Method and system for uniquely identifying a user computer in real time for security violations using a plurality of processing parameters and servers

• US 9,444,839 B1
• Filed: 08/21/2008
• Issued: 09/13/2016
• Est. Priority Date: 10/17/2006
• Status: Expired due to Fees

• Current Assignee: Threatmetrix Incorporated (RELX PLC)
• Original Assignee: Threatmetrix Incorporated (RELX PLC)
• Inventors: Goldie, Colin, Faulkner, Alisdair, Jones, David
• Primary Examiner(s): RAHIM, MONJUR
• Application Number:
  US12/196,256
• Time in Patent Office: 2,945 Days
• Field of Search: 707/688, 726 22- 27, 709/203, 370/235
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A method is provided for identifying a compromised client device from a masquerading device. The method includes capturing a plurality of attributes from a network device connecting to a web service. In a specific embodiment, each of the attributes represents a parameter, and the plurality of parameters uniquely identifying the network device from a plurality of other networks devices. The method maintains the network device substantially free from any software programs associated with the capturing of the plurality of attributes. That is, in a specific embodiment, the method does not rely on installing executable code in the network device to capture the attributes. Based on information associated with the attributes, the method can determine if the network device is compromised.

Claims

1. A method for identifying a network device, the method comprising:

capturing, by a hardware processor of one or more servers, a plurality of attributes from the network device being connected to a web service, the plurality of attributes uniquely identifying the network device from a plurality of networks devices;

maintaining the network device free from any software programs associated with the capturing of the plurality of attributes;

determining, by the hardware processor, a device identifier based on a programmatic transformation of the plurality of attributes captured from the network device, wherein at least a subset of the plurality of attributes are related to one or more of ID information, network information, location information, device information, browser information, site information, or time information associated with the network device;

capturing, by the hardware processor, a plurality of second attributes from a second network device being connected to the web service;

determining, by the hardware processor, a second device identifier based on a programmatic transformation of the plurality of second attributes captured from the second network device;

determining, by the hardware processor, if the network device is compromised based on a comparison of the device identifier and the second device identifier; and

determining, by the hardware processor, a classification of the network device based on the device identifier.

2. The method of claim 1 further comprising using fuzzy logic to process the plurality of attributes.

3. The method of claim 1 wherein the ID information comprises one or more of Flash Cookie, first Party Browser Cookie, and third Party Browser Cookie.

4. The method of claim 1 wherein the network information comprises one or more IP Address, ISP, MTU, Connection Type, Connection Speed, Bogon Hijack Address, Static/Dynamic Address, Proxy Address, TCP Sequence Number, and other TCP header code.

5. The method of claim 1 wherein the location information comprises one or more of country, city, latitude, and longitude.

6. The method of claim 1 wherein the device information comprises one or more OS, Screen Resolution, Screen DPI, Start Time, Local Time, Clock-Offset, Clock-Dift, and Time Zone.

7. The method of claim 1 wherein the browser information comprises one or more of Language, Browser version, Browser string, Javascript major and minor versions, Flash major and minor versions, Browser plug-ins or extensions, and Supported MIME types.

8. The method of claim 1 wherein the site information comprises one or more domain, domain owner, session id, merchant id, URL, referrer, advertisement, ID, and campaign ID.

9. The method of claim 1 wherein the time information comprises one or more seconds, hour, day, week, and month.