Request header anomaly detection

1 . A method for detecting suspicious clients seeking access to a website comprising:

providing a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;

receiving at the web server a plurality of incoming HTTP request headers from a browser of a client, wherein the plurality of incoming HTTP request headers are selected from the group consisting of ACCEPT, ACCEPT_ENCODING, ACCEPT_LANGUAGE, CONNECTION, HOST, REFERER, and USER_AGENT headers, the plurality of incoming HTTP request headers is in an order of appearance from top to bottom and includes a first header and a second header, wherein the first header identifies a type of the browser of the client and the second header identifies a quality value, wherein the quality value is associated with a browser among a plurality of browsers;

comparing the type of the browser of the client identified in the first header received from the browser of the client with the browser associated with the quality value identified in the second header received from the browser of the client;

determining that the type of the browser of the client does not correspond to the browser associated with the quality value; and

denying, based on the determination, the client access to the website.

2 . The method of claim 1 , comprising:

comparing information identified by a third header to the type of browser identified by the first header and the browser identified by the quality value, wherein the plurality of HTTP request headers further includes the third header; and

determining that one of the first header, the second header, and the third header do not correspond to the same client.

3 . The method of claim 2 , wherein the third header identifies acceptable human languages readable by at least one of the plurality of browsers.

4 . The method of claim 3 , comprising:

providing an example of a correct set of HTTP request headers for the type of the browser identified in the first header including a correct order of appearance of the correct set of HTTP request headers.

5 . The method of claim 4 , comprising:

comparing the order of appearance of the incoming HTTP request headers of the client browser with the correct order of appearance and if in a different order of appearance an anomaly is detected.

6 . The method of claim 2 , wherein the third header identifies encoding acceptable by at least one of the plurality of browsers.

7 . The method of claim 2 , wherein the third header identifies a list of control options for a current connection of at least one of the plurality of browsers.

8 . The method of claim 2 , wherein the third header identifies a domain name of at least one of the plurality of browsers.

9 . The method of claim 2 , wherein the third header identifies an address of a previous web page from at least one of the plurality of browsers.

10 . The method of claim 2 , wherein the third header identifies a browser version and an operating system of for at least one of the plurality of browsers.

11 . A non-transitory machine-readable medium storing a set of instructions for detecting suspicious clients seeking access to a website that when executed by a processor perform steps comprising:

providing a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;

receiving at the web server a plurality of incoming HTTP request headers from a browser of a client, wherein the plurality of incoming HTTP request headers are selected from the group consisting of ACCEPT, ACCEPT_ENCODING, ACCEPT_LANGUAGE, CONNECTION, HOST, REFERER, and USER_AGENT headers, the plurality of incoming HTTP request headers is in an order of appearance from top to bottom and includes a first header and a second header, wherein the first header identifies a type of the browser of the client and the second header identifies a quality value, wherein the quality value is associated with a browser among a plurality of browsers;

comparing the type of the browser of the client identified in the first header received from the browser of the client with the browser type associated with the quality value identified in the second header received from the browser of the client;

determining that the type of the browser of the client does not correspond to the browser associated with the quality value; and

denying, based on the determination, the client access to the website wherein the plurality of incoming HTTP request headers are selected from the group consisting of ACCEPT, ACCEPT_ENCODING, ACCEPT_LANGUAGE, CONNECTION, HOST, REFERER, and USER_AGENT headers.

12 . The non-transitory machine-readable medium of claim 11 , the instructions configured to perform steps comprising:

comparing information identified by a third header to the type of browser identified by the first header and the browser identified by the quality value, wherein the plurality of HTTP request headers includes the third header; and

determining that one of the first header, the second header, and the third header do not correspond to the same client.

13 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies acceptable human languages readable by at least one of the plurality of browsers.

14 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies encoding acceptable by at least one of the plurality of browsers.

15 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies a list of control options for a current connection of at least one of the plurality of browsers.

16 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies a domain name of at least one of the plurality of browsers.

17 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies an address of a previous web page from at least one of the plurality of browsers.

18 . The non-transitory machine-readable medium of claim 12 , wherein the third header identifies a browser version and an operating system of at least one of the plurality of browsers.

19 . A system for detecting suspicious clients seeking access to a website comprising components configured to:

provide a web server supporting the website electronically connected to the Internet for responding to incoming HTTP requests for webpages of the website from clients attempting to access the website;

receive at the web server a plurality of incoming HTTP request header from a browser of a client, wherein the plurality of incoming HTTP request headers are selected from the group consisting of ACCEPT, ACCEPT_ENCODING, ACCEPT_LANGUAGE, CONNECTION, HOST, REFERER, and USER_AGENT headers, the plurality of incoming HTTP request headers is in an order of appearance from top to bottom and includes a first header and a second header, wherein the first header identifies a type of the browser of the client and the second header identifies a quality value, wherein the quality value is associated with a browser among a plurality of browsers;

compare the type of the browser of the client identified in the first header received from the browser of the client with the browser type associated with the quality value identified in the second header received from the browser of the client;

determine that the type of the browser of the client does not correspond to the browser associated with the quality value; and

deny, based on the determination, the client access to the website.