Monitoring resource utilization of an online system based on browser attributes collected for a session

1. A computer implemented method for detecting unauthorized resource utilization, the method comprising:

in response to receiving valid credentials from a browser associated with an organization that is requesting access to a resource, issuing, by an online system, a session token to the browser, wherein access to the resource is granted to browsers that provide the session token during a session;

collecting a first sample of browser attributes from a first browser that provides the session token during the session;

collecting a second sample of browser attributes from a second browser that provides the session token during the session, wherein the browser attributes from the first browser and the second browser comprise:

a CPU (central processing unit) class representing a type or architecture of a CPU of a client device,

languages supported by the browser,

fonts supported by the browser,

media devices attached to the client device,

codecs supported by the browser,

a time zone offset of the browser representing a number of minutes from GMT time,

a user agent identifying a type of browser,

an autonomous system number (ASN),

information describing a screen on which the browser was displayed such as screen resolution,

a do not track setting represented as a Boolean value, and

a digital rights management setting of the browser;

determining a score indicating a distance between the first and second samples of browser attributes collected during the session, the score determined at least in part on (1) for a browser attribute, computing a distance between two values of the browser attribute in the two samples, and (2) computing a weighted aggregate of the distances between the values of corresponding browser attributes in the two samples;

determining based on the score whether the first and second samples of browser attributes collected during the session were received from different browsers, indicating that the organization shares the session token across different browsers;

responsive to determining that the organization shares the session token across the different browsers, detecting unauthorized resource utilization by the organization; and

responsive to determining unauthorized resource utilization by the organization performing a mitigation action, wherein the mitigation action is configured to alert a user, provide a recommendation to the user, or stop the unauthorized resource utilization,

wherein the weighted aggregate assigns high weight to browser attributes representing (1) a platform of a client device running the browser or (2) the CPU Class of the client device running the browser compared to browser attributes representing (1) the agent of the browser or (2) plugins of the browser.

2. The computer implemented method of claim 1 , wherein a weight for a browser attribute is determined based on historical values of the browser attribute collected over a past time interval.

3. The computer implemented method of claim 1 , wherein a weight for a browser attribute is determined based on a frequency of distribution of values of the browser attribute over a past time interval.

4. The computer implemented method of claim 1 , wherein each sample of browser attributes has a type, and wherein the distance between the browser attribute in the two samples of browser attributes is determined using a distance metric associated with the type of the browser attribute.

5. The computer implemented method of claim 1 , wherein the mitigation action comprises one or more of:

invalidating the session token; requiring the user to re-authenticate; or logging the user out.

6. The computer implemented method of claim 1 , further comprising:

determining that the first and second samples of browser attributes are from browsers of the organization if the first and second samples of browser attributes have matching browser attributes representing one or more of an internet protocol (IP) address or an autonomous system number (ASN); and

wherein unauthorized resource utilization is detected responsive to determining that the two samples of browser attributes are from browsers of the organization.

7. The computer implemented method of claim 1 , wherein the computer implemented method is implemented at an online system, and the online system is a multi-tenant system, further comprising:

determining that the two samples of browser attributes are from browsers of a same tenant.

8. A non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps for detecting unauthorized resource utilization, the steps comprising:

in response to receiving valid credentials from a browser associated with an organization that is requesting access to a resource, issuing, by an online system, a session token to the browser, wherein access to the resource is granted to browsers that provide the session token during a session;

collecting a first sample of browser attributes from a first browser that provides the session token during the session;

collecting a second sample of browser attributes from a second browser that provides the session token during the session, wherein the browser attributes from the first browser and the second browser comprise:

a CPU (central processing unit) class representing a type or architecture of a CPU of a client device,

languages supported by the browser,

fonts supported by the browser,

media devices attached to the client device,

codecs supported by the browser,

a time zone offset of the browser representing a number of minutes from GMT time,

a user agent identifying a type of browser,

an autonomous system number (ASN),

information describing a screen on which the browser was displayed such as screen resolution,

a do not track setting represented as a Boolean value, and

a digital rights management setting of the browser;

determining a score indicating a distance between the first and second samples of browser attributes collected during the session, the score determined at least in part on (1) for a browser attribute, computing a distance between two values of the browser attribute in the two samples, and (2) computing a weighted aggregate of the distances between the values of corresponding browser attributes in the two samples;

determining based on the score whether the first and second samples of browser attributes collected during the session were received from different browsers, indicating that the organization shares the session token across different browsers;

responsive to determining that the organization shares the session token across the different browsers, detecting unauthorized resource utilization by the organization; and

responsive to determining unauthorized resource utilization by the organization, performing a mitigation action, wherein the mitigation action is configured to alert a user, provide a recommendation to the user, or stop the unauthorized resource utilization,

wherein the weighted aggregate assigns high weight to browser attributes representing (1) a platform of a client device running the browser or (2) the CPU Class of the client device running the browser compared to browser attributes representing (1) the user agent of the browser or (2) plugins of the browser.

