Detecting credentials abuse of cloud compute services
AssigneePalo Alto Networks (Israel Analytics) Ltd.
InventorsDror Alon, Niv Sela, Or Kliger, Guy Arazi
Life of this patent
Estimating the term…
Abstract
Methods, storage systems and computer program products implement embodiments of the present invention that include identifying a first autonomous system number (ASN) for a service hosted by a networked entity, and retrieving, from a log file, an entry corresponding to an access by a networked entity to the service and including an Internet Protocol (IP) address of the networked entity and an access token authorizing access to the service. A second ASN for the IP address is identified, and the second ASN is compared to the first ASN. Finally, an alert is generated for the access upon detecting the first ASN differing from the second ASN.
Claims17
A method, comprising:
- identifying a first autonomous system number (ASN) for a service hosted by a networked entity;
- retrieving, from a log file, an entry corresponding to an access by a networked entity to the service and comprising an Internet Protocol (IP) address of the networked entity and an access token authorizing access to the service;
- identifying a second ASN for the IP address;
- comparing, by a processor, the second ASN to the first ASN;
- and
- generating an alert for the access upon detecting the first ASN differing from the second ASN.
An apparatus, comprising:
- a network interface controller (NIC);
- and
- one or more processors configured:
- to identify a first autonomous system number (ASN) for a service hosted by a networked entity,
- to retrieve, from a log file via the NIC, an entry corresponding to an access by a networked entity to the service and comprising an Internet Protocol (IP) address of the networked entity and an access token authorizing access to the service,
- to identify a second ASN for the IP address,
- to compare the second ASN to the first ASN, and
- to generate an alert for the access upon detecting the first ASN differing from the second ASN.
A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
- to identify a first autonomous system number (ASN) for a service hosted by a networked entity;
- to retrieve, from a log file, an entry corresponding to an access by a networked entity to the service and comprising an Internet Protocol (IP) address of the networked entity and an access token authorizing access to the service;
- to identify a second ASN for the IP address;
- to compare the second ASN to the first ASN;
- and
- to generate an alert for the access upon detecting the first ASN differing from the second ASN.
Dependencies are inferred from the claim text.