Classifying logins, for example as benign or malicious logins, in private networks such as enterprise networks for example
AssigneeNew York University
InventorsSeyedhossein Siadati, Nasir MEMON
Life of this patent
Estimating the term…
Abstract
Logins within a private network are classified as benign or malicious by (a) receiving login patterns within a private network, wherein each login pattern includes one or more attributes of each of (i) a user uniquely associated with the login, (ii) a source computer uniquely associated with the login, and (iii) a destination computer uniquely associated with the login, and wherein each login pattern is characterized as one of (A) a normal login pattern, (B) a benign login pattern, or (C) a malicious login pattern; (b) receiving a new login; and (c) classifying the new login as benign or malicious using the login patterns for the private network that were received.
Claims20
A computer-implemented method comprising:
- a) receiving login patterns within a private network, wherein each login pattern includes one or more attributes of each of (i) a user uniquely associated with the login, (ii) a source computer uniquely associated with the login, and (iii) a destination computer uniquely associated with the login, and wherein each login pattern is characterized as one of (A) a normal login pattern, (B) a benign login pattern, or (C) a malicious login pattern;
- b) receiving a new login;
- and
- c) classifying the new login as benign or malicious using the login patterns for the private network that were received.
Apparatus comprising:
- a) an input adapted to
- (1) receive login patterns within a private network, wherein each login pattern includes one or more attributes of each of (i) a user uniquely associated with the login, (ii) a source computer uniquely associated with the login, and (iii) a destination computer uniquely associated with the login, and wherein each login pattern is characterized as one of (A) a normal login pattern, (B) a benign login pattern, or (C) a malicious login pattern, and
- (2) receive a new login;
- and
- b) a classifier adapted to classify the new login as benign or malicious using the login patterns for the private network that were received.
A non-transitory computer-readable medium storing processor-executable instructions which, when executed by one or more processors, cause the one or more processors to perform a method comprising:
- a) receiving login patterns within a private network, wherein each login pattern includes one or more attributes of each of (i) a user uniquely associated with the login, (ii) a source computer uniquely associated with the login, and (iii) a destination computer uniquely associated with the login, and wherein each login pattern is characterized as one of (A) a normal login pattern, (B) a benign login pattern, or (C) a malicious login pattern;
- b) receiving a new login;
- and
- c) classifying the new login as benign or malicious using the login patterns for the private network that were received.
The non-transitory computer-readable medium of 19 wherein the private network is an enterprise network, and wherein the attributes of the user include at least one of (A) type of user, (B) title of user within the enterprise, (C) department of the user within the enterprise, and (D) an office location of the user within the enterprise,
- wherein the attributes of the source computer include at least one of (A) server or workstation, and (B) geographic location of the source computer, and
- wherein the attributes of the destination computer include at least one of (A) server or workstation, (B) geographic location of the destination computer, and (C) application or type of application hosted by the destination computer.
Dependencies are inferred from the claim text.