Abstract: The present disclosure is directed towards systems and methods for improving anomaly detection using injected outliers. A normalcy calculator of a device may include a set of outliers into a training dataset of data points. The normalcy calculator, using a K-means clustering algorithm applied on the training dataset, identify at least a first cluster of data points. The normalcy calculator of the device may determine a region with a center and an outer radius that covers at least a spatial extent of the first cluster of data points. The normalcy calculator may determine a first normalcy radius for the first cluster by reducing the region around the center until a point at which all artificial outliers are excluded from a region defined by the first normalcy radius. An outlier detector of the device may use the region defined by the first normalcy radius to determine whether a new data point is normal or abnormal.

Abstract: Systems and methods for protection against session stealing is described. In embodiments of the present solution, a device intermediary to the client and the server may identify first properties of the client and associate the first properties with the session key. When the device receives subsequent request comprising the session key, the device matches the associated first properties with second properties of the second device that is sending the subsequent request. If there is a match, the subsequent request transmitted to the server. Otherwise, the subsequent request is rejected.

Abstract: A streaming rewrite method and system that can execute an efficient multiple pattern search method that parses a response in a data structure of an appliance. The method and system can avoid copying to a buffer by parsing data across a data structure to identify search patterns and phrases that may be identified by one or more actions and/or rules of an appliance or system. A parser can input one or more search patterns, and parse a body of a response or one or more packets for the search patterns. The parser can obtain pattern information about the packets and/or the response, and store this information in a database. The appliance can then perform lookups in the database for pattern information and perform rewrites in accordance with the stored pattern information. The rewritten response and/or packets can then be transmitted to a destination.