Back to results
US 10,454,955 B2Granted
Real-time contextual monitoring intrusion detection and prevention
AssigneeSap SE
InventorsElad Schulman, Amidan Tabak, Ofer Rivlin
Life of this patent
Estimating the term…
Abstract
A configuration is received for an agent associated with an application to monitor application transactions. The agent monitors incoming and outgoing application transactions using the agent and transmits monitored transaction data to a monitoring server for anomalous transaction detection. The agent receives instructions from the monitoring server to perform an action based on the transmitted monitored transaction data and reports the status of the performed action to the monitoring server.
Claims18
A computer-implemented method, comprising:
- receiving a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application;
- monitoring, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type;
- transmitting monitored transaction data to a monitoring server performing anomalous transaction detection;
- receiving instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type;
- replacing the monitoring agent with the replacement monitoring agent at runtime;
- and
- performing, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application.
4 more elements
A non-transitory, computer-readable medium storing computer-readable instructions, the instructions executable by a computer and configured to:
- receive a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application;
- monitor, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type;
- transmit monitored transaction data to a monitoring server performing anomalous transaction detection;
- receive instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type;
- replace the monitoring agent with the replacement monitoring agent at runtime;
- and
- perform, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application.
4 more elements
A computer-implemented system, comprising:
- at least one hardware processor interoperably coupled with a computer memory and configured to:
- receive a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application;
- monitor, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type;
- transmit monitored transaction data to a monitoring server performing anomalous transaction detection;
- receive instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type;
- replace the monitoring agent with the replacement monitoring agent at runtime;
- and
- perform, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application.
5 more elements
Dependencies are inferred from the claim text.