Method and apparatus for detection and notification of unauthorized access attempts in a distributed data processing system
AssigneeInternational Business Machines Corporation
InventorsChristopher Lawrence Canestaro, Rick A. Hamilton, II, John Steven Langford, Maulin Ishwarbhai Patel
Life of this patent
Estimating the term…
Abstract
A method and apparatus for identifying unauthorized attempts to access a data processing system. A file used to contain data on failed attempts to access the data processing system is monitored. Responsive to the file containing data on failed attempts to access the data processing system, the data is analyzed to identify candidates for unauthorized access attempts.
Claims39
A method for identifying unauthorized attempts to access a data processing system, the method comprising the computer implemented steps of:
- recording data in a file each time an attempt to access the data processing system has failed;
- monitoring said file used to contain said data on failed attempts to access the data processing system;
- and
- responsive to said file containing said data on failed attempts to access the data processing system, analyzing said data to identify candidates for unauthorized access attempts.
A method for identifying unauthorized attempts to access a data processing system, the method comprising the computer implemented steps of:
- responsive to a periodic event, monitoring a file used to contain data on failed attempts to access the data processing system;
- and
- responsive to the file containing data on failed attempts to access the data processing system, analyzing the data to identify candidates for unauthorized access attempts.
A method for identifying unauthorized attempts to access a data processing system, the method comprising the computer implemented steps of:
- responsive to a request to check for unauthorized attempts, monitoring a file used to contain data on failed attempts to access the data processing system;
- and
- responsive to the file containing data on failed attempts to access the data processing system, analyzing the data to identify candidates for unauthorized access attempts.
A method for identifying unauthorized access attempts to a data processing system, the method comprising the computer implemented steps of:
- recording data in a file each time an attempt to access the data processing system has failed;
- monitoring said file used to contain said data on failed attempts to access the data processing system;
- responsive to said file containing said data on failed attempts to access the data processing system, analyzing said data to identify user IDs and hosts from which failed authorized attempts occurred;
- and
- responsive to a user ID having an absence of a successful access attempt, placing the user ID and an associated host in a notification file.
A method for identifying unauthorized access attempts to a data processing system, the method comprising the computer implemented steps of:
- periodically checking a file for data for a presence of failed attempts to access the data processing system within the file;
- responsive to the file containing data on failed attempts to access the data processing system;
- analyzing the data to identify user IDs and hosts from which failed authorized attempts occurred;
- and
- responsive to a user ID having an absence of a successful access attempt, placing the user ID and an associated host in a notification file.
A distributed data processing system comprising:
- a network;
- a plurality of clients connected to the network;
- a server connected to the network, wherein the server stores a set of data for unsuccessful access attempts, checks for a presence of unsuccessful access attempts in response to a periodic event, analyzes the set of data to identify candidates for unauthorized access attempts, and responsive to an identification of a candidate for unauthorized access, sends a notification containing information about the candidate.
A data processing system for identifying unauthorized attempts to access a data processing system, the data processing system comprising:
- recording means for recording data in a file each time an attempt to access the data processing system has failed;
- monitoring means for monitoring said file used to contain said data on failed attempts to access the data processing system;
- and
- analyzing means, responsive to the file containing said data on failed attempts to access the data processing system, for analyzing the data to identify candidates for unauthorized access attempts.
A data processing system for identifying unauthorized attempts to access a data processing system, the data processing system comprising:
- monitoring means for monitoring, responsive to a periodic event, a file used to contain data on failed attempts to access the data processing system;
- and
- analyzing means, responsive to the file containing data on failed attempts to access the data processing system, for analyzing the data to identify candidates for unauthorized access attempts.
A data processing system for identifying unauthorized attempts to access a data processing system, the data processing system comprising:
- monitoring means for monitoring, responsive to a request to check for unauthorized attempts, a file used to contain data on failed attempts to access the data processing system;
- and
- analyzing means, responsive to the file containing data on failed attempts to access the data processing system, for analyzing the data to identify candidates for unauthorized access attempts.
A data processing system for identifying unauthorized access attempts to a data processing system, the data processing system comprising:
- recording means for recording data in a file each time an attempt to access the data processing system has failed;
- monitoring means for monitoring said file used to contain said data on failed attempts to access the data processing system;
- analyzing means, responsive to said file containing said data on failed attempts to access the data processing system, for analyzing said data to identify user IDs and hosts from which failed authorized attempts occurred;
- and
- placing means, responsive to a user ID having an absence of a successful access attempt, for placing the user ID and an associated host in a file.
A data processing system for identifying unauthorized access attempts to a data processing system, the data processing system comprising:
- monitoring means for periodically checking a file for data for a presence of failed access attempts within the file;
- analyzing means, responsive to the file containing data on failed access attempts, for analyzing the data to identify user IDs and hosts from which failed authorized attempts occurred;
- and
- placing means, responsive to a user ID having an absence of a successful access attempt, for placing the user ID and an associated host in a file.
A computer program product in a computer readable medium for identifying unauthorized attempts to access a data processing system, the computer program product comprising:
- first instructions for recording data in a file each time an attempt to access the data processing system has failed;
- second instructions for monitoring said file used to contain said data on failed attempts to access the data processing system;
- and
- third instructions, responsive to said file containing said data on failed attempts to access the data processing system, for analyzing the data to identify candidates for unauthorized access attempts.
A computer program product in a computer readable medium for identifying unauthorized access attempts to a data processing system, the computer program product comprising:
- first instructions for recording data in a file each time an attempt to access the data processing system has failed;
- second instructions for monitoring said file used to contain said data on failed attempts to access the data processing system;
- third instructions, responsive to said file containing said data on failed attempts to access the data processing system, for analyzing said data to identify user IDs and hosts from which failed authorized attempts occurred;
- and
- fourth instructions, responsive to a user ID having an absence of a successful access attempt, for placing the user ID and an associated host in a file.
A distributed data processing system comprising:
- a network;
- a plurality of clients connected to the network;
- a server connected to the network, wherein the server stores a set of data for unsuccessful access attempts, checks for a presence of unsuccessful access attempts in response to a request to check for unauthorized attempts, analyzes the set of data to identify candidates for unauthorized access attempts, and responsive to an identification of a candidate for unauthorized access, sends a notification containing information about the candidate.
Dependencies are inferred from the claim text.