Method and system to detect and interrupt a robot data aggregator ability to access a website

• US 9,762,597 B2
• Filed: 08/26/2015
• Issued: 09/12/2017
• Est. Priority Date: 08/26/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Doganata, Yurdaer N., Luna, David Corbalan, Mestre, Jordi Cahue, Noguera Pages, Francisco Javier
• Primary Examiner(s): DOAN, TRANG T
• Application Number:
  US14/836,341
• Publication Number:
  US 20170063881A1
• Time in Patent Office: 748 Days
• Field of Search: None
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information processing system, a computer readable storage medium, and a method to detect and block a robot data aggregator from accessing a website. A method includes defining a set of important features of business operations associated with users using a website. A feature value for each important feature is extracted from collected session data of a user session using the website. A user classifier classifies the user session as being with a human user or a robot user. Based on the classifying, access to the website by a robot user is blocked. Training user session data is also generated from the collected user session data thereby the user classifier learns and improves accuracy and reliability in detecting the type of user in a user session.

Claims

1. A computer-based method to block a robot data aggregator from accessing a website, the method comprising:

analyzing business operations and session data associated with using a website, the session data being collected from a session history log of user sessions, including human user sessions and robot user sessions, that use the business operations while accessing and/or navigating the website;

defining, based on the analyzing, a set of important features of the collected session data from the user sessions, a feature value for each feature in the set of important features being extractable from each user session;

extracting a feature value for each feature in the set of important features from the session data collected from each user session;

classifying the session data collected from each user session as being with a human user or a robot user;

generating training user session data, the training user session data comprising;

collected session data from each user session in the session history log;

extracted feature values from the collected session data from each user session; and

a classifier flag value indicating that the extracted feature values are from a user session with a human user or a robot user;

training a user classifier builder with the training user session data to build a user classifier including a model of behaviors of important business operations using the website, the model being based on the training user session data and including a set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user, and to discriminate a user session with a human user from a user session with a robot user; and

blocking access to the website by a robot user that has been determined, from user session data monitored from a user session, to have accessed and/or navigated business operations while using the website.

2. The method of claim 1, further comprising storing the training user session data in a training user session data repository in a memory.

3. The method of claim 1, wherein the model of the user classifier comprises at least one of

a logistic regression model;

and

a decision tree model.

4. The method of claim 1, wherein the website is a financial institution website and the business operations associated with using the website comprise banking operations invoked by users of the financial institution website during user sessions while online accessing and/or navigating the financial institution website.

5. A method, with an information processing system, to discriminate and block a robot data aggregator from accessing a website, the method comprising:

defining a set of important features of business operations and session data associated with using a website, the session data being collected from user sessions, including human user sessions and robot user sessions, that use the business operations while accessing and/or navigating the website, a feature value for each feature in the set of important features being extractable from each user session;

monitoring user sessions that use the business operations while accessing and/or navigating the website, and collecting user session data from each user session;

extracting a feature value for each feature in the set of important features from the session data collected from a user session;

classifying with a user classifier the session data collected from each user session as being with a human user or a robot user, the user classifier comprising a model of behaviors of important business operations using the website based on training user session data that is stored in a training user session data repository in a memory, the model including a set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user;

blocking, based on the classifying, access to the website by a robot user that has been determined from the collected user session data to have accessed and/or navigated business operations while using the website; and

generating, based on the classifying, training user session data from the collected user session data, the training user session data comprising;

collected session data from the user session;

extracted feature values from the collected session data; and

a classifier flag value, assigned to the extracted feature values by the user classifier, indicating that the extracted feature values are from a user session with a human user or a robot user.

6. The method of claim 5, further comprising updating training user session data stored in a training user session data repository in a memory with the generated training user session data resulting in updated training user session data being stored in the training user session data repository.

7. The method of claim 6, further comprising:

training a user classifier builder with the updated training user session data stored in the training user session data repository to build a replacement model of behaviors of important business operations using the website, the replacement model being based on the updated training user session data stored in the training user session data repository and including a replacement set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user, and to discriminate a user session with a human user from a user session with a robot user; and

replacing in the user classifier the model and the set of decision rules with the replacement model and the replacement set of decision rules, respectively.

8. The method of claim 5, wherein the model of the user classifier comprises a predictive model including at least one of

a logistic regression model;

and

a decision tree model.

9. The method of claim 5, wherein the website is a financial institution website and the business operations associated with using the website comprise banking operations invoked by users of the financial institution website during user sessions while online accessing and/or navigating the financial institution website.

