Citrix Systems, Inc.

Andreas Varnavas

Manikam Muthiah

Satyendra Tiwari

Vikramjeet Singh

Prabhjeet Singh Chawla

Neha Joshi

Nikolaos Georgakopoulos

Kiran Kumar

Venkatesh Vellingiri

Nikolaos Tsapakis

Premkumar S J

Ananthaneni Sai Teja Chowdary

A system and method that detects malicious account creation in a web-based platform. A method includes detecting suspicious events associated with an account creation process using a username classifier that evaluates a username used to create a new account, an IP address classifier that evaluates an IP address used to create the new account, and a domain classifier that evaluates a domain from an email address used to create the new account; analyzing each detected suspicious event with a density analysis classifier to determine if each detected suspicious event comprises a malicious event based on a density of detected suspicious events from a collections of account creation processes; and determining an alert condition based on at least one malicious event detection.

Classification scheme for detecting illegitimate account creation

Described embodiments provide systems and methods for detection of the degradation of a virtual desktop environment. A computing device may receive data from a plurality of client devices. The computing device may identify a subset of client devices from the plurality of client devices with at least one characteristic in common based on the received data. The computing device may determine a ratio of the identified subset of client devices, the ratio being a comparison of client devices of the subset with a value above a first threshold to a total number of client devices of the subset, and the value being indicative of a characteristic of performance for that client device. The computing device may identify a cause of an anomaly in the performance of the application based on the ratio exceeding a second threshold.

Systems and methods for detection of degradation of a virtual desktop environment

Described embodiments provide systems, methods, and computer readable media for generating environment descriptors. A device having at least one process may identify a plurality of feature vectors. Each vector may describe a corresponding access to an application hosted on a server in one of a plurality of network environments and having a corresponding performance metric. The device may provide a performance model using the plurality of feature vectors and the corresponding performance metrics. The performance model may be used to determine expected performance metrics for at least a first network environment. A first environment descriptor of the expected performance metrics may be generated for at least the first network environment. The first environment descriptor of the expected performance metrics may be used to assess a measured performance metric or a second environment descriptor of a second network environment.

Method for computing environment specific baselines for metrics of user experience

Described embodiments provide systems and methods for determining a change in a performance of a server. A device can receive a processing load and a request rate of a server. The device can determine a value indicative of a correlation between the processing load and the request rate of the server for a range of time. The device can determine whether the value is outside a range of a threshold for the server. The threshold can be indicative of one or more previous values determined for the server for the range of time. The device can generate an alert indicating a change in a performance of the server responsive to a comparison of the value to the threshold for the server.

Determining changes in a performance of a server

Described embodiments provide systems and methods for monitoring server utilization and reallocating resources using upper bound values. A device can determine a value indicative of an upper bound of a processing load of a server using data points detected for the processing load over a first range of time. The upper bound can correspond to a percentage of the processing load during the first range of time. The device can monitor, using the value, the processing load of the server over a second range of time. A determination can be made whether the value of the processing load is greater than a threshold during the second range of time. The device can generate an alert for the device responsive to a comparison of the value of the processing load to the threshold.

Growing community of inventors

Patras, Greece

Andreas Varnavas