This patent concerns novel technology for detection of zero-day data classes for domains with high-dimensional mixed continuous/discrete feature spaces, including Internet traffic. Assume there is a known-class database available for learning a null hypothesis that a given new batch of unlabeled data does not contain any data from unknown/anomalous classes. A novel and effective generalization of previous parsimonious mixture and topic modeling methods is developed. The novel unsupervised anomaly detector (AD) acts on a new unlabeled batch of data to either identify the statistically significant anomalous classes latently present therein or reject the alternative hypothesis that the new batch contains any anomalous classes. The present AD invention can be applied in an on-line setting. Labeling (by a human expert or by other means) of anomalous clusters provides new supervised data that can be used to adapt an actively learned classifier whose objective is to discriminate all the classes.

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as TLS fingerprinting. Preferably, TLS fingerprinting herein comprises combining different parameters from the initial Hello packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the TLS signature) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Service providers may operate one or more services configured to detect requests generated by automated agents. A CAPTCHA may be transmitted in response to requests generated by automated agents. The CAPTCHAs may be included in a modal pop-up box configured to be displayed by a client application displaying a webpage to a customer of the service provider. Furthermore, the CAPTCHAs included in the modal pop-up box may be rendered inactive and caused not to be displayed by client application executing the webpage. Submitted solutions to CAPTCHAs may be presented with a cookie that enables access to resources of the service provider without restriction. Cookies may be tracked and their use may be used to detect automated agent activity.

A computer system configured to improve security of server computers interacting with client computers, the system comprising: one or more processors executing instructions that cause the one or more processors to: select, from the plurality of detection tests, one or more first detection tests to be performed by a client computer; send, to the client computer, a first set of detection instructions that define the one or more first detection tests, and which when executed causes generating a first set of results that identifies a first set of characteristics of the client computer; receive the first set of results from the client computer; select one or more first countermeasures from a plurality of countermeasures based on the first set of characteristics identified in the first set of results; send, to the client computer, a first set of countermeasure instructions that define the one or more first countermeasures.

In one embodiment, a device in a network determines a first set of domain generation algorithm (DGA) predictions for a particular domain name by analyzing one or more extracted lexical features of the particular domain name using a first ensemble of decision trees. The device determines a second set of DGA predictions for the particular domain name by analyzing one or more extracted cluster features of a cluster of related domain names to which the particular domain name belongs using a second ensemble of decision trees. The device predicts a DGA associated with the particular domain name based on the first and second sets of DGA predictions. The device causes performance of a security action based on the predicted DGA associated with the particular domain.

Web Bot detection methods and systems are provided that receive a request, in connection with a network session. The methods and systems determine whether the request is associated with potential Bot activity, and based thereon assign a Bot confidence designation. The Bot confidence designation indicates a likelihood that the request represents an agent-based request. The methods and systems analyze a session trait of the network session relative to predetermined session traits indicative of human-based requests, and assign a human confidence designation based on the analysis. The human confidence designation indicates a likelihood that the request represents a human-based request. The request is then classified to represent an agent-based request or human-based request based on the Bot and human confidence designations.

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent (UHCA) may also be used to detect anomalous behavior.

A server computer system programmed to generate a first challenge credential to the client computer, that corresponds to a first response credential in a first challenge-response credential pair; render first dynamic-credential instructions causing the client to generate the first response credential; send the first challenge credential and the first dynamic-credential instructions, but not the first response credential; receive a request that includes a first test-challenge credential and a first test-response credential; determine whether the first test-challenge credential and the first test-response credential are the first challenge-response credential pair; if the first test-response credential is the first response credential, determine that a count is associated with the first challenge-response credential pair, and determine whether the count satisfies a first threshold; if the count does not satisfy the first threshold, determine that the first request is not a replay request and assign a second count to the first challenge-response credential pair.

Methods and systems to resolve a distributed denial of service (DDoS) attack in a wireless network are disclosed. In one embodiment, a method comprises receiving signaling messages along with samples of spurious traffic sourced from one or more end devices, where the one or more end devices connect to the wireless network for internet connectivity. The method continues with determining, based the samples, that there is a DDoS attack occurring in which a set of one or more of the end devices is acting as bots in a botnet, and are thus are infected end devices, and causing denial of radio resource allocation to the set of one or more of the infected end devices.

Various embodiments provide an approach to detect intrusion of connected IoT devices. In operation, features associated with behavioral attributes as well as volumetric attributes of network data patterns of different IoT devices is analyzed by means of statistical analysis to determine deviation from normal operation data traffic patterns to detect anomalous operations and possible intrusions. Data from multiple networks and devices is combined in the cloud to provide for improved base models for statistical analysis.