Embodiments provide techniques for evaluating and validating network sessions.
Embodiments provide techniques for evaluating and validating network sessions. A first set of connection data associated with a first interaction of a network session between a client and a server is accessed, where the first set of connection data comprises a first internet protocol (IP) address of the client. A second set of connection data associated with a second interaction of the network session is accessed. An anomaly score for the network session is generated based on at least one of the first set of connection data or the second set of connection data using an anomaly model. Upon determining, based on the anomaly score, that the network session is anomalous, the network session is invalidated and an indication that the first IP address is indicative of anomalous connectivity is stored.
BACKGROUND
An ever-increasing number of network systems exist to provide a wide variety of services to users. For example, systems are available for hosting, downloading, and/or uploading data, transmitting messages, streaming data, ecommerce, digital authentication, performing computational operations, and the like. In many cases, these digital services are provided using a subscription-based platform, where services are provided only (or preferably) to subscribing users (and non-subscribed users receive lesser priority or are denied service entirely). Ensuring platform security is important to maintaining the integrity of such digital services. Many platforms therefore use various techniques to accurately identify allowed and disallowed users or connections.
1. A method, comprising: accessing a first set of connection data associated with a first interaction of a first network session between a client and a server, wherein the first set of connection data comprises a first internet protocol (IP) address of the client; accessing a second set of connection data associated with a second interaction of the first network session, wherein the second set of connection data comprises a second IP address of the client; generating a first anomaly score for the first network session based on at least one of the first set of connection data or the second set of connection data using an anomaly model; and upon determining, based on the first anomaly score, that the first network session is anomalous: invalidating the first network session; and storing an indication that the first IP address is indicative of anomalous connectivity. ||
11. One or more non-transitory computer readable media containing, in any combination, computer program code that, when executed by operation of any combination of one or more processors, performs an operation comprising: accessing a first set of connection data associated with a first interaction of a first network session between a client and a server, wherein the first set of connection data comprises a first internet protocol (IP) address of the client; accessing a second set of connection data associated with a second interaction of the first network session, wherein the second set of connection data comprises a second IP address of the client; generating a first anomaly score for the first network session based on at least one of the first set of connection data or the second set of connection data using an anomaly model; and upon determining, based on the first anomaly score, that the first network session is anomalous: invalidating the first network session; and storing an indication that the first IP address is indicative of anomalous connectivity. ||
16. A system, comprising: one or more processors; and one or more memories storing a program, which, when executed on any combination of the one or more processors, performs operations, the operations comprising: accessing a first set of connection data associated with a first interaction of a first network session between a client and a server, wherein the first set of connection data comprises a first internet protocol (IP) address of the client; accessing a second set of connection data associated with a second interaction of the first network session, wherein the second set of connection data comprises a second IP address of the client; generating a first anomaly score for the first network session based on at least one of the first set of connection data or the second set of connection data using an anomaly model; and upon determining, based on the first anomaly score, that the first network session is anomalous: invalidating the first network session; and storing an indication that the first IP address is indicative of anomalous connectivity.