Patent ID: 9699042
Date: 2017-07-04
CPC Classifications: G06F,G06Q,H04L

Claim:
1. A computer-implemented method, comprising: monitoring, by a network monitor on a computer, a network of devices to identify a plurality of communication sessions associated with a client identifier, each of the plurality of communication sessions being associated with sessions data; analyzing the identified plurality of communication sessions using an unclassified sessions model to determine unclassified sessions, wherein the unclassified sessions model indicates session characteristics for the unclassified sessions, and wherein the unclassified sessions are sessions that are not classified as corresponding to either human activity or automated activity; determining a quantity of other unclassified sessions associated with the client identifier and a quantity of total sessions associated with the client identifier; determining a ratio of the quantity of other unclassified sessions to the quantity of total sessions; and classifying the unclassified sessions based at least in part on a comparison of the ratio to a threshold, wherein the classifying for the unclassified sessions causes the network monitor to (a) identify illegitimate users or illegitimate sessions in accordance with the client identifier of the unclassified sessions and (b) perform an action on sessions data or resources of the unclassified sessions pertaining to the identified illegitimate users.