Websites that provide electronic services receive input from client machines in the form of requests to access content at various addresses. These requests may follow a particular sequence. For example, within a user session, an online banking service may receive, in order, a request to access, in order, a login page, a password page, an account summary page, a transaction history page, a funds transfer page, a confirmation page, and a logout request page.
However, the online banking service and websites like it are susceptible to attacks from malicious actors. For example, in some attacks, malicious code in a browser running on a user computer alters the requests to a web server in a way that avoids detection by the user.
Conventional approaches to detecting attacks from malicious actors involve comparing frequencies of various behaviors in user sessions with predicted frequencies of those behaviors. For example, an administrator may analyze the frequency of a particular viewing order of a web page and compare this frequency to that predicted by a statistical model. If the frequency in the user session exceeds the predicted frequency, an administrator labels the user session as suspect.