# US 10,454,955 B2 · Real-time contextual monitoring intrusion detection and prevention > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,955 B2 - Document ID: US10454955B2 - Status: Granted - Kind: B2 - Application number: 16/010,988 - Filed: 2018-06-18 - Published: 2018-10-18 - Granted: 2019-10-22 - Earliest claimed: 2015-07-28 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Elad Schulman; Amidan Tabak; Ofer Rivlin - Web page: https://patentgrep.com/patent/US10454955B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A configuration is received for an agent associated with an application to monitor application transactions. The agent monitors incoming and outgoing application transactions using the agent and transmits monitored transaction data to a monitoring server for anomalous transaction detection. The agent receives instructions from the monitoring server to perform an action based on the transmitted monitored transaction data and reports the status of the performed action to the monitoring server. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application; monitoring, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type; transmitting monitored transaction data to a monitoring server performing anomalous transaction detection; receiving instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type; replacing the monitoring agent with the replacement monitoring agent at runtime; and performing, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application. ### Claim 2 (depends on 1) The method of claim 1, wherein the monitoring agent tags the monitored transaction data with contextual information associated with the monitored application transactions for use by the monitoring server in forming complete transactions between different applications to analyze the complete transactions for anomalous transactions. ### Claim 3 (depends on 2) The method of claim 2, wherein the configuration of the agent can be dynamically updated during agent runtime in response to a determination of at least one detected anomalous transaction, wherein the anomalous transaction is associated with a particular user as identified at least in part by the contextual information tagged by the monitoring agent, wherein the received instructions from the monitoring server further include the dynamically updated configuration, and wherein the dynamically updated configuration instructs the monitoring agent to redirect at least a portion of attempted incoming and outgoing transactions associated with the particular user to a honeypot application. ### Claim 4 (depends on 1) The method of claim 1, wherein agent code is inserted and compiled into the application code as part of the application. ### Claim 5 (depends on 1) The method of claim 1, wherein the transactions are performed using the secure shell (SSH) protocol. ### Claim 6 (depends on 1) The method of claim 1, wherein the anomalous transaction detection is performed using a learning machine using behavior models continuously updated by learning machine determinations. ### Claim 7 A non-transitory, computer-readable medium storing computer-readable instructions, the instructions executable by a computer and configured to: receive a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application; monitor, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type; transmit monitored transaction data to a monitoring server performing anomalous transaction detection; receive instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type; replace the monitoring agent with the replacement monitoring agent at runtime; and perform, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application. ### Claim 8 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the monitoring agent tags the monitored transaction data with contextual information associated with the monitored application transactions for use by the monitoring server in forming complete transactions between different applications to analyze the complete transactions for anomalous transactions. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the configuration of the agent can be dynamically updated during agent runtime in response to a determination of at least one detected anomalous transaction, wherein the anomalous transaction is associated with a particular user as identified at least in part by the contextual information tagged by the monitoring agent, wherein the received instructions from the monitoring server further include the dynamically updated configuration, and wherein the dynamically updated configuration instructs the monitoring agent to redirect at least a portion of attempted incoming and outgoing transactions associated with the particular user to a honeypot application. ### Claim 10 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein agent code is inserted and compiled into the application code as part of the application. ### Claim 11 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the transactions are performed using the secure shell (SSH) protocol. ### Claim 12 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the anomalous transaction detection is performed using a learning machine using behavior models continuously updated by learning machine determinations. ### Claim 13 A computer-implemented system, comprising: at least one hardware processor interoperably coupled with a computer memory and configured to: receive a configuration at a monitoring agent integrated into a particular executing application, the monitoring agent operable when executed by at least one processor to monitor incoming and outgoing application transactions performed by the particular executing application; monitor, by the monitoring agent, incoming and outgoing application transactions of the particular executing application based on the received configuration, wherein the monitoring agent can be dynamically replaced with a different monitoring agent with differing capabilities during runtime in response to a determination of at least one detected anomalous transaction of at least one particular anomaly type, wherein the monitoring agent is determined to be inadequate to manage the particular anomaly type; transmit monitored transaction data to a monitoring server performing anomalous transaction detection; receive instructions from the monitoring server in response to the monitoring server detecting one or more anomalous transactions of the at least one particular anomaly type, the received instructions comprising instructions to dynamically replace the monitoring agent with a replacement monitoring agent determined to be capable of managing the at least one particular anomaly type; replace the monitoring agent with the replacement monitoring agent at runtime; and perform, by the replacement monitoring agent, monitoring of future incoming and outgoing applications transactions performed by the particular executing application. ### Claim 14 (depends on 13) The computer-implemented system of claim 13, wherein the monitoring agent tags the monitored transaction data with contextual information associated with the monitored application transactions for use by the monitoring server in forming complete transactions between different applications to analyze the complete transactions for anomalous transactions. ### Claim 15 (depends on 14) The computer-implemented system of claim 14, wherein the configuration of the agent can be dynamically updated during agent runtime in response to a determination of at least one detected anomalous transaction, wherein the anomalous transaction is associated with a particular user as identified at least in part by the contextual information tagged by the monitoring agent, wherein the received instructions from the monitoring server further include the dynamically updated configuration, and wherein the dynamically updated configuration instructs the monitoring agent to redirect at least a portion of attempted incoming and outgoing transactions associated with the particular user to a honeypot application. ### Claim 16 (depends on 13) The computer-implemented system of claim 13, wherein agent code is inserted and compiled into the application code as part of the application. ### Claim 17 (depends on 13) The computer-implemented system of claim 13, wherein the transactions are performed using the secure shell (SSH) protocol. ### Claim 18 (depends on 13) The computer-implemented system of claim 13, wherein the anomalous transaction detection is performed using a learning machine using behavior models continuously updated by learning machine determinations.