The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Nov. 26, 2019

Filed:

Dec. 06, 2018
Applicant:

Oracle International Corporation, Redwood Shores, CA (US);

Inventors:

Aleksey M. Urmanov, San Diego, CA (US);

Alan P. Wood, San Jose, CA (US);

Assignee:

ORACLE INTERNATIONAL CORPORATION, Redwood Shores, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
H04L 29/06 (2006.01); G06F 17/30 (2006.01); G06F 15/16 (2006.01); G06F 21/31 (2013.01); G06F 21/55 (2013.01);
U.S. Cl.
CPC ...
H04L 63/1483 (2013.01); G06F 21/31 (2013.01); G06F 21/316 (2013.01); G06F 21/554 (2013.01); H04L 63/08 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01); G06F 2221/2101 (2013.01); H04L 2463/121 (2013.01);
Abstract

Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for a user authentication attempt to access a secure computer resource, user authentication log data having user attribute values is collected. The user authentication log data is transformed into a tracer data structure. The tracer data structure is augmented with timestamp data to generate an event data structure. It is determined whether the tracer data structure matches an existing tracer data structure stored in a rules database and, if not, a novelty flag is set to generate a new user behavior model filter. If the tracer data structure matches the existing tracer data structure: an existing user behavior model filter is applied, issuance of an alarm message or signal is controlled, and the existing user behavior model filter is updated based, at least in part, on the event data structure.


Find Patent Forward Citations

Loading…