Detection of anomalous network activity
AssigneeCanon Kabushiki Kaisha
InventorsHari Rathod, Allison Bajo, Samuel Schrader
Life of this patent
Estimating the term…
Abstract
Access to web services is managed. Metrics associated with accesses to a service are collected, and the metrics include activities associated with a user. A profile associated with the user is generated and updated. One or more metrics of an incoming access request to the service are compared against the profile using a statistical measure and a corresponding threshold for detecting an anomaly. The threshold is determined based on associations between a distribution of the metrics of the profile and a subset of other profile metric distributions. There is a determination of whether the incoming access request is an anomaly based on the comparison.
Claims24
A method for managing access to one or more web services, the method comprising:
- collecting metrics associated with accesses to a service, wherein the metrics include activities associated with a user;
- generating and updating a profile associated with the user;
- comparing one or more metrics of an incoming access request to the service against the profile using a statistical measure and a corresponding threshold for detecting an anomaly, wherein the threshold is determined based on associations between a distribution of the metrics of the profile and a subset of other profile metric distributions;
- and
- determining whether the incoming access request is an anomaly based on the comparison.
An apparatus for apparatus for managing access to one or more web services, comprising:
- a computer-readable memory constructed to store computer-executable process steps;
- and
- a processor constructed to execute the process steps stored in the memory, wherein the process steps cause the processor to:
- collect metrics associated with accesses to a service, wherein the metrics include activities associated with a user;
- generate and updating a profile associated with the user;
- compare one or more metrics of an incoming access request to the service against the profile using a statistical measure and a corresponding threshold for detecting an anomaly, wherein the threshold is determined based on associations between a distribution of the metrics of the profile and a subset of other profile metric distributions;
- and
- determine whether the incoming access request is an anomaly based on the comparison.
A non-transitory computer-readable storage medium storing computer-executable process steps for causing a computer to perform a method for managing access to one or more web services, the method comprising:
- collecting metrics associated with accesses to a service, wherein the metrics include activities associated with a user;
- generating and updating a profile associated with the user;
- comparing one or more metrics of an incoming access request to the service against the profile using a statistical measure and a corresponding threshold for detecting an anomaly, wherein the threshold is determined based on associations between a distribution of the metrics of the profile and a subset of other profile metric distributions;
- and
- determining whether the incoming access request is an anomaly based on the comparison.
Dependencies are inferred from the claim text.