10. A website information processing system comprising:

memory;

a network interface for interfacing the website information processing system with one or more web communication networks;

a web server for providing business operations to users of a website while accessing and/or navigating the website during user sessions;

a user classifier for classifying users of the website as either human users or robot users; and

a processor, communicatively coupled with the memory, the network interface, the web server, and the user classifier, the processor, responsive to computer instructions, performing a method to block a robot data aggregator from accessing the website, the method comprising;

defining a set of important features of business operations and session data associated with using the website, the session data being collected from user sessions, including human user sessions and robot user sessions, that use the business operations while accessing and/or navigating the website, a feature value for each feature in the set of important features being extractable from each user session;

monitoring user sessions that use the business operations while accessing and/or navigating the website, and collecting user session data from each user session;

extracting a feature value for each feature in the set of important features from the session data collected from a user session;

classifying with the user classifier the session data collected from each user session as being with a human user or a robot user, the user classifier comprising a model of behaviors of important business operations using the website based on training user session data that is stored in a training user session data repository in the memory, the model including a set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user;

blocking, based on the classifying, access to the website by a robot user that has been determined from the collected user session data to have accessed and/or navigated business operations while using the website; and

generating, based on the classifying, training user session data from the collected user session data, the training user session data comprising;

collected session data from the user session;

extracted feature values from the collected session data; and

a classifier flag value, assigned to the extracted feature values by the user classifier, indicating that the extracted feature values are from a user session with a human user or a robot user.

11. The system of claim 10, wherein the processor, responsive to computer instructions, performs the following:

updating training user session data stored in a training user session data repository in the memory with the generated training user session data resulting in updated training user session data being stored in the training user session data repository.

12. The system of claim 11, wherein the processor, responsive to computer instructions, performs the following:

training a user classifier builder with the updated training user session data stored in the training user session data repository to build a replacement model of behaviors of important business operations using the website, the replacement model being based on the updated training user session data stored in the training user session data repository and including a replacement set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user, and to discriminate a user session with a human user from a user session with a robot user; and

replacing in the user classifier the model and the set of decision rules with the replacement model and the replacement set of decision rules, respectively.

13. The system of claim 10, wherein the model of the user classifier comprises a predictive model including at least one of

a logistic regression model;

and

a decision tree model.

14. The system of claim 10, wherein the website is a financial institution website and the business operations associated with using the website comprise banking operations invoked by users of the financial institution website during user sessions while online accessing and/or navigating the financial institution website.

15. A non-transitory computer readable storage medium, comprising computer instructions which, responsive to being executed by a processor, cause the processor to perform operations to block a robot data aggregator from accessing a website, the operations comprising:

defining a set of important features of business operations and session data associated with using a website, the session data being collected from user sessions, including human user sessions and robot user sessions, that use the business operations while accessing and/or navigating the website, a feature value for each feature in the set of important features being extractable from each user session;

monitoring user sessions that use the business operations while accessing and/or navigating the website, and collecting user session data from each user session;

extracting a feature value for each feature in the set of important features from the session data collected from a user session;

classifying with a user classifier the session data collected from each user session as being with a human user or a robot user, the user classifier comprising a model of behaviors of important business operations using the website based on training user session data that is stored in a training user session data repository in a memory, the model including a set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user;

blocking, based on the classifying, access to the website by a robot user that has been determined from the collected user session data to have accessed and/or navigated business operations while using the website; and

generating, based on the classifying, training user session data from the collected user session data, the training user session data comprising;

collected session data from the user session;

extracted feature values from the collected session data; and

a classifier flag value, assigned to the extracted feature values by the user classifier, indicating that the extracted feature values are from a user session with a human user or a robot user.

16. The non-transitory computer readable storage medium of claim 15, wherein the processor performed operations further comprising:

updating training user session data stored in a training user session data repository in a memory with the generated training user session data resulting in updated training user session data being stored in the training user session data repository.

17. The non-transitory computer readable storage medium of claim 16, wherein the processor performed operations further comprising:

training a user classifier builder with the updated training user session data stored in the training user session data repository to build a replacement model of behaviors of important business operations using the website, the replacement model being based on the updated training user session data stored in the training user session data repository and including a replacement set of decision rules that the user classifier follows to determine a type of user of a user session as either a human user or a robot user, and to discriminate a user session with a human user from a user session with a robot user; and

replacing in the user classifier the model and the set of decision rules with the replacement model and the replacement set of decision rules, respectively.

18. The non-transitory computer readable storage medium of claim 17, wherein the replacement model of the user classifier comprises a predictive model including at least one of

a logistic regression model;

and

a decision tree model.