Patent Document ID: 9106693
Application ID: 13910019
Patent Status: 1

Claim One:
1. A method comprising: receiving, by a security device and from a device, network traffic directed to one or more computing devices protected by the security device; forwarding the network traffic to the one or more computing devices; responsive to receiving, from the one or more computing devices, a response to the network traffic: injecting, by the security device, into the response to form a modified response, code requesting a plurality of data points from the device, wherein the plurality of data points includes at least configuration information of the device; and sending, by the security device and to the device, the modified response; receiving, by the security device and from the device, at least a portion of the requested plurality of data points, wherein the portion of the requested plurality of data points includes one or more of a User Agent of the device, HTTP_ACCEPT headers of the device, browser plugin information of the device, time zone information of the device, screen size of a monitor of the device, color depth of the monitor of the device, system fonts installed at the device, or whether cookies are enabled at the device; comparing, by the security device, the received portion of the requested plurality of data points to respective sets of data points associated with one or more known attacker devices; determining, based on the comparison, whether a first respective set of data points associated with a first known attacker device satisfies a similarity threshold; and selectively managing, based on the determination, additional network traffic directed to the one or more computing devices protected by the security device and received from the device.