Monitoring resource utilization of an online system based on browser attributes collected for a session

An online system monitors resources utilization by users connecting with the online system and detects unauthorized resource utilization caused by sharing of sessions. The online system collects samples of browser attributes from browsers interacting with the online system. The online system determines a score indicating a difference between two samples of browser attributes taken at different times. The online system uses the score to determine whether the two samples of browser attributes in the same session were received from different browsers. If the online system detects unauthorized resource utilization if the two samples are determined to be from two different browsers. The online system takes mitigating actions, for example, by invalidating the session or requiring users to re-enter credentials.

BACKGROUND

Field of Art

This disclosure relates in general to monitoring resource utilization in online systems, and in particular to detecting unauthorized resource utilization based on browser attributes collected for a session.

Description of the Related Art

Online systems such as multi-tenant systems provide services to enterprises. For example, a multi-tenant system may support multiple tenants, each tenant representing an enterprise. Users from an enterprise connect with the multi-tenant system to use the services offered by the online system. Multi-tenant systems typically limit utilization of resources of the multi-tenant system by an enterprise. For example, a multi-tenant system may enforce a limit on the number of sessions that users of the enterprise can create within a time interval or the number of concurrent sessions that users of the enterprise can create.

Enterprises may exceed the allotted utilization for them. For example, users of a small enterprise may share credentials necessary to create sessions with the multi-tenant system. As a result, the number of users that interact with the online system exceeds the number of valid credential issued by the multi-tenant system resulting in higher resource utilization. A larger enterprise may not allow sharing of credentials since a single user can modify the credentials thereby affecting a large number of other users. However, larger enterprises can implement infrastructure that allows multiple client devices to reuse a session. Such infrastructure may be implemented using hardware and software maintained by an IT (information technology) organization of the enterprise. As a result, an enterprise can exceed the allotted resource utilization without requesting new sessions.

Multi-tenant systems would like to ensure that enterprises that use their services do not exceed the allotted resource utilization. However, conventional techniques fail to detect unauthorized resource utilization by an enterprise. Conventional techniques detect unauthorized use of credentials, for example, if a user steals credentials from an enterprise to connect with the online system. However, if each session is created by a client device of the enterprise using with valid credentials, conventional techniques fail to detect unauthorized resource utilization by the enterprise.

The figures use like reference numerals to identify like elements. A letter after a reference numeral, such as “105a,” indicates that the text refers specifically to the element having that particular reference numeral. A reference numeral in the text without a following letter, such as “105,” refers to any or all of the elements in the figures bearing that reference numeral.

DETAILED DESCRIPTION

An online system, for example, a multi-tenant system offers services to enterprises. Each enterprise represents a set of users that can use the services offered by the online system. An enterprise typically has an agreement with the online system that limits the amount of resources of the online system utilized by users of the enterprise, for example, by imposing a limit on the number of sessions that users of the enterprise can create with the online system within a time interval. The online system uses the number of sessions as an estimate of the amount of resources used. As an example, if a typical user utilizes x amount of resources with a session and the enterprise has an agreement to limit the number of sessions to N within a time interval, the estimated resource utilization by the enterprise is N*x.

However, an enterprise can exceed the allotted amount of resource utilization by sharing sessions across users. For example, if a session is created for one user but shared by m users, the enterprise effectively utilizes N*x*m resources of the online system. This resource utilization can be much higher than the amount agreed upon with the enterprise. The online system may not detect this excess resource utilization since the enterprise did not exceed the number of sessions that the enterprise is allowed to create and each session was created using valid credentials. Such resource utilization is considered unauthorized resource utilization.

Embodiments of the invention monitor resource utilization by enterprises of the online system and detect unauthorized resource utilization. The online system receives a request to access resources of the online system from a user of the enterprise via a browser executing on a client device. The online system receives credentials from the user creating the session and verifies that the credentials are valid. Responsive to determining that the credentials are valid, the online system grants access to the requested resource by issuing a session token to the browser. The online system grants access to the requested resource to browsers that provide valid session token. The online system may receive multiple requests for accessing the resource using the same session token.

