Method and system of distinguishing between human and machine

Patent metadata

Field	Value
Publication number	US-9529999-B2
Application number	US-201414303530-A
Country	US
Kind code	B2
Filing date	Jun 12, 2014
Priority date	Jun 13, 2013
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

A method and a system of distinguishing between a human and a machine are disclosed. The method includes: when a request for accessing a designated network service is received, recording information of the request which include a time of receiving the request and information of an access object that sends the request; computing a statistical value of requests sent by the access object in real time based on a record; and determining the access object to be abnormal when the statistical value of the requests sent by the access object falls outside a predetermined normal range. The disclosed system of distinguishing between a human and a machine includes a recording module, a computation module and a determination module. Identification between humans and machines using the disclosed scheme is difficult to be cracked down and can improve an accuracy rate of human-machine identification.

First claim

What is claimed is:

1. A computer-implemented method, the method performed by one or more processors and a memory communicatively coupled with the one or more processors, the memory having instructions, which when executed cause the processors to perform the steps, comprising:
recording, when a request for accessing a designated network service is received, information of the request which includes a time of receiving the request and information of an access object that sends the request, the information of the access object including information of a terminal and the user associated with sending the request;
computing in real time a statistical value of requests sent by the access object based on a record, the statistical value of the requests includes statistical value of requests sent by the terminal and by the user;
determining that the access object is abnormal in response to the statistical value of the requests sent by the access object falling outside a predetermined normal range;
determining whether the access object is a user or a terminal; and
in response to determining that the access object is a terminal, isolating the terminal, refraining from receiving a request from the terminal, and stopping to compute the statistical value of the requests sent from the terminal upon determining that a number of anomalies associated with the terminal reaches a predetermined number of anomalies, M, wherein M=1 or M>1; or
in response to determining that the access object is a user, isolating the user, refraining from receiving a request from the user, and stopping to compute the statistical value of the requests sent from the user upon determining that a number of anomalies associated with the user reaches a predetermined number of anomalies, N, wherein N=1 or N>1.

2. The computer-implemented method of claim 1 , wherein:
the statistical value of the requests sent by the access object includes one or more request frequency values; and
the statistical value of the access object falls outside the predetermined normal range when a request frequency value thereof is greater than a corresponding request frequency threshold.

3. The computer-implemented method of claim 2 , wherein:
a request frequency value is represented as a number of requests sent within a time window that has a configured time duration, a time of receiving a most recent request sent from the access object being set as an end time of the time window; or the request frequency value is represented as a time duration used by a configured number of requests that are consecutively sent, and the configured number of requests includes the most recent request sent from the access object; and
the request frequency values correspond to different configured time durations or different configured numbers of times, and respective number-of-times thresholds or time duration thresholds are accordingly different.

4. The computer-implemented method of claim 1 , wherein in response to determining that the access object is a terminal:
the statistical value of the requests sent by the terminal includes a value for a frequency of user appearance and/or a value for a frequency of user switching obtained from an analysis of users who sent the requests via the terminal; and
the statistical value of the requests sent by the terminal falls outside the predetermined normal range when the value for the frequency of user appearance is greater than a first threshold for the frequency of user appearance, and/or the value for the frequency of user switching is greater than a second threshold for the frequency of user switching.

5. The computer-implemented method of claim 4 , wherein:
the value for the frequency of user appearance is represented as a number of different users who sent one or more requests via the terminal within a time window having a configured time duration, and the value for the frequency of user switching is represented as a number of times that the users who sent the one or more requests via the terminal are switched within the time window having the configured time duration, wherein an end time of the time window is a time of receiving a most recent request sent from the terminal.

6. The computer-implemented method of claim 1 , wherein in response to determining that the access object is a user:
the statistical value of the requests sent by the user further includes a value for a frequency of terminal appearance and/or a value for a frequency of terminal switching obtained from an analysis of terminals that are used by the user when sending the requests; and
the statistical value of the requests sent by the user falls outside the predetermined normal range when the value for the frequency of terminal appearance is greater than a first threshold for the frequency of terminal appearance and/or the value for the frequency of terminal switching is greater than a second threshold for the frequency of terminal switching.

7. The computer-implemented method of claim 6 , wherein:
the value for the frequency of terminal appearance is represented as a number of different terminals used by the user to send one or more requests within a time window that has a configured time duration; and the value for the frequency of terminal switching is represented as a number of times that the user switch the terminals to send a plurality of requests within the time window that has the configured time duration, wherein an end time of the time window is a time of receiving a most recent request sent by the user.

8. The computer-implemented method of claim 1 , wherein:
the statistical value of the requests sent by the access request includes a value for a time interval between consecutive requests sent by the access object; and
the statistical value falls outside the predetermined normal range when the value for the time interval is less than a corresponding time interval threshold.

9. The computer-implemented method of claim 8 , wherein:
the consecutive requests sent by the access object are classified into different types based on whether the consecutive requests are sent by a same access object and/or whether the consecutive requests correspond to requests for a same network service, wherein a time interval threshold is individually set up for each different type of consecutive requests.

10. The computer-implemented method of claim 1 , wherein:
upon determining the access object to be abnormal, if the access object has not been isolated, excluding request(s) sent from the access object prior to a current instance of anomaly when computing the statistical value of the requests sent from the access object in real time.

11. A system comprising:
one or more processors; and
a memory communicative coupled with the one or more processors, the memory having instructions, which when executed cause the processors to perform the acts, comprising:
recording, when a request for accessing a designated network service is received, information of the request which includes a time of receipt of the request and information of an access object that sends the request, the information of the access object including information of a terminal and a user associated with sending the request;
computing a statistical value of requests sent by the access object in real time based on a record, the statistical value of the requests includes statistical value of requests sent by the terminal and by the user;
determining the access object to be abnormal in response to the statistical value of the requests sent by the access object exceeding a predetermined normal range;
determining whether the access object is a user or a terminal; and
in response to determining that the a

Assignees

• Alibaba Group Holding Ltd

Inventors

• Fu Yingfang
• Zhang Yudong
• Zhang Zhenyuan
• Liu Jian

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L63/1458

  Denial of Service · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title