System and method for bot detection and classification

Patent metadata

Field	Value
Publication number	US-11258860-B2
Application number	US-201916726529-A
Country	US
Kind code	B2
Filing date	Dec 24, 2019
Priority date	Dec 24, 2019
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

A computing system includes a server. The server is communicatively coupled to a data repository and is configured to store a data in the data repository. The server is further configured to create a server instance, wherein the server instance is associated with a user. The server is additionally configured to create a session based on an external entity requesting a resource from the server instance, and to execute a bot detection logic to determine if the external entity is a bot. If the external entity is a bot then the server is configured to perform a bot-based action, wherein the server is configured to provide for multi-instance support to a plurality of users.

First claim

The invention claimed is:

1. A computing system, comprising:
at least one memory storing instructions; and
one or more processors configured to execute the instructions to perform operations of a server communicatively coupled to a data repository and configured to store data in the data repository and provide for multi-instance support to a plurality of users, wherein the server is configured to:
create a server instance associated with a user;

create a session based on an external entity requesting a resource from the server instance; and
execute a bot detection logic configured to determine whether the external entity is a bot, classify a type of the bot, and set a Boolean attribute to an initial value of false when bot detection is enabled, wherein the Boolean attribute indicates if the session has been processed for the bot detection, wherein the bot detection logic comprises:
a listener configured to continuously execute during the session in a background process; and
a bot detection manager configured to detect whether the external entity is the bot, wherein the listener is configured to asynchronously initiate the bot detection manager in response to determining that the Boolean attribute is set to false; and
in response to determining that the external entity is the bot, perform a bot-based action.

2. The computing system of claim 1 , wherein the bot detection logic is configured to check a global session property to determine when the bot detection is enabled, and wherein the bot comprises a web crawler configured to automatically browse one or more web pages.

3. The computing system of claim 1 , wherein requesting the resource comprises transmitting a user agent string, wherein the bot detection manager is configured to detect whether the external entity is the bot based on the user agent string, an IP address of the transmitted user agent string, or a combination thereof.

4. The computing system of claim 1 , wherein the bot detection manager is configured to detect whether the external entity is the bot based on a cached list comprising a plurality of user agent strings, a plurality of IP addresses, or a combination thereof.

5. The computing system of claim 1 , wherein the server is configured to execute the bot detection logic only once after creating the session.

6. The computing system of claim 1 , wherein the server instance is owned by the user and wherein the server is configured to create a plurality of server instances also owned by the user based on a plurality of resource requests.

7. The computing system of claim 1 , wherein the bot-based action comprises providing the requested resource to the external entity and not updating a billing account belonging to the user only when the bot is classified as an approved bot.

8. A method, comprising:
creating, via a server communicatively coupled to a data repository and configured to store a data in the data repository and provide for multi-instance support to a plurality of users, a server instance, wherein the server instance is associated with a user;
creating a session based on an external entity requesting a resource from the server instance;
executing a bot detection logic to determine whether the external entity is a bot, classify a type of the bot, and set a Boolean attribute to an initial value of false when bot detection is enabled, wherein the Boolean attribute indicates if the session has been processed for the bot detection, wherein the bot detection logic comprises;
a listener configured to continuously execute during the session in a background process; and
a bot detection manager configured to detect whether the external entity is the bot, wherein the listener is configured to asynchronously initiate the bot detection manager in response to determining that the Boolean attribute is set to false; and
in response to determining that the external entity is the bot, performing a bot-based action.

9. The method of claim 8 , comprising checking a global session property to determine when the bot detection is enabled, and wherein the bot comprises a web crawler configured to automatically browse one or more web pages.

10. The method of claim 8 , wherein the bot detection manager is configured to detect whether the external entity is the bot based on a cached list comprising a plurality of user agent strings, a plurality of IP addresses, or a combination thereof.

11. The method of claim 8 , wherein requesting the resource comprises transmitting a user agent string, wherein the bot detection manager is configured to detect whether the external entity is the bot based on the user agent string.

12. The method of claim 8 , comprising executing the bot detection logic only once during the session.

13. A non-transitory, computer-readable medium storing instructions executable by one or more processors of a computing system, wherein, when executed by the one or more processors, the instructions cause the one or more processors to:
create, via a server communicatively coupled to a data repository and configured to store a data in the data repository and provide for multi-instance support to a plurality of users, a server instance, wherein the server instance is associated with a user;
create a session based on an external entity requesting a resource from the server instance;
execute a bot detection logic configured to determine whether the external entity is a bot, to classify a type of the bot, and to set a Boolean attribute to an initial value of false when bot detection is enabled, wherein the Boolean attribute indicates if the session has been processed for the bot detection, wherein the bot detection logic comprises;
a listener configured to continuously execute during the session in a background process; and
a bot detection manager configured to detect whether the external entity is the bot, wherein the listener is configured to asynchronously initiate the bot detection manager in response to determining that the Boolean attribute is set to false; and
in response to determining that the external entity is the bot, perform a bot-based action.

14. The computer-readable medium of claim 13 , wherein the instructions cause the one or more processors to check a global session property to determine if the bot detection is enabled.

15. The computer-readable medium of claim 13 , wherein the bot detection manager is configured to detect whether the external entity is the bot based on a cached list comprising a plurality of user agent strings, a plurality of IP addresses, or a combination thereof.

16. The computer-readable medium of claim 13 , comprising instructions configured to execute the bot detection logic only once after creating the session to determine if the external entity is the bot.

Assignees

• Servicenow Inc

Inventors

• Syed Jaheen Afsar
• Mishra Prabhat
• Teketi Ramola Raj

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title