US 12,316,672 B2
Bot detection in an edge network using transport layer security (TLS) fingerprint
David Senecal, Santa Clara, CA (US); Andrew Kahn, San Francisco, CA (US); Ory Segal, Herzliya (IL); Elad Shuster, Herzliya (IL); and Duc Nguyen, Santa Clara, CA (US)
Assigned to Akamai Technologies, Inc., Cambridge, MA (US)
Filed by Akamai Technologies, Inc., Cambridge, MA (US)
Filed on Oct. 24, 2023, as Appl. No. 18/383,351.
Application 18/383,351 is a continuation of application No. 17/533,185, filed on Nov. 23, 2021, granted, now 11,799,908, issued on Oct. 24, 2023.
Application 17/533,185 is a continuation of application No. 15/973,585, filed on May 8, 2018, granted, now 11,184,390, issued on Nov. 23, 2021.
Claims priority of provisional application 62/599,845, filed on Dec. 18, 2017.
Prior Publication US 2024/0056479 A1, Feb. 15, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); G06N 20/00 (2019.01); H04L 9/40 (2022.01); H04L 67/02 (2022.01)
CPC H04L 63/1483 (2013.01) [G06N 20/00 (2019.01); H04L 63/166 (2013.01); H04L 67/02 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A computer program product in a non-transitory computer readable medium, the computer program product comprising program code executable in and across a set of hardware processors, the program code comprising:
first program code executable in a first hardware processor and configured to execute a script and, responsive to execution of the script, to output a set of transport layer security parameters;
second program code executable in a second hardware processor and configured to receive and extract the set of transport layer security parameters, to process the extracted set of transport layer security parameters into a hash value, and to selectively output the hash value; and
third program code executable in a third hardware processor and configured to receive the hash value, based on a machine learning model, carry out a determination whether an entity that generated the set of transport layer security parameters as reflected by the hash value has a characteristic associated with a bot, and to provide the second program code an indication based on the determination;
wherein the second program code is further configured to receive and to take a given action based on the indication.