Devices, systems, and methods of contextual mapping of web-page elements and other User Interface elements, for the purpose of differentiating between fraudulent transactions and legitimate transactions, or for the purpose of distinguishing between a fraudulent user and a legitimate user. User Interface elements of a website or webpage or application or other computerized service, are contextually analyzed. A first User Interface element is assigned a low fraud-relatedness score-value, since user engagement with the first User Interface element does not create a security risk or a monetary exposure. A second, different, User Interface element is assigned a high fraud-relatedness score-value, since user engagement with the second User Interface element creates a security risk or a monetary exposure. The fraud-relatedness score-values are taken into account, together with user-specific behavioral characteristics, in order to determine whether to generate a possible-fraud notification, or as part of generating a possible-fraud score for a particular set-of-operations.

A system and method for identifying botnets. The method includes determining a network event proximity based on collected network data, where the network data relates to at least one network device; determining time density of the network data; determining trend patterns of the network data; and determining, based on the network event proximity, time density, and trend patterns, when a botnet activity is present within the network data.

Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.

There are disclosed herein a technique for use in security. In at least one embodiment, the technique comprises receiving information relating to users and performing an affinity propagation clustering operation in connection with the information to identify a cluster of similar users. Further, the technique determines a risk in connection with a user in the cluster by comparing the user to one or more other users in the cluster. Still further, based on the risk in connection with the user, the technique controls access by the user to a computerized resource.

Certain aspects and features of the present disclosure relate to systems and methods for automatically classifying hosts in real-time. For instance, classifying hosts as bots, and subsequently mitigating or blocking traffic from the hosts classified as bots can be advantageous in real-time data exchange systems. In a real-time data exchange system, data can be exchanged between a server and a target host in real-time when the target host accesses a webpage. Inhibiting data communication between servers and hosts operated by bot scripts can reduce fraudulent activity. In some implementations, hosts can be automatically classified into various groups based at least in part on the data included in requests received from the hosts.

A technique to slow down or block creation of automated attack scripts uses a detector configured to discriminate whether particular attack-like activity is a true attack, or simply a hacker testing an automated attack script, and then permitting any such test script to continue working (attacking) the site, albeit on a limited basis. In this manner, the hacker receives an indication that his or her automated attack script is already working. Thereafter, when the detector later detects a launch of an actual attack based on or otherwise associated with the automated attack script (previously under test), the attack fails either because the script was not a working script in the first instance, or because information learned about the script is used to adjust the site as necessary to then prepare adequately for a true attack.

A method of detecting bots, preferably in an operating environment supported by a content delivery network (CDN) that comprises a shared infrastructure of distributed edge servers from which CDN customer content is delivered to requesting end users (clients). The method begins as clients interact with the edge servers. As such interactions occur, transaction data is collected. The transaction data is mined against a set of primitive or compound features sets to generate a database of information. In particular, preferably the database comprises one or more data structures, wherein a given data structure associates a feature value with its relative percentage occurrence across the collected transaction data. Thereafter, and upon receipt of a new transaction request, primitive or compound feature set data derived from the new transaction request are compared against the database. Based on the comparison, an end user client associated with the new transaction request is then characterized, e.g., as being associated with a human user, or a bot.

A data processing system, according to various embodiments, may receive a data subject access request that includes a request to delete personal data of a particular data subject, modify personal data of the data subject, and/or provide personal data of the data subject. At least partially in response to receiving the data subject access request, the system may determine whether the data subject access request was initiated by an automated source. At least partially in response to determining that the data subject access request was initiated by an automated source, the system may automatically take at least one action to have the data subject access request reinitiated by a human source. At least partially in response to determining that the data subject access request was initiated by a human, the system may automatically facilitate the fulfillment of the data subject access request.

One or more computing devices, systems, and/or methods for monitoring levels of activity of client devices using a cluster of servers having a decentralized network architecture are provided, where over-counting, which may be caused by an uneven distribution of requests transmitted by the client devices to the cluster of servers, may be mitigated. For example, a request may be received by a first server, of the cluster of servers, from a client device. A first counter value associated with a level of activity of the client device may be incremented by a first number. One or more data packets may be transmitted to one or more servers of the cluster of servers. Each data packet of the one or more data packets may comprise an instruction to increment a counter value associated with the client device by a second number, which may be different than the first number.

A method and system for detecting and mitigating a malicious bot is disclosed. Address information is obtained from a third-party threat intelligence provider, the address information corresponding to network traffic that has been identified as malicious network traffic. Network traffic originating on a networked device is inspected in search of packets that correspond to the obtained address information. A check is performed to determine if a given one of the searched packets corresponds to an address associated with the address information and, responsive to the check indicating that the given one of the searched packets corresponds to the address associated with the address information, a managed router service is configured to mitigate the malicious network traffic.