# US 10,484,409 B2 · Systems, methods, and computer-readable media for data security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,409 B2 - Document ID: US10484409B2 - Status: Granted - Kind: B2 - Application number: 15/582,786 - Filed: 2017-05-01 - Published: 2017-08-17 - Granted: 2019-11-19 - Earliest claimed: 2014-01-30 - Assignees: Nasdaq, Inc. - Applicants: Nasdaq, Inc. - Inventors: Stuart Ogawa - Web page: https://patentgrep.com/patent/US10484409B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) - G06F 16/951: Indexing; Web crawling techniques - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In a server system providing data security, a processor monitors requests or activities of a computing device and compares the monitored requests or activities with a database of predetermined characteristics to determine whether the monitored requests or activities indicates that the computing device (i) accessed or attempted to access sequentially more than a predetermined number of data files or objects in less than a predetermined period of time, and (ii) downloaded a predetermined number of data files or objects. The monitored requests or activities is determined suspicious when the comparing determines that (i) and (ii) are true, which causes a response to hinder the monitored requests or activities. ## Claims ### Claim 1 A method performed at a data security computing system that includes one or more processor devices, one or more communication devices, and one or more memories, the method comprising: monitoring, by the data security computing system, one or more requests or activities of a computing device; comparing, by the data security computing system, the monitored one or more requests or activities with a database of predetermined characteristics to determine whether the monitored one or more requests or activities indicates that the computing device (i) accessed or attempted to access sequentially more than a number of data files or objects in less than a predetermined period of time, and (ii) downloaded more than X data files or objects; determining, by the data security computing system, that the monitored one or more requests or activities is suspicious when the comparing determines that the monitored one or more requests or activities indicate that the computing device (i) accessed or attempted to access sequentially more than the number of data files or objects in less than a predetermined period of time, and (ii) downloaded more than X data files or objects; and initiating, by the data security computing system, a response to hinder the monitored one or more requests or activities when the monitored one or more requests or activities is determined to be suspicious. ### Claim 2 (depends on 1) The method of claim 1, further comprising: associating a marker to marked monitored one or more requests or activities determined to be suspicious which indicates that a data security action for the marked one or more requests or activities should be taken. ### Claim 3 (depends on 1) The method of claim 1, wherein X=B+(Y % of B) and X, B, and Y are adjustable parameters. ### Claim 4 (depends on 1) The method of claim 1, further comprising comparing the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when an IP address of the computing device matches a known suspicious IP address. ### Claim 5 (depends on 1) The method of claim 1, further comprising comparing the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the monitored one or more requests or activities includes the computing device submitted at least a predetermined number of search terms within less than a predetermined period of time. ### Claim 6 (depends on 1) The method of claim 1, further comprising comparing the monitored one or more requests or activities with the database of predetermined characteristics to determine that the request is suspicious when the computing device submits a search term that included more than at least one of a predetermined number of characters and a predetermined number of keywords. ### Claim 7 (depends on 1) The method of claim 1, further comprising comparing the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the computing device makes more than a predetermined number of searches related to a same topic. ### Claim 8 (depends on 1) The method of claim 1, further comprising comparing the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the computing device submits data in a format does not match an expected format. ### Claim 9 (depends on 1) The method of claim 1, wherein the response includes terminating a communication channel with the computing device. ### Claim 10 (depends on 1) The method of claim 1, wherein the response includes deleting the monitored one or more requests or activities from a first server, and storing a copy of the monitored one or more requests or activities in a secondary server. ### Claim 11 A server system configured to provide data security, comprising: one or more processor devices, one or more communication interfaces; one or more memory devices including computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to: monitor one or more requests or activities of a computing device; compare the monitored one or more requests or activities with a database of predetermined characteristics to determine whether the monitored one or more requests or activities indicates that the computing device (i) accessed or attempted to access sequentially more than a number of data files or objects in less than a predetermined period of time, and (ii) downloaded more than X data files or objects; determine that the monitored one or more requests or activities is suspicious when the comparing determines that the monitored one or more requests or activities indicate that the computing device (i) accessed or attempted to access sequentially more than the number of data files or objects in less than a predetermined period of time, and (ii) downloaded more than X data files or objects; and initiate a response to hinder the monitored one or more requests or activities when the monitored one or more requests or activities is determined to be suspicious. ### Claim 12 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to associate a marker to marked monitored one or more requests or activities determined to be suspicious which indicates that a data security action for the marked one or more requests or activities should be taken. ### Claim 13 (depends on 11) The server system of claim 11, wherein X=B+(Y % of B) and X, B, and Y are adjustable parameters. ### Claim 14 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to compare the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when an IP address of the computing device matches a known suspicious IP address. ### Claim 15 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to compare the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the monitored one or more requests or activities includes the computing device submitted at least a predetermined number of search terms within less than a predetermined period of time. ### Claim 16 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to compare the monitored one or more requests or activities with the database of predetermined characteristics to determine that the request is suspicious when the computing device submits a search term that included more than at least one of a predetermined number of characters and a predetermined number of keywords. ### Claim 17 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to compare the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the computing device makes more than a predetermined number of searches related to a same topic. ### Claim 18 (depends on 11) The server system of claim 11, further comprising computer-executable instructions, which when executed by the one or more processor devices, cause the one or more processor devices to compare the monitored one or more requests or activities with the database of predetermined characteristics to determine that the monitored one or more requests or activities is suspicious when the computing device submits data in a format does not match an expected format. ### Claim 19 (depends on 11) The server system of claim 11, wherein the response includes terminating a communication channel with the computing device. ### Claim 20 (depends on 11) The server system of claim 11, wherein the response includes deleting the data from a first server and storing a copy of the data in a secondary server. ### Claim 21 A non-transitory, computer-readable medium having instructions stored thereon which, when executed at a data security computing system that includes one or more processor devices, one or more communication devices, and one or more memories, cause the data security computing system to perform operations that include: receiving, at the data security computing system, a request for data from a computing device; determining, at the data security computing system, characteristics associated with the request for data; determining, at the data security computing system, whether the request for the data is suspicious, wherein the determining whether the request for the data is suspicious includes comparing the determined characteristics with a database of predetermined characteristics to determine whether the determined characteristics indicate that the computing device (i) accessed or attempted to access sequentially more than a number of data files or objects in less than a predetermined period of time, and (ii) downloaded more than X data files or objects; and initiating, at the data security computing system, a response to hinder the request for the data when the request is determined to be suspicious.