PATENT CLAIM ANALYSIS

Application Number: 16193167
Application Type: Utility
Filing Date: 2018-11
Publication Date: 2019-03
Patent Classification: ["726", "023000"]

Abstract:
Embodiments can identify requests that may be tied to a DDOS attack. For example, the primary identifiers (e.g., a source address) of requests for a network resource (e.g., an entire website or a particular element of the website) can be tracked. In one embodiment, a statistical analysis of how often a particular source address (or other primary identifier) normally makes a request can be used to identify source addresses that make substantially more requests. A normal amount can correspond to an average number of request that a source address makes. According to some embodiments, a system can use statistical analysis methods on various request data in web server logs to identify potential attacks and send data concerned potential attacks to an HBA system for further analysis.

Claim (Index 1):
A method comprising:\n one or more processors performing the steps of:\n receiving a first set of records of requests for target objects of a network resource; \n analyzing the first set of records to determine a primary identifier for each record, the first set of records having a plurality of different primary identifiers; \n for each primary identifier of the plurality of different primary identifiers:\n determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including at least one of: i) the request having the primary identifier, and ii) the request being for a particular target object of the network resource; \n creating a histogram having a plurality of counters, each counter corresponding to a specified number of requests and storing a count of different primary identifiers having a corresponding request number be the specified number of requests; \n identifying one or more outlier primary identifiers having the request number exceed a threshold, the threshold being based on the standard deviation of the histogram; \n analyzing the records of requests matching the one or more outlier primary identifiers to determine whether the requests are part of an attack on the network resource; and \n adding at least one of an outlier primary identifier and the particular target object to a bad list when requests corresponding to the outlier primary identifier are part of an attack on the network resource.

Metadata:
- Claim Count in Document: 41.0
- Percentile: 98.0
- Lexical Diversity: 1.82051
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15899106', '14931138', '15296824', '14815863', '15418518']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2692452199843766
- 35 USC 102 Novelty (BERT): 0.512151166055618
- Combined Prediction Score: 0.2935358145915008
- Mean Citation Score: 203.40637
- Max Citation Score: 315.63992
- Similarity Product: 283.7032605806065

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test