9. The non-transitory computer readable storage medium of claim 8 , wherein a weight for a browser attribute is determined based on historical values of the browser attribute collected over a past time interval.

10. The non-transitory computer readable storage medium of claim 8 , wherein a weight for a browser attribute is determined based on a frequency of distribution of values of the browser attribute over a past time interval.

11. The non-transitory computer readable storage medium of claim 8 , wherein each sample of browser attributes has a type, and wherein the distance between the browser attribute in the two samples of browser attributes is determined using a distance metric associated with the type of the browser attribute.

12. The non-transitory computer readable storage medium of claim 8 , wherein the mitigation action comprises one or more of:

invalidating the session token; requiring the user to re-authenticate; or logging the user out.

13. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the processor to perform steps comprising:

determining that the first and second samples of browser attributes are from browsers of the organization if the first and second samples of browser attributes have matching browser attributes representing one or more of an internet protocol (IP) address or an autonomous system number (ASN); and

wherein unauthorized resource utilization is detected responsive to determining that the two samples of browser attributes are from browsers of the organization.

14. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the processor to perform steps comprising:

determining that the two samples of browser attributes represent a same tenant.

15. A computer system comprising:

a computer processor; and

a non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps for monitoring resource utilization, the steps comprising:

in response to receiving valid credentials from a browser associated with an organization that is requesting access to a resource, issuing, by an online system, a session token to the browser, wherein access to the resource is granted to browsers that provide the session token during a session;

collecting a first sample of browser attributes from a first browser that provides the session token during the session;

collecting a second sample of browser attributes from a second browser that provides the session token during the session, wherein the browser attributes from the first browser and the second browser comprise:

a CPU (central processing unit) class representing a type or architecture of a CPU of a client device,

languages supported by the browser,

fonts supported by the browser,

media devices attached to the client device,

codecs supported by the browser,

a time zone offset of the browser representing a number of minutes from GMT time,

a user agent identifying a type of browser,

an autonomous system number (ASN),

information describing a screen on which the browser was displayed such as the screen resolution,

a do not track setting represented as a Boolean value, and

a digital rights management setting of the browser;

determining a score indicating a distance between the first and second samples of browser attributes collected during the session, the score determined at least in part on (1) for a browser attribute, computing a distance between two values of the browser attribute in the two samples, and (2) computing a weighted aggregate of the distances between the values of corresponding browser attributes in the two samples;

determining based on the score whether the first and second samples of browser attributes collected during the session were received from different browsers, indicating that the organization shares the session token across different browsers;

responsive to determining that the organization shares the session token across the different browsers, detecting unauthorized resource utilization by the organization; and

responsive to determining unauthorized resource utilization by the organization, performing a mitigation action, wherein the mitigation action is configured to alert a user, provide a recommendation to the user, or stop the unauthorized resource utilization,

wherein the weighted aggregate assigns high weight to browser attributes representing (1) a platform of a client device running the browser or (2) the CPU Class of the client device running the browser compared to browser attributes representing (1) the user agent of the browser or (2) plugins of the browser.

16. The computer system of claim 15 , wherein each sample of browser attributes has a type, and wherein the distance between the browser attribute in the two samples of browser attributes is determined using a distance metric associated with the type of the browser attribute.

17. The computer system of claim 15 , wherein the instructions further cause the processor to perform steps comprising:

determining that the first and second samples of browser attributes are from browsers of the organization if the first and second samples of browser attributes have matching browser attributes representing one or more of an internet protocol (IP) address or an autonomous system number (ASN); and

wherein unauthorized resource utilization is detected responsive to determining that the two samples of browser attributes are from browsers of the organization.

18. The computer system of claim 15 , wherein the computer system is a multi-tenant system, further comprising:

determining that the two samples of browser attributes are from browsers of a same tenant.