# US 2013/0160119 A1 · System security monitoring

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0160119 A1
- Document ID: US20130160119A1
- Status: Published application
- Kind: A1
- Application number: 13/329,931
- Filed: 2011-12-19
- Published: 2013-06-20
- Earliest claimed: 2011-12-19
- Assignees: Verizon Patent and Licensing Inc.
- Inventors: A. Bryan SARTIN; Gina M. Ganley; Kevin Long; Jo Ann Joels; Andrew J. Bonillo, JR.
- Web page: https://patentgrep.com/patent/US20130160119A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A computing device may receive netflow data that includes information corresponding to network-side activity associated with a target device. The computing device may evaluate the netflow data based on a netflow signature to identify potentially malicious activity. The netflow signature may include information corresponding to two or more network events occurring in a particular order. The computing device may report, to another computing device, that potentially malicious activity, corresponding to the network data, has been detected based on the evaluation of the netflow data.

## Claims

### Claim 1

A method, comprising:
receiving, by a computing device, netflow data,
where the netflow data comprises information corresponding to network-side activity associated with a target device;
evaluating, by the computing device, the netflow data based on a netflow signature to identify potentially malicious activity,
where the netflow signature comprises information corresponding to two or more network events occurring in a particular order, and
reporting, by the computing device and to another computing device, that potentially malicious activity, corresponding to the netflow data, has been detected based on the evaluation of the netflow data.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
prior to reporting that potentially malicious activity has been detected, determining a risk factor based on the evaluation of the netflow data,
where the risk factor corresponds to a level of risk associated with the netflow data; and
determining whether the risk factor exceeds a risk threshold,
where the risk threshold comprises a threshold level of risk associated with the target device.

### Claim 3 (depends on 1)

The method of claim 1, where evaluating the netflow data further comprises:
evaluating the netflow data based on an activity watchlist, where the activity watchlist comprises an identifier corresponding to an external activity device.

### Claim 4 (depends on 3)

The method of claim 3, where the activity watchlist comprises at least one of:
an identifier corresponding to an external activity system previously identified as a source of malicious activity,
an identifier corresponding to an external activity system previously identified as a source of suspicious activity, or
an identifier corresponding to an external activity system previously involved in a system security investigation.

### Claim 5 (depends on 1)

The method of claim 1, where the netflow signature comprises information corresponding to two or more events occurring in a particular order and within a particular amount of time.

### Claim 6 (depends on 1)

The method of claim 1, where the netflow signature comprises information corresponding to at least one of:
pre-attack research corresponding to the target device,
points of intrusion corresponding to the target device,
unauthorized access corresponding to the target device,
data extraction corresponding to the target device,
malicious activity corresponding to the target device, or
criminal activity corresponding to the target device.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
receiving feedback data associated with the potentially malicious activity; and
updating a netflow data evaluation operation based on the feedback data.

### Claim 8 (depends on 7)

The method of claim 7, where the netflow data evaluation operation comprises at least one of:
an operation to evaluate netflow data based on the netflow signature,
an operation to evaluate netflow data based on an activity watchlist,
an operation to determine a risk factor based on netflow data,
an operation to determine a risk threshold corresponding to the target system, or
an operation to report potentially malicious activity.

### Claim 9

A computing device, comprising:
a memory comprising instructions; and
a processor, connected to the memory, to execute the instructions to:
receive netflow data from an activity collection system;
where the netflow data comprises information corresponding to network-side activity associated with a target device;
evaluate the netflow data based on a netflow signature to identify potentially malicious activity,
where the netflow signature comprises information corresponding to two or more network events occurring in a particular order,
evaluate the netflow data based on an activity watchlist to identify potentially malicious activity,
where the activity watchlist comprises an identifier corresponding to an external activity device; and
report, to another computing device, that potentially malicious activity, corresponding to the netflow data, has been detected based on the evaluation of the netflow data.

