Low touch integration of a bot detection service in association with a content delivery network

Patent metadata

Field	Value
Publication number	US-12101350-B2
Application number	US-202217844431-A
Country	US
Kind code	B2
Filing date	Jun 20, 2022
Priority date	Feb 13, 2018
Publication date	Sep 24, 2024
Grant date	Sep 24, 2024

Abstract

A server interacts with a bot detection service to provide bot detection as a requesting client interacts with the server. In an asynchronous mode, the server injects into a page a data collection script configured to record interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data to the server. After the client receives the page, the sensor data is collected and forwarded to the server through a series of posts. The server forwards the posts to the detection service. During this data collection, the server also may receive a request from the client for a protected endpoint. When this occurs, and in a synchronous mode, the server issues a query to the detection service to obtain a threat score based in part on the collected sensor data that has been received and forwarded by the server. Based on the threat score returned, the server then determines whether the request for the endpoint should be forwarded onward for handling.

First claim

What is claimed is as follows:

1. A method to integrate a detection operation in association with an overlay network customer environment, comprising:
as a page that includes a reference to a protected endpoint is returned to a requesting client, and in a first mode of operation, injecting into the page a reference to a script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receiving and forwarding collected sensor data to a detection service;
responsive to intercepting a request for the endpoint, and in a second mode of operation, issuing a query to the detection service to obtain a threat score associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determining based at least in part on the threat score received in response to the query whether the request for the endpoint should be forwarded onward for handling.

2. The method as described in claim 1 wherein the request for the endpoint is not forwarded upon a determination that the threat score is indicative of the requesting client being a bot.

3. The method as described in claim 1 wherein the query is issued while the requesting client continues to interact with the page locally.

4. The method as described in claim 1 wherein the page is associated with an overlay network customer workflow that involves collection of sensitive data.

5. The method as described in claim 1 wherein the data collection script is injected into the page by including a script tag in a response body of the page.

6. The method as described in claim 1 further including enriching the collected sensor data prior to delivering the sensor data to the detection service.

7. The method as described in claim 1 wherein the collected sensor data is forwarded to the detection service continuously as the collected sensor data is received.

8. The method as described in claim 1 wherein the collected sensor data is posted to the detection service asynchronously.

9. The method as described in claim 1 further including forwarding the request for the endpoint onward to an origin server associated with the overlay network customer environment.

10. The method as described in claim 9 wherein the injecting, receiving and forwarding, issuing a query and determining operations occur at a server associated with the overlay network, the server located between the requesting client and the origin server associated with the overlay network customer environment.

Assignees

• Akamai Tech Inc

Inventors

• Senecal David
• Bhurke Prajakta

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title