Low touch integration of a bot detection service in association with a content delivery network

Patent metadata

Field	Value
Publication number	US-11368483-B1
Application number	US-201916273216-A
Country	US
Kind code	B1
Filing date	Feb 12, 2019
Priority date	Feb 13, 2018
Publication date	Jun 21, 2022
Grant date	Jun 21, 2022

Abstract

A server interacts with a bot detection service to provide bot detection as a requesting client interacts with the server. In an asynchronous mode, the server injects into a page a data collection script configured to record interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data to the server. After the client receives the page, the sensor data is collected and forwarded to the server through a series of posts. The server forwards the posts to the detection service. During this data collection, the server also may receive a request from the client for a protected endpoint. When this occurs, and in a synchronous mode, the server issues a query to the detection service to obtain a threat score based in part on the collected sensor data that has been received and forwarded by the server. Based on the threat score returned, the server then determines whether the request for the endpoint should be forwarded onward for handling.

First claim

What is claimed is as follows:

1. A method to integrate bot detection in association with an overlay network customer environment, comprising:
receiving an overlay network customer configuration that includes identification of an endpoint to be protected against a bot attack;
as a page that includes a reference to the protected endpoint is returned to a requesting client, and in an asynchronous mode of operation, injecting into the page a reference to a data collection script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receiving and forwarding collected sensor data to a bot detection service;
responsive to intercepting a request for the endpoint, and in a synchronous mode of operation, issuing a query to the bot detection service to obtain a threat score associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determining based at least in part on the threat score received in response to the query whether the request for the endpoint should be forwarded onward for handling.

2. The method as described in claim 1 wherein the request for the endpoint is not forwarded upon a determination that the threat score is indicative of the requesting client being a bot.

3. The method as described in claim 1 wherein the query is issued while the requesting client continues to interact with the page locally.

4. The method as described in claim 1 wherein the page is associated with an overlay network customer workflow that involves collection of sensitive data.

5. The method as described in claim 4 wherein the workflow is one of: a checkout, a search and a login.

6. The method as described in claim 1 wherein the data collection script is injected into the page by including a JavaScript tag in a response body of the page.

7. The method as described in claim 1 further including enriching the collected sensor data prior to delivering the sensor data to the bot detection service.

8. The method as described in claim 1 wherein the collected sensor data is forwarded to the bot detection service continuously as the collected sensor data is received.

9. The method as described in claim 1 wherein the collected sensor data is delivered to the bot detection service via one or more JavaScript Object Notation (JSON)-formatted POST requests.

10. The method as described in claim 9 wherein a particular JSON-formatted POST request is associated with a behavioral action occurring locally at the requesting client.

11. The method as described in claim 1 wherein the query is issued to an Application Programming Interface (API) of the bot detection service.

12. The method as described in claim 11 wherein the collected sensor data is posted asynchronously to the bot detection service via the API.

13. Apparatus, comprising:
a hardware processor;
computer memory configured to hold computer program instructions executed by the hardware processor to integrate bot detection in association with an overlay network customer environment, the computer program instructions comprising program code configured to:
receive an overlay network customer configuration that includes identification of an endpoint to be protected against a bot attack;
as a page that includes a reference to the protected endpoint is returned to a requesting client, and in an asynchronous mode of operation, inject into the page a data collection script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receive and forward collected sensor data to a bot detection service;
responsive to intercepting a request for the endpoint, and in a synchronous mode of operation, issue a query to the bot detection service to obtain a threat score and other information associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determine based at least in part on the threat score whether the request for the endpoint should be forwarded onward for handling.

Assignees

• Akamai Tech Inc

Inventors

• Senecal David
• Bhurke Prajakta

Classifications

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title