Back to results
US 10,476,895 B2Granted
Intrusion detection and response system
AssigneeSap SE
InventorCédric Hebert
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for intrusion detection and response. An embodiment operates by receiving one or more events corresponding to one or more user actions performed during a connectivity session to a computer system. The received one or more events are compared to one or more intrusion parameters associated with the computer system. It is determined that the received one or more events correspond to the intrusion event and that the user actions are performed on a first version of the computer system. The connectivity session is switched from the first version of the computer system to a second version of the computer system responsive to the determination of the intrusion event.
Claims20
A method, comprising:
- receiving a plurality of events corresponding to one or more user actions received from one or more computing devices during each of a plurality of connectivity sessions to a computer system, wherein each of the plurality of connectivity sessions comprises one or more of the one or more user actions corresponding to the plurality of events;
- comparing the received plurality of events to one or more intrusion parameters associated with the computer system, wherein the intrusion parameters comprise criteria that indicates whether the plurality of events correspond to an intrusion event;
- determining, based on the comparison, that the received plurality of events across the plurality of connectivity sessions correspond to the intrusion event;
- determining that one or more of the one or more user actions are performed on a first version of the computer system during a particular connectivity session of the plurality of connectivity sessions;
- and
- switching, by a version selector, the particular connectivity session from the first version of the computer system, to which a first one or more of the computing devices was connected, to a second version of the computer system responsive to the determination of the intrusion event, wherein the second version of the computer system includes one or more features designed to prevent access one or more resources included in the first version of the computer system based on the intrusion event.
3 more elements
A system, comprising:
- a non-transitory memory;
- and
- at least one processor coupled to the memory and configured to perform operations comprising:
- receiving a plurality of events corresponding to one or more user actions received from one or more computing devices during each of a plurality of connectivity sessions to a computer system, wherein each of the plurality of connectivity sessions comprises one or more of the one or more user actions corresponding to the plurality of events;
- comparing the received plurality of events to one or more intrusion parameters associated with the computer system, wherein the intrusion parameters comprise criteria that indicates whether the plurality of events correspond to an intrusion event;
- determining, based on the comparison, that the received plurality of events across the plurality of connectivity sessions correspond to the intrusion event;
- determining that one or more of the one or more user actions are performed on a first version of the computer system during a particular connectivity session of the plurality of connectivity sessions;
- and
- switching, by a version selector, the particular connectivity session from the first version of the computer system, to which a first one or more of the computing devices was connected, to a second version of the computer system responsive to the determination of the intrusion event, wherein the second version of the computer system includes one or more features designed to prevent access one or more resources included in the first version of the computer system based on the intrusion event.
6 more elements
A tangible computer-readable device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:
- receiving a plurality of events corresponding to one or more user actions received from one or more computing devices during each of a plurality of connectivity sessions to a computer system, wherein each of the plurality of connectivity sessions comprises one or more of the one or more user actions corresponding to the plurality of events;
- comparing the received plurality of events to one or more intrusion parameters associated with the computer system, wherein the intrusion parameters comprise criteria that indicates whether the plurality of events correspond to an intrusion event;
- determining, based on the comparison, that the received plurality of events across the plurality of connectivity sessions correspond to the intrusion event;
- determining that one or more of the one or more user actions are performed on a first version of the computer system during a particular connectivity session of the plurality of connectivity sessions;
- and
- switching, by a version selector, the particular connectivity session from the first version of the computer system, to which a first one or more of the computing devices was connected, to a second version of the computer system responsive to the determination of the intrusion event, wherein the second version of the computer system includes one or more features designed to prevent access one or more resources included in the first version of the computer system based on the intrusion event.
3 more elements
Dependencies are inferred from the claim text.