The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Mar. 23, 2021

Filed:

Jun. 18, 2018
Applicant:

Oracle International Corporation, Redwood Shores, CA (US);

Inventors:

Aleksey M. Urmanov, San Diego, CA (US);

Alan Paul Wood, San Jose, CA (US);

Anton A. Bougaev, La Jolla, CA (US);

Assignee:

Oracle International Corporation, Redwood Shores, CA (US);

Attorney:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
G06F 21/31 (2013.01); H04L 29/06 (2006.01); G06F 21/45 (2013.01);
U.S. Cl.
CPC ...
G06F 21/316 (2013.01); G06F 21/45 (2013.01); H04L 63/083 (2013.01); H04L 63/0815 (2013.01); H04L 63/0876 (2013.01);
Abstract

The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.


Find Patent Forward Citations

Loading…