Microsoft Technology Licensing, LLC

Yossef Basha

Dror Cohen

Jonatan Zukerman

Noa Esther Aviv Hamamy

Ran Albagli

Benyamin Farshteindiker

A computing system is provided, including a server computing device configured to execute a security service that communicates with a security agent on a client computing device via a wide area network and an on-premises network on which the client computing device is provisioned, and receive and store, at the server computing device, administrator login credentials for a router device on the on-premises network. The processor is further configured to send a monitoring command to the security agent to cause the security agent to access the router device using the administrator login credentials and configure the router device to forward network traffic received by the router device to the security agent at the client computing device via port mirroring, and receive an on-premises network traffic monitoring report from the security agent based on the network traffic forwarded to the client computing device.

On-premises network traffic monitoring via security agent configured port mirroring of router device

Methods, systems and computer program products are provided for detection of slow brute force attacks based on user-level time series analysis. A slow brute force attack may be detected based on one or more anomalous failed login events associated with a user, alone or in combination with one or more post-login anomalous activities associated with the user, security alerts associated with the user, investigation priority determined for the user and/or successful logon events associated with the user. An alert may indicate a user is the target of a successful or unsuccessful slow brute force attack. Time-series data (e.g., accounted for in configurable time intervals) may be analyzed on a user-by-user basis to identify localized anomalies and global anomalies, which may be scored and evaluated (e.g., alone or combined with other information) to determine an investigation priority and whether and what alert to issue for a user.

Growing community of inventors

Kadima, Israel

Yossef Basha