# US 2013/0160129 A1 · System security evaluation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160129 A1 - Document ID: US20130160129A1 - Status: Published application - Kind: A1 - Application number: 13/329,920 - Filed: 2011-12-19 - Published: 2013-06-20 - Earliest claimed: 2011-12-19 - Assignees: Verizon Patent and Licensing Inc. - Inventors: A. Bryan SARTIN; Gina M. GANLEY; Kevin LONG; Jo Ann JOELS - Web page: https://patentgrep.com/patent/US20130160129A1 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computing device may receive external activity data corresponding to a target system. The external activity data may include information corresponding to network-side information relating to the target system. The computing device may identify suspicious external activity, corresponding to the external activity data, based on an activity watchlist. The activity watchlist may include information corresponding to external activity systems associated with known sources of malicious activity. The computing device may generate a system security report based on the suspicious external activity identified. ## Claims ### Claim 1 A method, comprising: receiving, by a computing device, external activity data corresponding to a target system, where the external activity data comprises information corresponding to network-side information relating to the target system; identifying, by the computing device, suspicious external activity, corresponding to the external activity data, based on an activity watchlist, where the activity watchlist comprises information corresponding to external activity systems associated with known sources of malicious activity; and generating, by the computing device, a system security report based on the suspicious external activity identified. ### Claim 2 (depends on 1) The method of claim 1, further comprising: detecting a potential system vulnerability corresponding to the target system; and verifying that the potential system vulnerability comprises an actual system vulnerability. ### Claim 3 (depends on 2) The method of claim 2, where detecting the potential system vulnerability comprises: executing a vulnerability scan operation directed at the target system. ### Claim 4 (depends on 2) The method of claim 2, where the external activity data is limited to external activity data corresponding to the actual system vulnerability. ### Claim 5 (depends on 1) The method of claim 1, further comprising: identifying suspicious external activity, corresponding to the external activity data, based on a security evaluation mechanism, where the security evaluation mechanism comprises an operation to identify a suspicious characteristic corresponding to the external activity data. ### Claim 6 (depends on 5) The method of claim 5, where the suspicious characteristic comprises at least one of: a particular external activity system interacting with the target system from an atypical geographic location, external activity occurring at an atypical time of day for the target system, an external activity system interacting with the target system via a virtual private network, an external activity system interacting with the target system via a proxy server, an external activity system interacting with the target system via a remote desktop device, an atypical volume of interactions between an external activity system and the target system, or an atypical data transfer between an external activity system and the target system. ### Claim 7 (depends on 1) The method of claim 1, where the system security report comprises information describing a level of security corresponding to the target system. ### Claim 8 (depends on 1) The method of claim 1, further comprising: providing the system security report to a reporting system to notify the reporting system of a level of security corresponding to the target system. ### Claim 9 A computing device, comprising: a memory to store instructions; and a processor, connected to the memory, to execute the instructions to: receive external activity data corresponding to a target system, where the external activity data comprises information corresponding to network-side information relating to the target system, identify suspicious external activity, corresponding to the external activity data, based on an activity watchlist, where the activity watchlist comprises information corresponding to external activity systems associated with known sources of malicious activity; identify suspicious external activity, corresponding to the external activity data, based on a security evaluation mechanism, where the security evaluation mechanism comprises an operation to identify a suspicious characteristic corresponding to the external activity data; and generate a system security report based on the suspicious external activity identified. ### Claim 10 (depends on 9) The computing device of claim 9, where the processor is further to: detect a potential system vulnerability corresponding to the target system, and verify that the potential system vulnerability comprises an actual system vulnerability. ### Claim 11 (depends on 10) The computing device of claim 10, where, to detect the potential system vulnerability, the processor is to: execute a vulnerability scan operation directed at the target system. ### Claim 12 (depends on 10) The computing device of claim 10, where the external activity data is limited to external activity data corresponding to the actual system vulnerability. ### Claim 13 (depends on 9) The computing device of claim 9, where the suspicious characteristic comprises at least one of: a particular external activity system interacting with the target system from an atypical geographic location, external activity occurring at an atypical time of day for the target system, an external activity system interacting with the target system via a virtual private network, an external activity system interacting with the target system via a proxy server, an external activity system interacting with the target system via a remote desktop device, an atypical volume of interactions between an external activity system and the target system, or an atypical data transfer between an external activity system and the target system. ### Claim 14 (depends on 9) The computing device of claim 9, where the system security report comprises information describing a level of security corresponding to the target system. ### Claim 15 (depends on 9) The computing device of claim 9, where the processor is further to: provide the system security report to a reporting system to notify the reporting system of a level of security corresponding to the target system. ### Claim 16 One or more non-transitory computer-readable storage media, comprising: one or more instructions that, when executed by a processor, cause the processor to: detect a potential system vulnerability corresponding to a target system, verify that the potential system vulnerability comprises an actual system vulnerability, receive external activity data corresponding to the target system, where the external activity data comprises information corresponding to network-side information relating to the target system, identify suspicious external activity, corresponding to the external activity data, based on an activity watchlist, where the activity watchlist comprises information corresponding to external activity systems associated with known sources of malicious activity; identify suspicious external activity, corresponding to the external activity data, based on a security evaluation mechanism, where the security evaluation mechanism comprises an operation to identify a suspicious characteristic corresponding to the external activity data; and generate a system security report based on the suspicious external activity identified. ### Claim 17 (depends on 16) The computer-readable storage media of claim 16, where the one or more instructions cause the processor to: execute a vulnerability scan operation directed at the target system to detect the potential system vulnerability. ### Claim 18 (depends on 16) The computer-readable storage media of claim 16, where the external activity data is limited to external activity data corresponding to the actual system vulnerability. ### Claim 19 (depends on 16) The computer-readable storage media of claim 16, where the suspicious characteristic comprises at least one of: a particular external activity system interacting with the target system from an atypical geographic location, external activity occurring at an atypical time of day for the target system, an external activity system interacting with the target system via a virtual private network, an external activity system interacting with the target system via a proxy server, an external activity system interacting with the target system via a remote desktop device, an atypical volume of interactions between an external activity system and the target system, or an atypical data transfer between an external activity system and the target system. ### Claim 20 (depends on 16) The computer-readable storage media of claim 16, where the system security report comprises information describing a level of security corresponding to the target system.