Automatic User Session Profiling System for Detecting Malicious Intent
AssigneeInternational Business Machines Corporation
InventorsRussell L. Couturier, Michael Hanner, Iosif V. Onut, Ronald B. Williams
Life of this patent
Estimating the term…
Abstract
A method for analyzing past user sessions for malicious intent. A security incident is detected by a computer system. Responsive to detecting the security incident, a forensic investigation is triggered by the computer system using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.
Claims20
A method for analyzing past user sessions for malicious intent, the method comprising:
- detecting, by a computer system, a security incident;
- and
- responsive to detecting the security incident, triggering, by the computer system, a forensic investigation using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.
A computer system comprising:
- a processor unit;
- and
- a forensic analysis product running on the processor unit, wherein the forensic analysis product, responsive to detecting a security incident, triggering a forensic investigation using a set of security rules for detecting web site vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.
A computer program product for analyzing user sessions for malicious intent, the computer program product comprising:
- a computer-readable storage media;
- first program code, stored on the computer-readable storage media, for detecting a security incident;
- and
- second program code, stored on the computer-readable storage media, for triggering a forensic investigation using a set of security rules for detecting web site vulnerability in response to detecting the security incident, in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.
Dependencies are inferred from the claim text.