Method and apparatus for monitoring a network data processing system
AssigneeInternational Business Machines Corporation
InventorLawrence Martin Moore
Life of this patent
Estimating the term…
Abstract
A method, apparatus, and computer instructions for identifying unauthorized users. User actions are monitored in an audit for an indication an unauthorized user logged into the data processing system with a valid user identifier and a valid password. An action is initiated in response to an indication of an unauthorized user.
Claims24
A method in a data processing system for identifying unauthorized users, the method comprising:
- monitoring for user actions in an audit for an indication an unauthorized user logged into the data processing system with a valid user identifier and a valid password;
- and
- responsive to an indication of an unauthorized user, initiating an action.
A method in a data processing system for handling unauthorized access to a network data processing system, the method comprising:
- recording user actions for each user logged into the network data processing system, wherein an audit is formed;
- monitoring for a pattern of user actions indicating a user is an unauthorized user;
- and
- initiating a security action if the user is identified as an unauthorized user.
A data processing system for identifying unauthorized users, the data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to monitor for user actions in an audit for an indication an unauthorized user logged into the data processing system with a valid user identifier and a valid password;
- and initiate an action in response to an indication of an unauthorized user.
A data processing system for handling unauthorized access to a network data processing system, the data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to record user actions for each user logged into the network data processing system in which an audit is formed;
- monitor for a pattern of user actions indicating a user is an unauthorized user;
- and initiate a security action if the user is identified as an unauthorized user.
A data processing system for identifying unauthorized users, the data processing system comprising:
- monitoring means for monitoring for user actions in an audit for an indication an unauthorized user logged into the data processing system with a valid user identifier and a valid password;
- and
- initiating means, responsive to an indication of an unauthorized user, for initiating an action.
A data processing system for handling unauthorized access to a network data processing system, the data processing system comprising:
- recording means for recording user actions for each user logged into the network data processing system, wherein an audit is formed;
- monitoring means for monitoring for a pattern of user actions indicating a user is an unauthorized user;
- and initiating means for initiating a security action if the user is identified as an unauthorized user.
A computer program product in a computer readable medium for identifying unauthorized users, the computer program product comprising:
- first instructions for monitoring for user actions in an audit for an indication an unauthorized user logged into the data processing system with a valid user identifier and a valid password;
- and
- second instructions, responsive to an indication of an unauthorized user, for initiating an action.
A computer program product in a computer readable medium for handling unauthorized access to a network data processing system, the computer program product comprising:
- first instructions for recording user actions for each user logged into the network data processing system, wherein an audit is formed;
- second instructions for monitoring for a pattern of user actions indicating a user is an unauthorized user;
- and
- third instructions for initiating a security action if the user is identified as an unauthorized user.
Dependencies are inferred from the claim text.