Patent ID: 11956255
Assignee: RAPID7, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 18:
19. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors implement a cyberattack reporting system and cause the cyberattack reporting system to:
receive a dataset indicating observed actions of a plurality of clients on a service;
identify a subset of the clients as suspected attackers, wherein each suspected attacker is observed with one or more attack actions in the dataset that indicates an attempted attack on the service matching at least one of a set of attack patterns;
identify a subset of the attempted attacks as successful attacks, wherein each successful attack includes one or more benign actions in the dataset performed by a suspected attacker after the attempted attack of the suspected attacker, and the one or more benign actions does not match any of the set of attack patterns; and
generate a report of the successful attacks, wherein the report indicates the suspected attackers of each successful attack and information about the attack actions and the benign actions associated with each successful attack;
wherein the cyberattack reporting system is configured to determine that two web requests are issued by a same client based on one or more of:
a source IP address of the two web requests;
an identity tracking object associated with the two web requests;
a session identifier associated with the two web requests; and

one or more HTTP header attributes of the two web requests.