Threshold Based Detection
AssigneeBank of America Corporation
InventorsSteven Sinks, Brian Devine, Jonathan Sheedy, Matthew Findley, Jared Wilson, Joshua Jenkins, Donald Hess
Life of this patent
Estimating the term…
Abstract
Various aspects of the disclosure relate to automated monitoring and detection of computing threats. A threat detection computing system is configured to monitor for security threats on a networked system. The threat detection system monitors process calls to detect otherwise benign activity that exceeds an expected threshold and identifies threat actor actions that would otherwise go un-noticed and be associated with normal computer activity.
Claims20
A computing device comprising:
- a processor;
- and
- non-transitory memory storing instructions that, when executed by the processor, cause the computing device to:
- monitor process actions of a computing device for an indication of a security threat to the operation of the computing device;
- analyze the monitored process actions to determine type and number of process calls to application programming interface functions;
- generate a threat score based on the analyzed type and number of process calls to application programming interface functions;
- determine if the generated threat score meets or exceeds a threat threshold;
- responsive to determining that the generated threat score meets or exceeds the threat threshold, generate at least one warning message indicating a security threat.
A method comprising:
- monitoring process actions of a computing device for an indication of a security threat to the operation of the computing device;
- analyzing the monitored process actions to determine type and number of process calls to application programming interface functions;
- generating a threat score based on the analyzed type and number of process calls to application programming interface functions;
- determining if the generated threat score meets or exceeds a threat threshold;
- responsive to determining that the generated threat score meets or exceeds the threat threshold, generating at least one warning message indicating a security threat.
Non-transitory computer readable media storing instructions that, when executed by a processor, cause a computing device to:
- monitor process actions of a computing device for an indication of a security threat to the operation of the computing device;
- analyze the monitored process actions to determine type and number of process calls to application programming interface functions;
- generate a threat score based on the analyzed type and number of process calls to application programming interface functions;
- determine if the generated threat score meets or exceeds a threat threshold;
- responsive to determining that the generated threat score meets or exceeds the threat threshold, generate at least one warning message indicating a security threat.
Dependencies are inferred from the claim text.