The online system performs the following steps for each session token. The online system collects samples of browser attributes from browsers interacting with the online system using the session token. The samples of browser attributes are collected at different times during the session, for example, periodically. The online system determines a score indicating a difference between two samples of browser attributes taken at different times. The online system may determine the score as a weighted aggregate of differences between the browser attributes in the two samples. The online system determines based on the score whether the two samples of browser attributes were received from different browsers. If the online system determines that the two samples of browsers using the same session token were received from two different instances of browsers, the online system determines that unauthorized resource utilization occurred. The online system may take mitigating actions to control the unauthorized resource utilization, for example, by invalidating the session token or requiring users to re-enter valid credentials.

Overall System Environment

FIG.1is a block diagram of a system environment illustrating monitoring of resource utilization by a multi-tenant system according to one embodiment. The system environment100comprises a multi-tenant system110and one or more tenants105, each tenant representing an enterprise associated with client devices115that connect with the multi-tenant system110. In other embodiments, the system environment100may include more or fewer components.

The multi-tenant system110stores data of one or more tenants. Each tenant may be an enterprise that represents a customer of the multi-tenant system110. Each tenant105may have multiple users that interact with the multi-tenant system via client devices115. Various elements of hardware and software of the multi-tenant system110may be shared by multiple tenants.

In one embodiment, multi-tenant system110implements a web-based customer relationship management (CRM) system. For example, the multi-tenant system110may store applications configured to implement and execute CRM software applications. As an example, one tenant105might be a company that employs a sales force where each salesperson uses a client device115to manage their sales process. Thus, a user might maintain contact data, leads data, customer follow-up data, performance data, goals and progress data, etc., all applicable to that user's personal sales process.

The multi-tenant system110comprises a session manager130, an application server135, a resource utilization monitor140, and a data store150. The application server135provides various applications that can be used by tenants of the multi-tenant system110. The application server135may simultaneously process requests for a number of tenants.

The data store150stores data for various tenants of the multi-tenant system110. It is transparent to tenants that their data may be stored in a data store150that is shared with data of other tenants. The data store150may store data for different tenants in separate physical structures, for example, separate database tables or separate databases. Alternatively, the data store150may store data of multiple tenants in a shared structure. For example, user accounts for all tenants may share the same database table. However, the multi-tenant system110stores additional information to logically separate data of different tenants. Accordingly, data of one tenant is kept logically separate from that of other tenants so that one tenant does not have access to another tenant's data, unless such data is expressly shared.

The client devices115for each tenant105create sessions with the multi-tenant system110. A client device115executes a browser that is used by a user to interact with the multi-tenant system110. Examples of browsers include INTERNET EXPLORER, CHROME, SAFARI, FIREFOX, and so on. A browser may be a proprietary application of a tenant used to interact with the multi-tenant system.

The multi-tenant system110provides credentials that are used by client devices115to send requests to the multi-tenant system110via browsers. The session manager130of the multi-tenant system110receives requests to create sessions from client devices115along with credentials for verifying authenticity of the requests. The session manager130verifies the credentials to make sure that the request is from a valid user associated with a tenant105. The session manager130creates a session for the requestor responsive to receiving valid credentials.

In an embodiment, the session manager130issues a session token in response to the request to create the session. The session token is subsequently provided by browsers executing on client devices115when they send requests for processing by the multi-tenant system110. The multi-tenant system110processes requests if they are accompanied with valid session tokens. A session token may be valid for a predetermined period of time. Once a session token expires, the client device115is required to request a new session token to continue interacting with the multi-tenant system110.

A tenant105may have an agreement with the multi-tenant system, for example, a license that imposes a limit on the maximum number of sessions that the tenant105is allowed to create within a time interval. The session manager130ensures that the number of sessions stays within any limits imposed by an agreement with the tenant. If a tenant attempts to create more sessions than are allowed, the session manager may deny the request or send a message to a system administrator of the tenant to revise the agreement to increase the number of allowed sessions.

