Detecting attacks by matching of access frequencies and sequences in different software layers
AssigneeSap SE
InventorsMartin HAERTERICH, Martin JOHNS
Life of this patent
Estimating the term…
Abstract
A number of events are counted in different layers of a computing environment during execution of a software application. The number of counted events can be compared to a previously generated cluster set to determine that at least one of the counted events is an outlier. Data can then be provided that characterizes the at least one of the counted events determined to be an outlier. In some cases, some or all of the functionality of the software application can be selectively disabled. Related apparatus, systems, techniques and articles are also described.
Claims20
A method for implementation by one or more data processors forming part of at least one computing device, the method comprising:
- counting, in different layers of a computing environment, a number of events occurring during execution of a software application;
- comparing the number of counted events to a previously generated cluster set to determine that at least one of the counted events is an outlier;
- and
- providing data characterizing the at least one of the counted events determined to be an outlier.
A system comprising:
- at least one data processor;
- and
- memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- counting, in different layers of a computing environment, a number of events occurring during execution of a software application;
- comparing the number of counted events to a previously generated cluster set to determine that at least one of the counted events is an outlier;
- and
- providing data characterizing the at least one of the counted events determined to be an outlier.
A method for implementation by one or more data processors forming part of at least one computing device, the method comprising:
- monitoring, in different layers of a computing environment, a sequence of events occurring during execution of a software application;
- comparing the number of monitored events to a previously generated cluster set to determine that at the sequence of at least some of such events is an outlier;
- and
- providing data characterizing the at least one sequence of events determined to be an outlier.
Dependencies are inferred from the claim text.