Automatically detecting misuse of licensed software

A method performed by a software application executable on a computing device, the method comprising:

• communicating with a server device of a managed network to separately access, from records of communication sessions between the server device and computing devices related to the managed network, a first record and a second record, wherein the first record includes a first set of one or more fields that are not present in the second record, wherein the second record includes a second set of one or more fields that are not present in the first record, wherein the communication sessions are initiated through use of accounts authorized to access the server device by licenses associated with a licensed software application executable on the server device, wherein the managed network contains the server device and a database associated with the licensed software application, wherein the database stores the records, and wherein the records include network addresses of the computing devices that are involved in the communication sessions;
• identifying a common field that is present in both the first record and the second record;
• correlating session information across the first record and the second record using the common field;
• using a set of license misuse criteria to identify, from the correlated session information, (i) a set of the communication sessions that meets the set of license misuse criteria and (ii) a network address of a target computing device involved in the set of communication sessions, wherein the set of license misuse criteria comprises at least one of a number of bytes transmitted between the target computing device and the server device during the set of communication sessions exceeding a threshold number of bytes, or the set of communication sessions including more than a threshold number of communication sessions;
• based on the network address of the target computing device, identifying the target computing device;
• and
• storing in memory an indication that identifies the target computing device as a potential source of misuse of one or more of the licenses.

An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing device, cause the computing device to perform operations comprising:

• communicating with a server device of a managed network to separately access, from records of communication sessions between the server device and computing devices related to the managed network, a first record and a second record, wherein the first record includes a first set of one or more fields that are not present in the second record, wherein the second record includes a second set of one or more fields that are not present in the first record, wherein the communication sessions are initiated through use of accounts authorized to access the server device by licenses associated with a licensed software application executable on the server device, wherein the managed network contains the server device and a database associated with the licensed software application, wherein the database stores the records, and wherein the records include network addresses of the computing devices that are involved in the communication sessions;
• identifying a common field that is present in both the first record and the second record;
• correlating session information across the first record and the second record using the common field;
• using a set of license misuse criteria to identify, from the correlated session information, (i) a set of the communication sessions that meets the set of license misuse criteria and (ii) a network address of a target computing device involved in the set of communication sessions, wherein the set of license misuse criteria comprises at least one of a number of bytes transmitted between the target computing device and the server device during the set of communication sessions exceeding a threshold number of bytes, or the set of communication sessions including more than a threshold number of communication sessions;
• based on the network address of the target computing device, identifying the target computing device;
• and
• storing in memory an indication that identifies the target computing device as a potential source of misuse of one or more of the licenses.