Intrusion detection
AssigneeEMC IP Holding Company LLC
InventorKenneth Byrne
Life of this patent
Estimating the term…
Abstract
Techniques are provided for intrusion detection on a computer system. In an example, a computer host device is configured to access data storage of the computer system via a communications network. It can be determined that the computer host device is behaving anomalously because a first current access by the computer host device to the data storage deviates from a second expected access by the computer host device to the data storage by more than a predefined amount. Then, in response to determining that the computer host device is behaving anomalously, the computer system can mitigate against the computer host device behaving anomalously.
Claims20
A system, comprising:
- a processor;
- and
- a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
- enabling a first computer host device to access data storage via a communications network;
- determining a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device that exhibit anomalous access to the data storage;
- determining that the first computer host device is exhibiting an anomalous behavior based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage;
- in response to determining that the first computer host device is exhibiting the anomalous behavior, mitigating the anomalous behavior of the first computer host device.
A method, comprising:
- configuring, by a system comprising a processor, a first computer host device with access to data storage via a communications network;
- determining, by the system, a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device, wherein the second computer host device and the third computer host device exhibit anomalous access to the data storage;
- determining, by the system, that the first computer host device is operating anomalously based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage;
- and
- mitigating, by the system, an effect resulting from the first computer host device operating anomalously.
A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
- determining a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device that exhibit anomalous access to data storage;
- determining that a first computer host device is behaving anomalously based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage;
- and
- initiating a mitigation action with respect to the first computer host device behaving anomalously.
Dependencies are inferred from the claim text.