Microsoft Technology Licensing, LLC

Daniel Mark Edwards

Royi Ronen

Tomer Koren

Mathias Scherman

Enhancements to network security are provided by identifying malicious actions taken against servers in a network environment, without having to access log data from individual servers. Seed data are collected by an administrator of the network environment, from honeypots and servers whose logs are shared with the administrator, to identify patterns of malicious actions to access the network environment. These patterns of use include ratios of TCP flags in communication sessions, entropy in the use of TCP flags over the life of a communication session, and packet size metrics, which are used to develop a model of characteristic communications for an attack. These attack models are shared with servers in the network environment to detect attacks without having to examine the traffic logs of those servers.

Network attack detection

A system receives a first request to replace a first credential used by an entity to access one or more resources with a second credential to be used by the entity to access the one or more resources. In response to receiving the first request, the system replaces the first credential with the second credential and allows use of the first credential for a predetermined period. In response to receiving a second request from the entity to access the one or more resources using the first credential after replacing the first credential with the second credential, the system allows the entity to access the one or more resources using the first credential during the predetermined period, and generates an indication that the entity used the first credential to access the one or more resources and that the entity is to be updated with the second credential within the predetermined period.

Growing community of inventors

Bothell, WA, United States of America

Daniel Mark Edwards