Patent ID: 7912965
Filing Date: 2011-03-22
Classification: G06F,H04L

Abstract:
1. A method for reporting on an anomalous request received by a server sent from a second client on a network, said method comprising (a) sending a training request from a first client to said server, (b) including a first record in a log of said server wherein said first record comprises a first identity of said first client, and including a second record corresponding to said training request in said log of said server subsequent to said first record wherein said second record comprises a first indication generated by said server of a first result of processing said training request, (c) sending said log incorporating said first record and said second record from said server to an analysis server, (d) parsing said log incorporating said first record and said second record at said analysis server to a first pattern derived from said log wherein said parsing comprises determining said first pattern comprising a first sequence of a first operation type obtained from said first record followed by a second operation type obtained from said second record and further comprising a first parameter corresponding to said training request and said first identity of said first client, (e) storing in a database of said analysis server said first pattern and said first parameter derived from said log wherein storing said first parameter comprises storing in said database an identity field corresponding to said first identity of said first client, (f) sending said anomalous request from said second client to said server, (g) including a third record corresponding to said anomalous request in said log of said server wherein said third record comprises a second identity of said second client and including a fourth record corresponding to said anomalous request in said log of said server subsequent to said third record wherein said fourth record comprises a second indication generated by said server of a second result of processing said anomalous request, (h) sending said log incorporating said third record and said fourth record from said server to said analysis server, (i) parsing said log incorporating said third record and said fourth record at said analysis server to a second pattern derived from said log wherein said parsing comprises determining said second pattern comprising a second sequence of a third operation type obtained from said third record followed by a fourth operation type obtained from said fourth record and further comprising a first constraint object corresponding to said second identity of said second client obtained from said third record and a second constraint object corresponding to said anomalous request obtained from said fourth record, (j) comparing said second pattern with said first pattern as stored in said database wherein said comparing comprises determining whether said first sequence has operation types in a matching order as said second sequence, whether said first identity is matched by said first constraint object and whether said first pattern comprising said first parameter is matched by said second constraint object, (k) generating a report comprising said second constraint object, and (l) displaying said report to an administrator.