As discussed herein, a tenant may reuse session tokens across multiple browsers to increase resource utilization without creating additional sessions. The resource utilization monitor140ensures that the resource utilization of multi-tenant system110by client devices of a tenant105is within an allotted quota. The resource utilization monitor140tracks session tokens issued by the session manager and determines whether the same session token is being used by multiple browsers. If the resource utilization monitor140detects excess resource utilization by a tenant, the resource utilization monitor140takes mitigating action, for example, by denying subsequent requests to create sessions by client devices of the tenant105responsive to detecting unauthorized resource utilization. Alternatively, the multi-tenant system110may send a message to a system administrator of the tenant105indicating excess resource utilization by the tenant with a request to revise the agreement with the multi-tenant system110in accordance with the high level of resource utilization.

Various components shown inFIG.1including the client devices115and the multi-tenant system110represent computing devices. A computing device can be a conventional computer system executing, for example, a Microsoft™ Windows™-compatible operating system (OS), Apple™ OS X, and/or a Linux distribution. A computing device can also be a client device having computer functionality, such as a personal digital assistant (PDA), mobile telephone, video game system, etc. Each computing device stores software modules storing instructions. The interactions between the various components of the system environment100are typically performed via a network, not shown inFIG.1.

Although embodiments disclosed herein are described in connection with a multi-tenant system, the techniques disclosed are applicable to other online systems as well. For example, an online system may provide services to one or more enterprises with a limit on the resource utilization of each enterprise. The online system can use the techniques disclosed herein to determine whether any enterprise is performing unauthorized resource utilization by sharing sessions.

System Architecture

FIG.2is a block diagram illustrating components of a resource utilization monitor according to one embodiment. The resource utilization monitor140comprises a browser attribute collection module210, a browser attribute comparison module220, an unauthorized usage detection module230, a mitigation action module240, and a session data store250. Other embodiments can have different and/or other components than the ones described here, and that the functionalities can be distributed among the components in a different manner.

The browser attribute collection module210periodically receives samples of browser attributes associated with a session and stores them in the browser attribute store250. A sample of browser attributes may also be referred to herein as a set of browser attributes. For example, the browser attribute collection module210may receive samples of browser attributes associated with a session every 5 minutes.

A sample of browser attributes includes browser attributes of various types. Each sample of browser attributes describes the browser that was used to interact with the multi-tenant system110via a session. Examples of browser attributes that are received from a browser executing on a client device include (1) IP (internet protocol) address of the client device, (2) platform representing the operating system executing on the client device, (3) CPU (central processing unit) class representing the type or architecture of CPU of the client device, (4) languages supported by the browser, (5) fonts supported the browser, (6) plugins on the browser, (7) media devices attached to the client device, (8) codecs supported by the browser, (9) time zone offset of the browser representing a number of minutes from GMT time, (10) a user agent identifying the type of browser, (11) autonomous system number (ASN), (12) information describing the screen on which the browser was displayed such as the screen resolution, (13) do not track setting represented as a boolean value, (14) a digital rights management setting of the browser, and so on.

In an embodiment, the multi-tenant system110sends instructions of a scripting language for execution on the browser, for example, JAVASCRIPT instructions. These instructions include functions to extract various browser attributes and send them to the multi-tenant system. These instructions are typically installed with permission of the user interacting with the multi-tenant system or by a system administrator of the tenant as part of an agreement with the multi-tenant system110. The browser attribute collection module210tracks session tokens and stores the browser attributes in association with the session token of the session used by the browser for interacting with the multi-tenant system.

The browser attribute comparison module220takes two samples of browser attributes and compares them. In an embodiment, the browser attribute comparison module220determines a measure of distance between the two samples of browser attributes.FIG.5describes a process for determining the measure of distance between two samples of browser attributes.

The unauthorized usage detection module230receives samples of browser attributes collected by the browser attribute collection module210and invokes the browser attribute comparison module220to compare the samples of browser attributes. It determines whether the two samples of browser attributes represent browsers of the same tenant. It further determines whether two samples of browser attributes of the same tenant using the same session token are from distinct browsers. Accordingly, the unauthorized usage detection module230determines whether a tenant is reusing session tokens across distinct browsers. If the unauthorized usage detection module230detects that the tenant is reusing session tokens across distinct browsers, the unauthorized usage detection module230flags unauthorized resource utilization by the tenant.

