Malicious Event Detection in Computing Environments
AssigneeCitrix Systems, Inc.
InventorsDan Hu, Yuan Zhang, Xiaolu Chu
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting malicious events in computing systems are described herein. Relationships between events occurring at computing systems are identified. The identified relationships are compared to a series of events previously determined to be a malicious activity to determine whether the identified relationship is potentially malicious activity. If the identified relationship is determined to be potentially malicious, actions can be taken to mitigate damages caused by the events in the identified relationship.
Claims24
A method comprising:
- receiving, by a computing device, data from a client device, data indicative of occurrences of a series of events that includes a first event of a first application on the client device and a second event;
- identifying, by the computing device and based the series of events, a relationship between the first event and the second event;
- determining, by the computing device, that the first event is potentially malicious activity based on a comparison between the identified relationship and other series of events previously determined to be malicious activity;
- and
- initiating, by the computing device, an action to modify a configuration of the client device responsive to the determination that the first event is potentially malicious activity.
(canceled)
(canceled)
An apparatus comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
- receive data from a client device, data indicative of occurrences of a series of events that includes a first event of a first application on the client device and a second event;
- identify, based on the series of events, a relationship between the first event and the second event;
- determine that the first event is potentially malicious activity based on a comparison between the identified relationship and other series of events previously determined to be malicious activity;
- and
- initiate an action to modify a configuration of the client device responsive to the determination that the first event is potentially malicious activity.
(canceled)
(canceled)
A method comprising:
- receiving, by a computing device, data from a client device, data indicative of occurrences of a series of events on the client device;
- identifying, by the computing device and from the series of events, a first event satisfying one or more triggering rules;
- identifying, by the computing device, a relationship between the first event and one or more other events from the series of events;
- determining, by the computing device, that the first event is potentially malicious activity based on a comparison between the identified relationship and other series of events previously determined to be malicious activity;
- and
- initiating, by the computing device, an action to modify a configuration of the client device responsive to the determination that the first event is potentially malicious activity.
Dependencies are inferred from the claim text.