Automation discovery to identify malicious activity
First Claim
1. A method comprising:
- receiving, with an automation discovery system comprising a processor in communication with a network, potentially automated network traffic data comprising data associated with a plurality of network communications;
analyzing, with the automation discovery system, the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated, the analyzing comprising determining that a time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity by performing a statistical analysis to determine degrees of similarity between each time delta and each other time delta;
when the potentially automated network traffic data is determined to be unlikely to be automated based on the degrees of similarity between each time delta and each other time delta, generating, with the automation discovery system, a low automation confidence score associated with the potentially automated network traffic data; and
when the potentially automated network traffic data is determined to be likely to be automated based on the degrees of similarity between each time delta and each other time delta, generating, with the automation discovery system, a high automation confidence score associated with the potentially automated network traffic data, the high automation confidence score being higher than the low automation confidence score.
12 Assignments
0 Petitions
Accused Products
Abstract
Systems and methods may use automation discovery to identify malicious activity. An automation discovery system comprising a processor in communication with a network and in communication with a database may receive potentially automated network traffic data. The system may analyze the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated. When the potentially automated network traffic data is not likely to be automated, the system may generate a low automation confidence score associated with the potentially automated network traffic data. When the potentially automated network traffic data is likely to be automated, the system may generate a high automation confidence score associated with the potentially automated network traffic data.
199 Citations
24 Claims
-
1. A method comprising:
-
receiving, with an automation discovery system comprising a processor in communication with a network, potentially automated network traffic data comprising data associated with a plurality of network communications; analyzing, with the automation discovery system, the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated, the analyzing comprising determining that a time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity by performing a statistical analysis to determine degrees of similarity between each time delta and each other time delta; when the potentially automated network traffic data is determined to be unlikely to be automated based on the degrees of similarity between each time delta and each other time delta, generating, with the automation discovery system, a low automation confidence score associated with the potentially automated network traffic data; and when the potentially automated network traffic data is determined to be likely to be automated based on the degrees of similarity between each time delta and each other time delta, generating, with the automation discovery system, a high automation confidence score associated with the potentially automated network traffic data, the high automation confidence score being higher than the low automation confidence score. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A system comprising:
-
a database; and an automation discovery system comprising a processor in communication with a network and in communication with the database and a memory, the automation discovery system being constructed and arranged to; receive potentially automated network traffic data comprising data associated with a plurality of network communications; analyze the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated, the analyzing comprising determining that a time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity by performing a statistical analysis to determine degrees of similarity between each time delta and each other time delta; when the potentially automated network traffic data is determined to be unlikely to be automated based on the degrees of similarity between each time delta and each other time delta, generate a low automation confidence score associated with the potentially automated network traffic data; and when the potentially automated network traffic data is determined to be likely to be automated based on the degrees of similarity between each time delta and each other time delta, generate a high automation confidence score associated with the potentially automated network traffic data, the high automation confidence score being higher than the low automation confidence score. - View Dependent Claims (14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24)
-
Specification