If the unauthorized usage detection module230flags unauthorized resource utilization by the tenant, the mitigation action module240takes mitigation actions. The mitigation action module240may alert a user of the enterprise or a system administrator of the multi-tenant system110about the unauthorized resource utilization. The mitigation action module240may provide the enterprise with a recommendation to revise the agreement with the multi-tenant system110, for example, by acquiring more licenses. In an embodiment, the mitigation action module240aggregates various instances of unauthorized resource utilization by the tenant to determine an estimate of actual resource usage of the tenant. The mitigation action module240uses the estimate of actual resource usage to recommend a number of licenses that the tenant requires based on the actual usage.

In an embodiment, the mitigation action module240requires the end user to pass enhanced authentication, for example, a captcha. If the enterprise is running automated processes that reuse session tokens across multiple browsers, requiring the users to pass a captcha requires manual intervention, thereby causing the automatic process to fail.

In an embodiment, the mitigation action module240requires the user to re-enter credentials, for example, re-enter password previously used to create the session. If the tenant is sharing session tokens across users without providing them valid credentials, the users are unlikely to be able to provide the credentials. If the enterprise shares the same password with multiple users, the mitigation action module240may not be able to stop the unauthorized resource utilization by requiring users to re-enter credential. However, enterprises that are large are unlikely to share credentials across users since any user can modify the credentials, thereby disrupting the use of the multi-tenant system by other users of the enterprise.

In an embodiment, the mitigation action module240logs out the user suspected of unauthorized resource utilization. This forces the user to re-authenticate by re-entering credential to obtain a new session token. This mitigation action has same effect as requiring the user to re-enter credentials.

The mitigating actions taken by the mitigation action module240to prevent unauthorized resource utilization are different from mitigation actions that may be taken if a user outside the enterprise is determined to have stolen credentials. For example, if a user outside the enterprise has stolen credentials, it is ineffective to request the user to re-enter credentials since the user is in possession of valid credentials. Similarly, logging out the user is also ineffective since the user has stolen credentials that the user can re-enter. In contrast these mitigation actions are effective against unauthorized resource utilization if an enterprise does not share credentials across users but uses an automatic mechanism to share sessions across browsers.

Overall Process

FIG.3illustrates comparison of browser attributes collected for a session, according to one embodiment.FIG.3shows a time line300associated with a session with the multi-tenant system110. The first data point310on the time line indicates a sample of browser attributes received when the user logs in and initiates the session. For the rest of the session, the resource utilization monitor140periodically obtains the browser attributes for the session, for example, every 5 minutes as indicated by the time interval320. In an embodiment, the multi-tenant system110allows a system administrator to configure the rate at which the browser attributes are obtained.

The resource utilization monitor140compares each sample of browser attributes with the previous sample of browser attributes that was obtained. The resource utilization monitor140determines based on the comparison, if the difference between the samples of browser attributes indicates that the session token was shared by two distinct browsers. For example, the samples of browser attributes B1 and B2 obtained at time points330and340respectively indicate more than a threshold difference between browser attributes indicating unauthorized resource utilization.

FIG.4is a flow chart illustrating the process for determining unauthorized resource utilization according to one embodiment. Other embodiments can perform the steps ofFIG.4in different orders. Moreover, other embodiments can include different and/or additional steps than the ones described herein.

The multi-tenant system110receives410a request to create a session from a user associated with a tenant and receives credentials for creating the session. The request may be for access to a resource of the multi-tenant system and is received from a browser executing on a client device115associated with the tenant. Examples of resources include applications running on the multi-tenant system110or databases stored on the multi-tenant system110. For example, a user may send a request via a browser to run an application on the multi-tenant system110or perform a query or execute a transaction on a database stored on the multi-tenant system110.

The multi-tenant system110verifies the credentials to ensure that they represent a valid user associated with the tenant. If the multi-tenant system110determines that the credentials received are valid, the multi-tenant system110provides420a session token to the requestor. The multi-tenant system110grants access to the resource to browsers that provide valid session tokens.

The multi-tenant system110receives samples of browser attributes from the browser that sends the session token. The multi-tenant system110may issue multiple session tokens at the same time for a tenant. The multi-tenant system110repeats the following steps430,440, and450for each session token. The multi-tenant system110collects430samples of browser attributes from browsers in a session for that session token. The samples of browser attributes may be collected at different times during the session.

