Privileged session analytics

• US 10,530,790 B2
• Filed: 09/23/2015
• Issued: 01/07/2020
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Shih, Kuang-Yu, Sharma, Himanshu, Ho, Fannie, Mao, Zhuoxing, Srinivasan, Sudhir Kumar
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Savenkov, Vadim
• Application Number:
  US14/862,906
• Publication Number:
  US 20160094577A1
• Time in Patent Office: 1,567 Days
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A privileged account manager is provided for monitoring privileged sessions on target systems of an enterprise. In an embodiment, the privileged account manager is configured to capture metadata related to a privileged session and generate a first activity pattern for the privileged session based on the captured metadata. The first activity pattern may include a sequence of one or more activities performed by a first user during the privileged session. The privileged account manager may be configured to identify a second activity pattern that comprises at least a subset of the one or more activities performed by the first user during the privileged session and determine an appropriate action to be performed for the first activity pattern based on the identification of the second activity pattern. In some embodiments, the privileged account manager may be configured to transmit the action to a second user on a client device.

Claims

1. A system comprising:

a processor; and

a memory device including instructions that, when executed by the processor, cause the processor to;

responsive to a first user requesting access from a first client device to a privileged account on a target system, send, to the first client device, access information to enable the first user using the first client device to access the privileged account;

based on the first client device accessing the privileged account using the access information, send, to the target system, a request to establish a session between the first client device and the target system;

receive, from the target system, metadata captured by the target system, wherein the metadata is indicative of activity performed by the first user operating the first client device during the session with the target system;

determine a first activity pattern for the session based on the metadata, the first activity pattern comprising a sequence of activities performed by the first user during the session, wherein each activity in the sequence of activities is associated with an activity weight, and wherein an activity weight associated with an activity in the sequence of activities is based on a position of the activity in the sequence of activities;

determine, based on each activity weight of each activity in the sequence of activities, a first total weight;

identify, based at least on a first subsequence of the first activity pattern, a second activity pattern comprising a second subsequence that corresponds to the first subsequence of the first activity pattern, the second activity pattern having a second total weight;

compare the first total weight to the second total weight to determine that the second total weight is within a pre-determined threshold of the first total weight;

in response to determining that the second total weight is within the pre-determined threshold of the first total weight, determine an action to be performed for the first activity pattern; and

transmit the action to a second client device, wherein the action is an action to be performed for the session.

2. The system of claim 1, wherein the instructions, when executed by the processor, further cause the processor to:

determine a weight to be assigned to a particular activity of the sequence of activities performed by the first user during the session.

3. The system of claim 1, wherein the weight is determined based on a threat level associated with the activity.

4. The system of claim 1, wherein determining that the second activity pattern is a match for the first activity pattern includes:

identifying a longest matching subsequence between activities included in a sequence in the first activity pattern and activities included in the second activity pattern.

5. The system of claim 1, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information, related to the session.

6. The system of claim 1, wherein the instructions, when executed by the processor, further cause the processor to:

transmit information related to the first activity pattern to the second client device.

7. The system of claim 1, wherein the second activity pattern is identified by comparing one or more activities included in the first activity pattern with one or more activities in each stored activity pattern of the set of stored activity patterns.

8. The system of claim 1, where the action includes an action to modify the session or an action to issue a notification.

9. The system of claim 1, wherein the activity weight associated with the activity is within a range, wherein the range is based at least on a threat level associated with the activity.

