Bot detection in an edge network using transport layer security (TLS) fingerprint
A method of bot detection in a computer network leverages a machine learning system. The machine learning system receives a fingerprint derived at a server, the server having extracted a set of transport layer security parameters received from a client and processed the set parameters into the fingerprint. Based at least in part on the fingerprint, the learning system determines whether the client is likely to be a bot as opposed to a human user. The system generates and returns to the server as score having a first value when the fingerprint is determined to be associated with a good client, and having a second value when the fingerprint is determined to be associated with a bot. Based on the score received from the machine learning system, the server takes a configured action with respect to the client.
1. A method of bot detection in a computer network, comprising:
receiving, at a machine learning system, a fingerprint, the fingerprint having been derived at a server by the server extracting a set of transport layer security parameters received from a client and processing the set of transport layer security parameters into the fingerprint, the set of transport layer security parameters having been generated at a client in association with execution of a script;
determining, by the machine learning system, and based at least in part on the fingerprint, whether the client is likely to be a bot as opposed to a human user;
generating, by the machine learning system, a score, wherein the score has a first value when the fingerprint is determined to be associated with a good client, and wherein the score has a second value when the fingerprint is determined to be associated with a bot; and
returning the score to the server for further action based on the score.
2. The method as described in claim 1 wherein the fingerprint is received at the machine learning system in association with a request flow between the client and the server.
3. The method as described in claim 1 wherein the fingerprint is received at the machine learning system out-of-band with respect to a request flow between the client and the server.
4. The method as described in claim 1 wherein the machine learning system uses supervised machine learning to generate a ruleset based at least in part on a set of generated scores that include the score.
5. The method as described in claim 1 further including the machine learning system generating and publishing a list of known bad signatures.
6. The method as described in claim 5 wherein a known bad signature is generated from information derived from the set of transport layer security parameters received.
7. The method as described in claim 6 wherein the known bad signature comprises a tuple: {the fingerprint, a header order, and a user-agent}.
8. The method as described in claim 1 wherein the fingerprint is derived at the server by applying a one-way hash function to the set of transport layer security parameters to produce the fingerprint.
9. An apparatus, comprising:
one or more processors;
computer memory holding computer program instructions executed by the one or more processors, the computer program instructions comprising program code configured as a machine learning system and configured to:
receive a fingerprint, the fingerprint having been derived at a server by the server extracting a set of transport layer security parameters received from a client and processing the set of transport layer security parameters into the fingerprint, the set of transport layer security parameters having been generated at a client in association with execution of a script;
determine, based at least in part on the fingerprint, whether the client is likely to be a bot as opposed to a human user;
generate a score, wherein the score has a first value when the fingerprint is determined to be associated with a good client, and wherein the score has a second value when the fingerprint is determined to be associated with a bot; and
return the score to the server for further action by the server based on the score.