### Claim 10 (depends on 9)

The computing device of claim 9, where the processor, prior to reporting that potentially malicious activity has been detected, is to:
determine a risk factor based on the evaluation of the netflow data,
where the risk factor corresponds to a level of risk associated with the netflow data; and
determine whether the risk factor exceeds a risk threshold,
where the risk threshold comprises a threshold level of risk associated with the target device.

### Claim 11 (depends on 9)

The computing device of claim 9, where the activity watchlist comprises at least one of:
an identifier corresponding to an external activity system previously identified as a source of malicious activity,
an identifier corresponding to an external activity system previously identified as a source of suspicious activity, or
an identifier corresponding to an external activity system previously involved in a system security investigation.

### Claim 12 (depends on 9)

The computing device of claim 9, where the netflow signature comprises information corresponding to two or more events occurring in a particular order and within a particular amount of time.

### Claim 13 (depends on 9)

The computing device of claim 9, where the netflow signature comprises information corresponding to at least one of:
pre-attack research corresponding to the target device,
points of intrusion corresponding to the target device,
unauthorized access corresponding to the target device,
data extraction corresponding to the target device,
malicious activity corresponding to the target device, or
criminal activity corresponding to the target device.

### Claim 14 (depends on 9)

The computing device of claim 9, where the processor is further to:
receive feedback data associated with the potentially malicious activity; and
update a netflow data evaluation operation based on the feedback data.

### Claim 15 (depends on 14)

The computing device of claim 14, where the netflow data evaluation operation comprises at least one of:
an operation to evaluate netflow data based on the netflow signature,
an operation to evaluate netflow data based on an activity watchlist,
an operation to determine a risk factor based on netflow data,
an operation to determine a risk threshold corresponding to the target system, or
an operation to report potentially malicious activity.

### Claim 16

One or more non-transitory computer-readable storage media, comprising:
one or more instructions that, when executed by a processor, cause the processor to:
receive netflow data from an activity collection system,
where the netflow data comprises information corresponding to network-side activity associated with a target device,
evaluate the netflow data based on a netflow signature to identify potentially malicious activity,
where the netflow signature comprises information corresponding to two or more network events occurring in a particular order,
report, to another computing device, that potentially malicious activity, corresponding to the netflow data, has been detected based on the evaluation of the netflow data,
receive feedback data associated with the potentially malicious activity, and
update a netflow data evaluation operation based on the feedback data.

### Claim 17 (depends on 16)

The computer-readable storage media of claim 16, where the one or more instructions cause the processor, prior to reporting that potentially malicious activity has been detected, further to:
determine a risk factor based on the evaluation of the netflow data,
where the risk factor corresponds to a level of risk associated with the netflow data, and
determine whether the risk factor exceeds a risk threshold,
where the risk threshold comprises a threshold level of risk associated with the target device.

### Claim 18 (depends on 16)

The computer-readable storage media of claim 16, where the one or more instructions cause the processor further to:
evaluate the netflow data based on an activity watchlist to identify potentially malicious activity,
where the activity watchlist comprises at least one of:
an identifier corresponding to an external activity system previously identified as a source of malicious activity,
an identifier corresponding to an external activity system previously identified as a source of suspicious activity, or
an identifier corresponding to an external activity system previously involved in a system security investigation.

### Claim 19 (depends on 16)

The computer-readable storage media of claim 16, where the netflow signature comprises information corresponding to at least one of:
pre-attack research corresponding to the target device,
points of intrusion corresponding to the target device,
unauthorized access corresponding to the target device,
data extraction corresponding to the target device,
malicious activity corresponding to the target device, or
criminal activity corresponding to the target device.

### Claim 20 (depends on 16)

The computer-readable storage media of claim 16, where the netflow data evaluation operation comprises at least one of:
an operation to evaluate netflow data based on the netflow signature,
an operation to evaluate netflow data based on an activity watchlist,
an operation to determine a risk factor based on netflow data,
an operation to determine a risk threshold corresponding to the target system, or
an operation to report potentially malicious activity.