CPC H04L 63/1425 (2013.01) [H04L 63/1433 (2013.01); H04L 63/1458 (2013.01)] | 20 Claims |
1. A method comprising:
accessing transaction data describing network traffic associated with a web server during an interval;
determining a short-term trend for an online entity, based on a count of new transactions involving the online entity during the interval according to the transaction data;
applying exponential smoothing to a history of transactions of the online entity to compute a long-term moving trend for the online entity by computing an exponentially smoothed average of the count of transactions and an exponentially smoothed standard deviation of the count of transactions;
detecting that an anomaly exists with respect to the online entity in the network traffic associated with the web server, based on a comparison between the short-term trend and the long-term trend for the online entity; and
implementing an access control between the online entity and the web server responsive to detecting the anomaly.
|