The multi-tenant system110determines a score indicating a difference between two samples of browser attributes taken at different times. The score may be determined as a weighted aggregate of differences between the browser attributes in the two samples. The multi-tenant system110determines based on the score whether the two samples of browser attributes were received from different browsers. The multi-tenant system110detects450unauthorized resource utilization if it determines that the two samples of browser attributes were received from different browsers. If the multi-tenant system110detects unauthorized resource utilization, the multi-tenant system110performs460mitigating actions as described in connection with mitigation action module240.

In an embodiment, the multi-tenant system110also determines whether the browser attributes represent the same tenant, for example, the same organization or enterprise that has an agreement with the multi-tenant system110. The multi-tenant system110determines that the browser attributes represent the same tenant if the two sample browser attributes have matching browser attributes representing the internet protocol (IP) address or the autonomous system number (ASN). If the multi-tenant system110determines that the two sample browser attributes represent two different tenants or two different organizations or enterprises, the multi-tenant system110makes a determination that there is no unauthorized resource utilization even if the same session token is being used by two different browsers. The multi-tenant system110makes this determination since the enterprise is not sharing session tokens across browsers for unauthorized resource utilization. The multi-tenant system110may make a different determination that there is a security breach of the enterprise since session tokens are being stolen by a client device outside the enterprise and may report this incident to the enterprise.

FIG.5is a flow chart illustrating the process for comparing two browser attributes according to one embodiment. Other embodiments can perform the steps ofFIG.4in different orders. Moreover, other embodiments can include different and/or additional steps than the ones described herein.

The browser attribute comparison module220receives510two samples of browser attributes B1 and B2 from browsers that provided the same session token. The browser attribute comparison module220determines a metric indicating a distance between the two samples of browser attributes as follows. Each sample of browser attributes may include different types of browser attributes. The browser attribute comparison module220may use a different distance metric for different types of browser attributes.

For each type T of browser attributes, the browser attribute comparison module220performs the steps520,530, and540. The browser attribute comparison module220determines a type of metric Mused for representing distance between browser attributes of type T The browser attribute comparison module220identifies an individual browser attribute B1iof type T from the set B1 and corresponding browser attribute B2of type T from the set B2. The browser attribute comparison module220determines a distance between B1iand B2iusing the distance metric M for the type T of browser attributes.

The browser attribute comparison module220determines a weighted aggregate of all the distance metrics determines for corresponding pairs of individual browser attributes from the samples of browser attributes B1 and B2. In an embodiment, the weighted aggregate computation is represented using the following equation.

In the above equation score represents a numerical score representing the result of the weighted aggregate computation, F represents the number of individual browser attributes in each sample of browser attributes B1 or B2, wirepresents the weight corresponding to the ithindividual browser attribute, direpresents the distance between the individual browser attributes B1iand B2i. The browser attribute comparison module220provides the weighted aggregate of the distance metrics as the measure of distance between the two samples of browser attributes B1 and B2 for comparing440them.

In an embodiment the weights wiare determined using the following equation.
wi=e−Entropyi=eΣp[i]log(p[i])(2)

In the above equation, wirepresents the weight for the ithbrowser attribute derived using historical data and p[i]denotes the probability distribution for the ithbrowser attribute over a time interval, for example, past 30 days. The summation in the above equation is performed over all browser attributes. The browser attribute comparison module220analyzes the browser attributes over the time interval to determine a frequency of each distinct value of the browser attribute. The browser attribute comparison module220determines a probability distribution based on the frequency of the each distinct value of the browser attribute. The browser attribute comparison module220determines the weight using the above equation (2).

The browser attribute comparison module220determines the distance for each type of browser attribute using a distance metric dependent on the type of browser attribute. Examples of distance metrics for different types of browser attributes are as follows.

Some browser attributes are represented as categorical values or as boolean values. An example of a categorical variable is CPU class that takes one of several values indicating different types of CPUs. An example of a boolean variable is the do not track setting of the browser that can be either true or false. The distance metric for categorical browser attributes or boolean browser attributes are determines using a function that takes two input values and returns a value indicating whether the two input values are equal. For example, the function may return 1 if the two input values are equal and 0 if the two input values are not equal.

