Methods for detecting malicious smart bots to improve network security and devices thereof

Patent metadata

Field	Value
Publication number	US-10270792-B1
Application number	US-201715404852-A
Country	US
Kind code	B1
Filing date	Jan 12, 2017
Priority date	Jan 21, 2016
Publication date	Apr 23, 2019
Grant date	Apr 23, 2019

Abstract

Methods, non-transitory computer readable media, security management apparatuses, and network traffic management systems that send a web page to a client device in response to a received request for a web resource. The web page comprises injected capability analysis client-side code that is configured to obtain and return capability data for a web browser identified in a user agent header of the request. A response comprising the returned capability data is received and the returned capability data is compared with expected capability data for the web browser identified in the user agent header of the request. A score is generated based at least in part on the comparison and a determination is made when the score exceeds an established threshold. The web resource is retrieved and provided to the client device, when the determining indicates that the score exceeds the established threshold.

First claim

What is claimed is:

1. A method for detecting malicious smart bots to improve network security implemented by a network traffic management system comprising one or more security management apparatuses, server devices, or client devices, the method comprising:
sending a web page to a client in response to a request for a web resource received from the client, wherein the web page comprises injected capability analysis client-side code that is configured to obtain and return capability data for a web browser identified in a user agent header of the request;
receiving a response from the client, the response comprising the returned capability data, and comparing capabilities of the web browser indicated in the returned capability data with stored expected capabilities of the web browser;
generating a score based at least in part on the comparison and determining when the score exceeds an established threshold; and
retrieving the web resource and providing the web resource to the client, when the determining indicates that the score exceeds the established threshold.

2. The method of claim 1 , further comprising blocking the request or performing a security check on the client, when the determining indicates that the score does not exceed the established threshold.

3. The method of claim 1 , further comprising:
determining when the request comprises an encrypted cookie and, when the determining indicates that the request comprises the encrypted cookie, determining when the encrypted cookie is valid;
retrieving and providing the web resource to the client without sending the web page to the client, receiving the response, generating the score, or determining when the score exceeds the established threshold, when the determining indicates that the encrypted cookie is valid; and
generating the encrypted cookie and providing the encrypted cookie to the client along with the web resource, when the determining indicates that the request does not comprise the encrypted cookie.

4. The method of claim 1 , wherein the score is generated based on a number or weight of matches between the capabilities of the web browser indicated in the returned capability data and the stored expected capabilities and the weight is based on a likelihood that one of the capabilities is associated with a malicious smart bot.

5. The method of claim 1 , further comprising sending an indication of the web resource along with the web page to the client, wherein the response further comprises the indication of the web resource and the web resource is retrieved using the indication of the web resource included in the response.

6. A security management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
send a web page to a client in response to a request for a web resource received from the client, wherein the web page comprises injected capability analysis client-side code that is configured to obtain and return capability data for a web browser identified in a user agent header of the request;
receive a response from the client, the response comprising the returned capability data, and comparing capabilities of the web browser indicated in the returned capability data with stored expected capabilities of the web browser;
generate a score based at least in part on the comparison and determine when the score exceeds an established threshold; and
retrieve the web resource and provide the web resource to the client, when the determining indicates that the score exceeds the established threshold.

7. The security management apparatus of claim 6 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to block the request or perform a security check on the client, when the determining indicates that the score does not exceed the established threshold.

8. The security management apparatus of claim 6 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:
determine when the request comprises an encrypted cookie and, when the determining indicates that the request comprises the encrypted cookie, determine when the encrypted cookie valid;
retrieve and provide the web resource to the client without sending the web page to the client, receiving the response, generating the score, or determining when the score exceeds the established threshold, when the determining indicates that the encrypted cookie is valid; and
generate the encrypted cookie and provide the encrypted cookie to the client along with the web resource, when the determining indicates that the request does not comprise the encrypted cookie.

9. The security management apparatus of claim 6 , wherein the score is generated based on a number or weight of matches between the capabilities of the web browser indicated in the returned capability data and the stored expected capabilities and the weight is based on a likelihood that one of the capabilities is associated with a malicious smart bot.

10. The security management apparatus of claim 6 , wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to send an indication of the web resource along with the web page to the client, wherein the response further comprises the indication of the web resource and the web resource is retrieved using the indication of the web resource included in the response.

11. A non-transitory computer readable medium having stored thereon instructions for detecting malicious smart bots to improve network security comprising executable code which when executed by one or more processors, causes the processors to:
send a web page to a client in response to a request for a web resource received from the client, wherein the web page comprises injected capability analysis client-side code that is configured to obtain and return capability data for a web browser identified in a user agent header of the request;
receive a response from the client, the response comprising the returned capability data, and comparing capabilities of the web browser indicated in the returned capability data with stored expected capabilities of the web browser;
generate a score based at least in part on the comparison and determine when the score exceeds an established threshold; and
retrieve the web resource and provide the web resource to the client, when the determining indicates that the score exceeds the established threshold.

12. The non-transitory computer readable medium of claim 11 , wherein the executable code, when executed by the one or more processors, further causes the one or more processors to block the request or perform a security check on the client, when the determining indicates that the score does not exceed the established threshold.

13. The non-transitory computer readable medium of claim 11 , wherein the executable code, when executed by the one or more processors, further causes the one or more processors to:
determine when the request comprises an encrypted cookie and, when the determining indicates that the request comprises the encrypted cookie, determine when the encrypted cookie valid;
retrieve and provide the web resource to the client without sending the web page to the client, receiving the response, generating the score, or determining when the score exceeds the established threshold, when the determining indicates that the encrypted cookie is valid; and
generate the encrypted cookie and provide the encrypted cookie to the client al

Assignees

• F5 Networks Inc

Inventors

• Shemesh Yaniv

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title