Patent ID: 8914878

Claim:
A method of determining whether a single network session is originated by an automated software agent, the method comprising: receiving, with a network device, packets of a single network session comprising one or more connections between a single client device and a single server device; assembling network session data for the network session from the packets, the network session data comprising application-layer data and packet flow data for the network session; calculating a plurality of scores for the network session based on a plurality of metrics applied to the network session data, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, and wherein each of the scores represents a likelihood that the network session is originated by an automated software agent, wherein the plurality of metrics comprise a combination of two or more of: a number of open connections for the network session, an average number of transactions per open connection for the network session, an average server response time to requests associated with the network session, a percent of data objects of a web page that are requested for the network session, changes to a user agent during the network session, web page cookie handling behavior by the client device for the network session, and an operating system used by the client device of the network session; aggregating the plurality of scores to produce an aggregate score such that the aggregate score only reflects the plurality of metrics applied to the network session data for the single network session between the client device and the server device; determining that the network session is originated by an automated software agent when the aggregate score exceeds a threshold; and executing a programmed response when the network session is determined to be originated by an automated software agent.