The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Dec. 03, 2019
Filed:
Jun. 27, 2018
Sas Institute Inc., Cary, NC (US);
Bryan C. Harris, Cary, NC (US);
Glen R. Goodwin, Laurel, MD (US);
Sean Riley Dyer, Leawood, KS (US);
Alexius Kofi Ameyaw Boakye, Jr., Ellicott City, MD (US);
Christopher Francis Smith, Clarksburg, MD (US);
Pankaj Ramesh Telang, Cary, NC (US);
Damian Tane Herrick, Cary, NC (US);
Edwin Kenton Brown, Elkridge, MD (US);
Justin Conrad Fleck, Mount Airy, MD (US);
SAS INSTITUTE INC., Cary, NC (US);
Abstract
A computing device computes a risk score for a user using a device based on a peer group identifier. Network activity measures characterize use of the device by the user. For each unique peer group identifier included in netflow records, a mean value is computed of each network activity measure. For each unique IP address and user identifier combination included in the netflow records, the mean value of each network activity measure is selected for a peer group identifier of the user; a risk score is computed by comparing each network activity measure for the unique IP address and user identifier combination to the selected mean value for the respective network activity measure; and when the risk score exceeds a predefined alert threshold, a high risk alert indicator is set indicating that the device is being used in an anomalous manner relative to other devices monitored by the computing device.