Behavioral analysis of scripting utility usage in an enterprise
AssigneeCA, Inc.
InventorsAkshata Krishnamoorthy Rao, Douglas Schlatter, Adam Glick, Feng Li
Life of this patent
Estimating the term…
Abstract
A method for behavioral analysis of scripting utility usage in an enterprise is described. In one embodiment, the method describes receiving, by a processor, data associated with execution of a scripting utility operating on a plurality of computing devices; executing a clustering algorithm on the received data; identifying at least one cluster based at least in part on executing the clustering algorithm; identifying an existence of an anomalous event associated with the scripting utility based at least in part on executing the clustering algorithm; and transmitting an indication of the anomalous event to an administrator.
Claims19
A method of behavioral analysis, comprising:
- receiving, by a processor, data associated with execution of a scripting utility operating on a plurality of computing devices;
- executing, by the processor, a clustering algorithm on the received data;
- identifying, by the processor, at least a first cluster corresponding to a first subset of the plurality of computing devices that execute a first usage of the scripting utility and a second cluster corresponding to a second subset of the plurality of computing devices that execute a second usage of the scripting utility that is different from the first usage of the scripting utility based at least in part on executing the clustering algorithm;
- identifying, by the processor, an existence of an anomalous event associated with the scripting utility based at least in part on executing the clustering algorithm, identifying the existence of the anomalous event including determining the anomalous event is an anomaly with respect to each computing device of the first subset of computing devices that execute the first usage of the scripting utility and the second subset of computing devices that execute the second usage of the scripting utility;
- and
- transmitting, by the processor, an indication of the anomalous event to an administrator.
A computing device configured for behavioral analysis, comprising:
- a processor;
- and
- memory in electronic communication with the processor, wherein the memory stores computer executable instructions that when executed by the processor cause the processor to perform the steps of:
- receiving data associated with execution of a scripting utility operating on a plurality of computing devices;
- executing a clustering algorithm on the received data;
- identifying at least a first cluster corresponding to a first subset of the plurality of computing devices that execute a first usage of the scripting utility and a second cluster corresponding to a second subset of the plurality of computing devices that execute a second usage of the scripting utility that is different from the first usage of the scripting utility based at least in part on executing the clustering algorithm;
- identifying an existence of an anomalous event associated with the scripting utility based at least in part on executing the clustering algorithm, identifying the existence of the anomalous event including determining the anomalous event is an anomaly with respect to each computing device of the first subset of computing devices that execute the first usage of the scripting utility and the second subset of computing devices that execute the second usage of the scripting utility;
- and
- transmitting an indication of the anomalous event to an administrator.
A non-transitory computer-readable storage medium storing computer executable instructions that when executed by a processor cause the processor to perform the steps of:
- receiving data associated with execution of a scripting utility operating on a plurality of computing devices;
- executing a clustering algorithm on the received data;
- identifying at least a first cluster corresponding to a first subset of the plurality of computing devices that execute a first usage of the scripting utility and a second cluster corresponding to a second subset of the plurality of computing devices that execute a second usage of the scripting utility that is different from the first usage of the scripting utility based at least in part on executing the clustering algorithm;
- identifying an existence of an anomalous event associated with the scripting utility based at least in part on executing the clustering algorithm, identifying the existence of the anomalous event including determining the anomalous event is an anomaly across each computing device of the plurality of computing devices;
- and
- transmitting an indication of the anomalous event to an administrator.
Dependencies are inferred from the claim text.