Back to results
US 11,775,622 B2Granted
Account monitoring
AssigneeForescout Technologies, Inc.
InventorsChunhui Zhan, Siying Yang
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for account access monitoring are described. In certain aspects, a login request associated with a device can be analyzed and a score determined. The score and a threshold can be used to determine whether to initiate an action.
Claims19
A method comprising:
- accessing information associated with a login request, wherein the login request is associated with a physical location, and wherein the information associated with the login request comprises a login duration;
- comparing a portion of the information associated with the login request with baseline information associated with a plurality of previous login requests, wherein the baseline information comprises network addresses, device properties, and security posture of one or more devices associated with the plurality of previous login requests;
- determining a score associated with the login request based on the comparing of the information associated with the login request with the baseline information associated with the previous login request and information associated with a device that sent the login request;
- accessing a threshold;
- determining, by a processing device, whether to initiate a security action based on the score associated with the login request and the threshold;
- and
- storing the information associated with the login request.
4 more elements
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- access information associated with a login request, wherein information associated with the login request comprises a physical location, and wherein the information associated with the login request comprises a login duration;
- compare a portion of the information associated with the login request with baseline information associated with a plurality of previous login requests, wherein the information associated with the previous login request comprises a one or more security properties of a device associated with the login request, wherein the baseline information comprises network addresses, device properties, and security posture of one or more devices associated with the plurality of previous login requests;
- determine a score associated with the login request based on the information associated with the previous login request based on the comparing of the information associated with the login request with the baseline information associated with the previous login request and information associated with a device that sent the login request;
- access a threshold;
- determine whether to initiate an action based on the score associated with the login request and the threshold;
- and
- store the information associated with the login request.
7 more elements
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- access information associated with a login request, wherein the login request is associated with a physical location, and wherein the information associated with the login request comprises a login duration;
- compare a portion of the information associated with the login request with baseline information associated with a plurality of previous login requests, wherein the information associated with the login request comprises a login information entry time, wherein the baseline information comprises network addresses, device properties, and security posture of one or more devices associated with the plurality of previous login requests;
- determine a score associated with the login request based on the information associated with the previous login request based on the comparing of the information associated with the login request with the baseline information associated with the previous login request and information associated with a device that sent the login request;
- access a threshold;
- determine whether to initiate a security action based on the score associated with the login request and the threshold;
- and
- store the information associated with the login request.
4 more elements
Dependencies are inferred from the claim text.