Patent ID: 9021583
Filing Date: 2015-04-28
Classification: G06F,H04L

Abstract:
1. In a network security system implemented in an electronic device, coupled to secured online resources for detecting unauthorized accesses of those secured online resources, a method comprising: monitoring, by the electronic device, a current user activity session in which a client device sends a series of access requests to a server device which is constructed and arranged to provide access to the secured online resources, from the series of access requests sent by the client device, providing a set of current frequency measurements, each of the set of current frequency measurements indicating a number of times the client device (i) receives a first webpage from the server device and (ii) sends a request to the server device for a second webpage within a predefined range of time after receiving the first webpage from the server device, and comparing the set of current frequency measurements to a set of average frequency measurements from an average user activity session model to produce an anomaly score which indicates whether the current user activity session is indicative of a hidden session by an attacker; wherein providing the set of current frequency measurements includes: wherein comparing the set of current frequency measurements to the set of average frequency measurements includes: