Methods, systems and computer program products for monitoring user login activity for a server application

• US 20050188222A1
• Filed: 02/24/2004
• Published: 08/25/2005
• Est. Priority Date: 02/24/2004
• Status: Abandoned Application

• Current Assignee: Covelight Systems, Inc. (Radware Limited)
• Original Assignee: Covelight Systems, Inc. (Radware Limited)
• Inventors: Hargett, Byron Lee, Somerville, Garth Douglas, Hester, Douglas Wayne, Logan, David Byron, Motsinger, David Lee, Wall, Virgil Montgomery Jr., Gramley, Kenneth Robert, Choy, Albert Ming
• Application Number:
  US10/785,584
• Publication Number:
  US 20050188222A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods, systems and computer program products are disclosed for monitoring user login activity for a server application in a computer network. The methods, systems, and computer program products can monitor communication data between a server application and a client. The methods, systems, and computer program products can also include applying one or more detectors to the communication data to identify a variety of predetermined activity. Further, the methods, systems, and computer program products can include generating a threat score associated with the predetermined activity by comparing the identified predetermined activity with a security threshold criteria.

Claims

1. A method for monitoring user login activity for a server application, the method comprising:

(a) receiving communication data between a server application and a client;

(b) monitoring user login failures between the server application and the client during an established session; and

(c) detecting when the number of user login failures exceeds a predetermined number.

2. The method of claim 1, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

3. The method of claim 1, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

4. The method of claim 1, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

5. The method of claim 1, wherein the server application is implemented by a web server.

6. The method of claim 1, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

7. The method of claim 1, wherein the communication data comprises only transmission control protocol packets.

8. The method of claim 1, wherein the server application comprises a plurality of server applications.

9. The method of claim 1, wherein the monitored user login failures are associated with a single user account.

10. The method of claim 1, wherein the monitored user login failures are associated with a single Internet protocol (IP) address.

11. A system for monitoring user login activity for a server application, the system comprising:

(a) a network interface operable to receive communication data between a server application and a client; and

(b) a detector operable to monitor user login failures between the server application and the client during an established session, and operable to detect when the number of user login failures exceeds a predetermined number.

12. The system of claim 11, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

13. The system of claim 11, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

14. The system of claim 11, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

15. The system of claim 11, wherein the server application is implemented by a web server.

16. The system of claim 11, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

17. The system of claim 11, wherein the communication data comprises only transmission control protocol packets.

18. The system of claim 11, wherein the server application comprises a plurality of server applications.

19. The system of claim 11, wherein the monitored user login failures are associated with a single user account.

20. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving communication data between a server application and a client;

(d) monitoring user login failures between the server application and the client during an established session; and

(e) detecting when the number of user login failures exceeds a predetermined number.

21. The computer program product of claim 20, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

22. The computer program product of claim 20, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

23. The computer program product of claim 20, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

24. The computer program product of claim 20, wherein the server application is implemented by a web server.

25. The computer program product of claim 20, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

26. The computer program product of claim 20, wherein the communication data comprises only transmission control protocol packets.

27. The computer program product of claim 20, wherein the server application comprises a plurality of server applications.

28. The computer program product of claim 20, wherein the monitored user login failures are associated with a single user account.

29. The computer program product of claim 20, wherein the monitored user login failures are associated with a single Internet protocol (IP) address.

30. A method for monitoring user login activity for a server application, the method comprising:

(a) receiving communication data between a server application and a client;

(b) monitoring user login failures between the server application and the client during a predetermined time; and

(c) detecting when the number of user login failures exceeds a predetermined number.

31. The method of claim 30, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

32. The method of claim 30, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

33. The method of claim 30, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

34. The method of claim 30, wherein the server application is implemented by a web server.

35. The method of claim 30, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

36. The method of claim 30, wherein the communication data comprises only transmission control protocol packets.

37. A system for monitoring user login activity for a server application, the method comprising:

(a) a network interface operable to receive communication data between a server application and a client;

(b) a detector operable to monitor user login failures between the server application and the client during a predetermined time, and operable to detect when the number of user login failures exceeds a predetermined number.

38. The system of claim 37, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

39. The system of claim 37, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

40. The system of claim 37, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

41. The system of claim 37, wherein the server application is implemented by a web server.

42. The system of claim 37, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

43. The system of claim 37, wherein the communication data comprises only transmission control protocol packets.

44. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving communication data between a server application and a client;

(b) monitoring user login failures between the server application and the client during a predetermined time; and

(c) detecting when the number of user login failures exceeds a predetermined number.

45. The computer program product of claim 44, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

46. The computer program product of claim 44, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

47. The computer program product of claim 44, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

48. The computer program product of claim 44, wherein the server application is implemented by a web server.

49. The computer program product of claim 44, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

50. The computer program product of claim 44, wherein the communication data comprises only transmission control protocol packets.

51. A method for monitoring user login activity for a server application, the method comprising:

(a) receiving communication data between a server application and an first authenticated user;

(b) monitoring a login session between the server application and the first authenticated user during a time interval; and

(c) detecting whether the first authenticated user logs into the server application as a second authenticated user during the time interval.

52. The method of claim 51, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

53. The method of claim 51, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

54. The method of claim 51, wherein the communication data can comprise HTTP requests from the client and a responses from the server application.

55. The method of claim 51, wherein the server application is implemented by a web server.

56. The method of claim 51, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

57. The method of claim 51, wherein the communication data comprises only transmission control protocol packets.

58. A system for monitoring user login activity for a server application, the method comprising:

(a) a network interface operable to receive communication data between a server application and an first authenticated user; and

(b) a detector operable to monitor a login session between the server application and the first authenticated user during a time interval, and operable to detect whether the first authenticated user logs into the server application as a second authenticated user during the time interval.

59. The system of claim 58, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

60. The system of claim 58, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

61. The system of claim 58, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

62. The system of claim 58, wherein the server application is implemented by a web server.

63. The system of claim 58, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

64. The system of claim 58, wherein the communication data comprises only transmission control protocol packets.

65. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving communication data between a server application and a client;

(b) monitoring user login failures between the server application and the client during a predetermined time; and

(c) detecting when the number of user login failures exceeds a predetermined number.

66. The computer program product of claim 65, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

67. The computer program product of claim 65, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

68. The computer program product of claim 65, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

69. The computer program product of claim 65, wherein the server application is implemented by a web server.

70. The computer program product of claim 65, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

71. The computer program product of claim 65, wherein the communication data comprises only transmission control protocol packets.

72. A method for monitoring user logoff activity for a server application, the method comprising:

(a) receiving communication data of a login session between a server application and a client;

(b) monitoring user logoff between the server application and the client;

(c) monitoring automatic session expiration between the server application and the client; and

(d) determining whether the client completes logoff before the session automatically expires.

73. The method of claim 72, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

74. The method of claim 72, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

75. The method of claim 72, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

76. The method of claim 72, wherein the server application is implemented by a web server.

77. The method of claim 72, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

78. The method of claim 72, wherein the communication data comprises only transmission control protocol packets.

79. A system for monitoring user logoff activity for a server application, the method comprising:

(a) a network interface operable to receive communication data of a login session between a server application and a client;

(b) a detector operable to monitor user logoff between the server application and the client, operable to monitor automatic session expiration between the server application and the client, and operable to determine whether the client completes logoff before the session automatically expires.

80. The system of claim 79, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

81. The system of claim 79, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

82. The system of claim 79, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

83. The system of claim 79, wherein the server application is implemented by a web server.

84. The system of claim 79, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

85. The system of claim 79, wherein the communication data comprises only transmission control protocol packets.

86. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) receiving communication data of a login session between a server application and a client;

(b) monitoring user logoff between the server application and the client;

(c) monitoring automatic session expiration between the server application and the client; and

(d) determining whether the client completes logoff before the session automatically expires.

87. The computer program product of claim 86, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

88. The computer program product of claim 86, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

89. The computer program product of claim 86, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

90. The computer program product of claim 86, wherein the server application is implemented by a web server.

91. The computer program product of claim 86, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

92. The computer program product of claim 86, wherein the communication data comprises only transmission control protocol packets.

