Patent ID: 8356001
Filing Date: 2013-01-15
Classification: G06F

Abstract:
1. A method for detecting malicious functional user behavior on a web application comprising: collecting a plurality of user requests sent from a client device to a web server hosting the web application during a session, wherein: creating a behavior pattern comprising a first mapping from a plurality of qualitative attributes to respective user values in the functional user behavior, wherein the user values are derived from parsing the information associated with the functional user behavior according to the qualitative attributes; correlating the created behavior pattern with each evaluation pattern of a set of known evaluation patterns, wherein at least one of the known evaluation patterns is associated with malicious functional user behavior and comprises a second mapping from at least one of the plurality of qualitative attributes in the created behavior pattern to one or more respective evaluation values; and in response to finding a match between the behavior pattern and the evaluation pattern associated with the malicious functional user behavior from the correlation, automatically executing a remediation action associated with the matching evaluation pattern.