Method for detection of unauthorized computer system usage

• US 20040068559A1
• Filed: 10/04/2002
• Published: 04/08/2004
• Est. Priority Date: 10/04/2002
• Status: Abandoned Application

• Current Assignee: Cable Television Laboratories Incorporated
• Original Assignee: Cable Television Laboratories Incorporated
• Inventors: Shaw, Terry D.
• Application Number:
  US10/264,878
• Publication Number:
  US 20040068559A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The method for detecting unauthorized computer system usage monitors the subscriber'"'"'s activities while using the computer system, the system activities and the Internet activities. When the computer system is initialized, the subscriber may manually or automatically set parameters for determining when an activity is unauthorized. When an activity is detected with deviates from normal system usage and operation, the activity is unauthorized. The unauthorized activity may be recorded in an activity log, may be terminated by the computer system, or the subscriber may be notified of the unauthorized usage.

Claims

1. A method for detecting autonomous computer system usage comprising:

monitoring an operation of said computer system;

monitoring a subscriber'"'"'s activity during usage of said computer system;

comparing said monitored computer system operation with said monitored subscriber activity to detect computer system operation that is inconsistent with said monitored subscriber'"'"'s activity; and

recording said inconsistent computer system activity in a log within said computer system.

2. The method of claim 1 wherein said monitoring of said computer system operation comprises monitoring an Internet connection activity.

3. The method of claim 2 wherein said monitoring of said activity of said computer system further comprises at least one of:

monitoring a memory access;

monitoring a bandwidth usage corresponding to said internet connection activity; and

monitoring a CPU activity.

4. The method of claim 1 wherein said monitoring of said subscriber'"'"'s activity comprises monitoring a subscriber input device activity

5. The method of claim 1 wherein said comparing comprises:

determining a computer system response to said subscriber activity; and

comparing said computer system response to said operation of said computer system, wherein if said computer system response and said computer system operation do not match, a unauthorized usage has been detected.

6. The method of claim 1 wherein said recording said inconsistent computer system activity comprises recording an Internet activity.

7. The method of claim 6 further comprising recording a bandwidth usage corresponding to said internet activity.

8. The method of claim 6 wherein said recording further comprises:

in a database at least one data of the class of activity data comprising;

a time corresponding to said monitoring;

said subscriber activity; and

said operation of said computer system.

9. The method of claim 1 for further usage to prevent said unauthorized information collection and computer system usage via a broadband Internet connection, further comprising:

performing an action to counter said inconsistent usage to terminate said inconsistent usage.

10. The method of claim 1 further comprising:

notifying said subscriber of said inconsistent computer system activity.

11. A method of preventing autonomous computer system Internet usage comprising:

monitoring an Internet activity;

monitoring a subscriber physical interaction with said computer system;

correlating said monitored Internet activity with said monitored subscriber physical interaction to detect computer system activity that is inconsistent with said monitored subscriber physical interaction; and

recording said inconsistent computer system activity in a log.

12. The method of claim 11 wherein said monitoring further comprises at least one of:

monitoring access to a storage media;

monitoring RAM access; and

monitoring an activity performed by a CPU during said computer system operation.

13. The method of claim 11 wherein monitoring said subscriber physical interaction comprises at least one of:

monitoring a character input device usage;

monitoring a pointing device usage; and

monitoring a game input device usage.

14. The method of claim 11 wherein said correlating said Internet activity and said subscriber physical interaction comprises:

determining a response to said subscriber physical interaction;

correlating said response to said Internet activity, wherein if said Internet activity is inconsistent with said subscriber physical interaction response said Internet activity is an autonomous activity.

15. The method of claim 11 wherein said monitoring of said Internet activity said monitoring of said subscriber physical interaction is performed periodically.

16. The method of claim 15 wherein said periodic performance is at scheduled intervals.

17. The method of claim 11 further comprising:

monitoring a bandwidth corresponding to said Internet activity.

18. The method of claim 17 wherein said periodic performance is contingent on usage of said broadband Internet connection.

19. The method of claim 11 further comprising:

manually setting a parameter corresponding to said Internet activity and said subscriber physical interaction for use correlating said Internet activity with said subscriber physical interaction to detect said inconsistent computer system activity.

20. The method of claim 19 wherein said parameter includes at least one of:

a time corresponding to said monitoring;

said subscriber physical interaction with said computer system; and

a data size corresponding to a transmission of data during said internet usage.

21. The method of claim 11 further comprising:

automatically setting a parameter corresponding to said Internet activity and said subscriber physical interaction for use correlating said Internet activity with said subscriber physical interaction to detect said inconsistent computer system activity.

22. The method of claim 21 wherein said automatically setting said parameter comprise at least one of:

monitoring said subscriber physical interaction with said computer system for a time period;

monitoring said internet activity;

setting said parameters in accordance with said monitored subscriber physical interaction with said computer system and said Internet activity.

23. The method of claim 22 wherein said parameter includes at least one of:

a time corresponding to said monitoring;

said subscriber physical interaction with said computer system;

a bandwidth corresponding to said Internet usage; and

a data size corresponding to a transmission of data during said internet usage.