10. A computer-implemented method comprising:

responsive to a first user requesting access from a first client device to a privileged account on a target system, sending, to the first client device, access information to enable the first user using the first client device to access the privileged account;

based on the first client device accessing the privileged account using the access information, sending, to the target system, a request to establish a session between the first client device and the target system;

receiving, from the target system, metadata captured by the target system, wherein the metadata is indicative of activity performed by the first user operating the first client device during the session with the target system;

determining a first activity pattern for the session based on the metadata, the first activity pattern comprising a sequence of activities performed by the first user during the session, wherein each activity in the sequence of activities is associated with an activity weight, and wherein an activity weight associated with an activity in the sequence of activities is based on a position of the activity in the sequence of activities;

determining, based on each activity weight of each activity in the sequence of activities, a first total weight;

identifying, based at least on a first sub sequence of the first activity pattern, a second activity pattern comprising a second sub sequence that corresponds to the first sub sequence of the first activity pattern, the second activity pattern having a second total weight;

comparing the first total weight to the second total weight to determine the second total weight is within a pre-determined threshold of the first total weight;

in response to determining the second total weight is within the pre-determined threshold of the first total weight, determining an action to be performed for the first activity pattern; and

transmitting the action to a second client device, wherein the action is an action to be performed for the session.

11. The computer-implemented method of claim 10, further comprising:

determining a weight to be assigned to a particular activity of the sequence of activities performed by the first user during the session.

12. The computer-implemented method of claim 10, wherein determining that the second activity pattern is a match for the first activity pattern includes:

identifying a longest matching subsequence between activities included in the sequence in the first activity pattern and activities included in the second activity pattern.

13. The computer-implemented method of claim 10, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information, related to the session.

14. The computer-implemented method of claim 10 further comprising:

transmitting information related to the first activity pattern to the second client device.

15. The computer-implemented method of claim 10, wherein the activity weight associated with the activity is within a range, wherein the range is based at least on a threat level associated with the activity.

16. A non-transitory computer-readable media storing computer-executable instructions executable by one or more processors, the computer-executable instructions comprising:

instructions that, in response to a first user requesting access from a first client device to a privileged account on a target system, send, to the first client device, access information to enable the first user using the first client device to access the privileged account;

instructions that, based on the first client device accessing the privileged account using the access information, cause the one or more processors to send, to the target system, a request to establish a session between the first client device and the target system;

instructions that cause the one or more processors to receive, from the target system, metadata captured by the target system, wherein the metadata is indicative of activity performed by the first user operating the first client device during the session with the target system;

instructions that cause the one or more processors to determine a first activity pattern for the session based on the metadata, the first activity pattern comprising a sequence of activities performed by the first user during the session, wherein each activity in the sequence of activities is associated with an activity weight, and wherein an activity weight associated with an activity in the sequence of activities is based on a position of the activity in the sequence of activities;

instructions that cause the one or more processors to determine, based on each activity weight of each activity in the sequence of activities, a first total weight;

instructions that cause the one or more processors to identify, based at least on a first sub sequence of the first activity pattern, a second activity pattern comprising a second sub sequence that corresponds to the first sub sequence of the first activity pattern, wherein the second activity pattern having a second total weight;

instructions that cause the one or more processors to compare the first total weight to the second total weight to determine the second total weight is within a pre-determined threshold of the first total weight;

in response to determining the second total weight is within the pre-determined threshold of the first total weight, instructions that cause the one or more processors to determine an action to be performed for the first activity pattern; and

instructions that cause the one or more processors to transmit the action to a second client device, wherein the action is an action to be performed for the session.

17. The non-transitory computer-readable media of claim 16, wherein the computer-executable instructions further comprise:

instructions that cause the one or more processors to determine a weight to be assigned to an activity of the sequence of activities performed by the first user during the session, and wherein the weight is determined based on a threat level associated with the activity.

18. The non-transitory computer-readable media of claim 16, wherein the computer-executable instructions further comprise:

instructions that cause the one or more processors to determine a weight to be assigned to a particular activity of the sequence of activities based on a position of an occurrence of the activity in the sequence of activities in the first activity pattern.

19. The non-transitory computer-readable media of claim 16, wherein the computer-executable instructions further comprise:

instructions for determining that the second activity pattern is a match for the first activity pattern, wherein the instructions that cause the one or more processors to identify a longest matching subsequence between activities included in the sequence in the first activity pattern and activities included in the second activity pattern.

20. The non-transitory computer-readable media of claim 16, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information, related to the session.