×

User behavior analyzer

  • US 9,529,777 B2
  • Filed: 10/26/2012
  • Issued: 12/27/2016
  • Est. Priority Date: 10/28/2011
  • Status: Active Grant
First Claim
Patent Images

1. A method for identifying abnormal client behavior with respect to communications between one or more servers and one or more client devices communicatively coupled to said one or more servers, the method comprising:

  • receiving a plurality of messages at a server from a plurality of client devices communicatively coupled to the server;

    grouping the plurality of messages into subsets of messages using a learn module of said server, with each subset of messages associated with a unique client identifier and with all messages within a subset being associated with the same unique client identifier;

    identifying each message within a subset of messages as belonging to a defined type of message;

    recording sequences of said defined types of messages within each of said subsets of messages using said learn module;

    measuring time intervals between said defined types of messages using said learn module;

    generating a state machine configured to model communications designated as constituting normal client behavior for defined types of messages, wherein the state machine comprises a determined order of a sequence of states and transitions configured based, at least in part, on the recorded sequences of defined types of messages and the measured time intervals between said defined types of messages that constitute normal client behavior;

    constructing a sequence of defined types of messages received from a client device using a detect module of said server;

    comparing the constructed sequence of defined types of messages to the state machine;

    calculating any differences between the constructed sequence and the state machine, wherein the differences are based, at least in part, on whether an order of the constructed sequence deviates from the determined order of the sequence of the state machine; and

    in response to a determination that the constructed sequence differs from the state machine by more than a predetermined value or range of values, generating an output designating a constructed sequence as abnormal client behavior.

View all claims
  • 2 Assignments
Timeline View
Assignment View
    ×
    ×