the search engine.