Some browser attributes are represented as tuples. For example, the dimensions of the screen of the client device is represented using two dimensions such as (1920, 1080) or (640, 480). Each tuple has a plurality of dimensions. The distance metric for browser attributes represented as tuples is an aggregate of differences between corresponding elements of the tuple. The browser attribute comparison module220receives two browser attribute values, each represented as a tuple comprising a plurality of elements. The browser attribute comparison module220determines differences between the corresponding elements of the tuples. The browser attribute comparison module220determines an aggregate of the differences. According to an embodiment, if the two browser attributes are represented as B1i=(x1,y1) and B2i=(x2,y2), the distance d between the browser attributes is determined using following equation (3).

Some browser attributes are represented as strings, for example, the user agent browser attribute or the plugins browser attribute. The distance between two browser attributes B1iand B2irepresented as strings is determined using the following equation (4).

Some browser attributes are represented as bit arrays, for example, fonts browser attribute. The distance between two browser attributes B1iand B2irepresented as bit arrays is determined using the following equation (5).

In the above equation (5), the BitwiseHamming function for two bit arrays is the value indicating the number of bits that are different between the two bit arrays and the function len is the length of the bit arrays. Accordingly, the browser attribute comparison module220determines the distance between two bit arrays by determining the bit wise hamming distance between the two bit arrays and dividing by the length of each bit array.

Some browser attributes can be represented as floating point numbers, for example, time zone offset value.

In equation (6), MaxDifference represents the maximum possible difference between the two browser attribute values. For example, for timezone offset, the MaxDifference value is 24 hours. The browser attribute comparison module220receives two floating point numbers as inputs, determines the absolute value of the difference of the two inputs and divides the result by the MaxDifference value.

Computer Architecture

FIG.6is a high-level block diagram illustrating a functional view of a typical computer system for use as one of the entities illustrated in the environment100ofFIG.1according to an embodiment. Illustrated are at least one processor602coupled to a chipset604. Also coupled to the chipset604are a memory606, a storage device608, a keyboard610, a graphics adapter612, a pointing device614, and a network adapter616. A display618is coupled to the graphics adapter612. In one embodiment, the functionality of the chipset604is provided by a memory controller hub620and an I/O controller hub622. In another embodiment, the memory606is coupled directly to the processor602instead of the chipset604.

The storage device608is a non-transitory computer-readable storage medium, such as a hard drive, compact disk read-only memory (CD-ROM), DVD, or a solid-state memory device. The memory606holds instructions and data used by the processor602. The pointing device614may be a mouse, track ball, or other type of pointing device, and is used in combination with the keyboard610to input data into the computer system200. The graphics adapter612displays images and other information on the display618. The network adapter616couples the computer system600to a network.

As is known in the art, a computer600can have different and/or other components than those shown inFIG.6. In addition, the computer600can lack certain illustrated components. For example, a computer system600acting as a multi-tenant system110may lack a keyboard610and a pointing device614. Moreover, the storage device608can be local and/or remote from the computer600(such as embodied within a storage area network (SAN)).

The computer600is adapted to execute computer modules for providing the functionality described herein. As used herein, the term “module” refers to computer program instruction and other logic for providing a specified functionality. A module can be implemented in hardware, firmware, and/or software. A module can include one or more processes, and/or be provided by only part of a process. A module is typically stored on the storage device608, loaded into the memory606, and executed by the processor602.

The types of computer systems600used by the entities ofFIG.1can vary depending upon the embodiment and the processing power used by the entity. For example, a client device115may be a mobile phone with limited processing power, a small display618, and may lack a pointing device614. The multi-tenant system110and the secondary platform120, in contrast, may comprise multiple blade servers working together to provide the functionality described herein.

ADDITIONAL CONSIDERATIONS

Certain embodiments described herein include process steps and instructions described in the form of an algorithm. It should be noted that the process steps and instructions of the embodiments could be embodied in software, firmware or hardware, and when embodied in software, could be downloaded to reside on and be operated from different platforms used by real time network operating systems.

The algorithms and operations presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may also be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will be apparent to those of skill in the, along with equivalent variations. In addition, the present embodiments are not described with reference to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the embodiments as described herein.

Finally, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter. Accordingly, the disclosure of the embodiments is intended to be illustrative, but not limiting.