93. A method for monitoring simultaneous logins for a server application, the method comprising:

(a) monitoring a first user login session for a first user of a server application;

(b) monitoring a second user login session for a second user of the server application; and

(c) determining whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

94. The method of claim 93, comprising selectively generating an alert based upon whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

95. The method of claim 93, wherein the first and second login sessions communicate over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

96. The method of claim 93, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

97. The method of claim 93, wherein the server application is implemented by a web server.

98. The method of claim 93, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

99. A system for monitoring simultaneous logins for a server application, the method comprising:

(a) a network interface operable to monitor communication data between a server application and a client; and

(b) a detector operable to monitor a first user login session for a first user of the server application, operable to monitor a second user login session for a second user of the server application, and operable to determine whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

100. The system of claim 99, wherein the detector is operable to selectively generating an alert based upon whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

101. The system of claim 99, wherein the first and second login sessions communicate over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

102. The system of claim 99, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

103. The system of claim 99, wherein the server application is implemented by a web server.

104. The system of claim 99, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

105. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) monitoring a first user login session for a first user of a server application;

(b) monitoring a second user login session for a second user of the server application; and

(c) determining whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

106. The computer program product of claim 105, comprising selectively generating an alert based upon whether the second user login session occurs during the first user login session when the user of the first and second login session are identical.

107. The computer program product of claim 105, wherein the first and second login sessions communicate over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

108. The computer program product of claim 105, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

109. The computer program product of claim 105, wherein the server application is implemented by a web server.

110. The computer program product of claim 105, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

111. A method of monitoring logins for a server application, the method comprising:

(a) designating a first login time for a client as a disallowed login time;

(b) determining a second login time for the client in communication data with a server application;

(c) determining whether the second login time matches the first login time; and

(d) if the first and second login times match, indicating that the client in data communication with the server application is logging in at a disallowed login time.

112. The method of claim 111, if the login time for the client is disallowed, generating an alert.

113. The method of claim 111, wherein the server application communicates data over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

114. The method of claim 111, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

115. The method of claim 111, wherein the data communicated with the server application can comprise HTTP requests from the client and HTTP responses from the server application.

116. The method of claim 111, wherein the server application is implemented by a web server.

117. The method of claim 111, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

118. The method of claim 111, wherein the data communicated with the server application comprises only transmission control protocol packets.

119. A system for monitoring logins for a server application, the method comprising:

(a) a network interface operable to monitor communication data between a server application and a client; and

(b) a detector operable to designate a first login time for a client as a disallowed login time, operable to determine a second login time for the client in communication data with a server application, operable to determine whether the second login time matches the first login time, and operable to indicating that the client in data communication with the server application is logging in at a disallowed login time, if the first and second login times match.

120. The system of claim 119, wherein the detector is operable to generate an alert if the login time for the client is disallowed.

121. The system of claim 119, wherein the server application communicates data over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

122. The system of claim 119, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

123. The system of claim 119, wherein the data communicated with the server application can comprise HTTP requests from the client and HTTP responses from the server application.

124. The system of claim 119, wherein the server application is implemented by a web server.

125. The system of claim 119, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

126. The system of claim 119, wherein the data communicated with the server application comprises only transmission control protocol packets.

127. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) designating a first login time for a client as a disallowed login time;

(b) determining a second login time for the client in data communication with a server application;

(c) determining whether the second login time matches the first login time; and

(d) if the first and second login times match, indicating that the client in data communication with the server application is logging in at a disallowed login time.

128. The computer program product of claim 127, if the login time for the client is disallowed, generating an alert.

129. The computer program product of claim 127, wherein the server application communicates data over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

130. The computer program product of claim 127, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

131. The computer program product of claim 127, wherein the data communicated with the server application can comprise HTTP requests from the client and HTTP responses from the server application.

132. The computer program product of claim 127, wherein the server application is implemented by a web server.

133. The computer program product of claim 127, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

134. The computer program product of claim 127, wherein the data communicated with the server application comprises only transmission control protocol packets.