Identifying malicious client network applications based on network request characteristics

1. A method, comprising:

receiving a plurality of requests from a client network application, each request in the plurality of requests for an action to be performed on a resource that is hosted at an origin server;

for the each request in the plurality of requests, determining one or more request attributes of the request and associating the one or more determined request attributes of the request with a session that identifies the client network application;

computing one or more session metrics of the session;

generating a confidence value for the client network application based at least on the determined request attributes of the plurality of requests and the computed session metrics of the session;

determining that the confidence value indicates that the client network application is malicious;

in response to determining that the confidence value indicates that the client network application is malicious, performing one or more mitigation actions.

2. The method of claim 1 , wherein generating the confidence value for the client network application comprises:

retrieving historical request data from a data structure, the historical request data including previous request attributes of previous requests from the client network application; and

analyzing the previous request attributes of the previous requests to identify patterns between the previous requests and the plurality of requests.

3. The method of claim 1 , wherein performing the one or more mitigation actions comprises:

modifying a reputation score associated with the client network application; and

initiating a challenge process in response to a subsequent request from the client network application.

4. The method of claim 1 , wherein performing the one or more mitigation actions comprises:

blocking the request from transmittal to the origin server.

5. The method of claim 1 , further comprising:

storing the one or more determined request attributes of the request and the session metrics in a data structure;

comparing request attributes of subsequent requests to the determined request attributes of the requests in the data structure; and

preventing one or more of the subsequent requests from being sent to the origin server when the request attributes of the one or more of the subsequent requests are similar to the determined request attributes of the requests in the data structure.

6. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:

receiving a plurality of requests from a client network application, each request in the plurality of requests for an action to be performed on a resource that is hosted at an origin server;

for the each request in the plurality of requests, determining one or more request attributes of the request and associating the one or more determined request attributes of the request with a session that identifies the client network application;

computing one or more session metrics of the session;

generating a confidence value for the client network application based at least on the determined request attributes of the plurality of requests and the computed session metrics of the session;

determining that the confidence value indicates that the client network application is malicious;

in response to determining that the confidence value indicates that the client network application is malicious, performing one or more mitigation actions.

7. The non-transitory machine-readable storage medium of claim 6 , wherein generating the confidence value for the client network application comprises:

retrieving historical request data from a data structure, the historical request data including previous request attributes of previous requests from the client network application; and

analyzing the previous request attributes of the previous requests to identify patterns between the previous requests and the plurality of requests.

8. The non-transitory machine-readable storage medium of claim 6 , wherein performing the one or more mitigation actions comprises:

modifying a reputation score associated with the client network application; and

initiating a challenge process in response to a subsequent request from the client network application.

9. The non-transitory machine-readable storage medium of claim 6 , wherein performing the one or more mitigation actions comprises:

blocking the request from transmittal to the origin server.

10. The non-transitory machine-readable storage medium of claim 6 that provides instructions that, when executed by the processor, cause said processor to further perform operations comprising:

storing the one or more determined request attributes of the request and the session metrics in a data structure;

comparing request attributes of subsequent requests to the determined request attributes of the requests in the data structure; and

preventing one or more of the subsequent requests from being sent to the origin server when the request attributes of the one or more of the subsequent requests are similar to the determined request attributes of the requests in the data structure.

11. An apparatus, comprising:

a processor;

a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, cause said processor to perform the following:

receive a plurality of requests from a client network application, each request in the plurality of requests for an action to be performed on a resource that is hosted at an origin server;

for the each request in the plurality of requests, determine one or more request attributes of the request and associating the one or more determined request attributes of the request with a session that identifies the client network application;

compute one or more session metrics of the session;

generate a confidence value for the client network application based at least on the determined request attributes of the plurality of requests and the computed session metrics of the session;

determine that the confidence value indicates that the client network application is malicious;

in response to determining that the confidence value indicates that the client network application is malicious, perform one or more mitigation actions.

12. The apparatus of claim 11 , wherein generating the confidence value for the client network application comprises:

retrieving historical request data from a data structure, the historical request data including previous request attributes of previous requests from the client network application; and

analyzing the previous request attributes of the previous requests to identify patterns between the previous requests and the plurality of requests.

13. The apparatus of claim 11 , wherein performing the one or more mitigation actions comprises:

modifying a reputation score associated with the client network application; and

initiating a challenge process in response to a subsequent request from the client network application.

14. The apparatus of claim 11 , wherein performing the one or more mitigation actions comprises:

blocking the request from transmittal to the origin server.

15. The apparatus of claim 11 , wherein the instructions further cause said processor to perform the following:

store the one or more determined request attributes of the request and the session metrics in a data structure;

compare request attributes of subsequent requests to the determined request attributes of the requests in the data structure; and

prevent one or more of the subsequent requests from being sent to the origin server when the request attributes of the one or more of the subsequent requests are similar to the determined request attributes of the requests in the data structure.