PRIVILEGED SESSION ANALYTICS

• US 20160094577A1
• Filed: 09/23/2015
• Published: 03/31/2016
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Shih, Kuang-Yu, Sharma, Himanshu, Ho, Fannie, Srinivasan, Sudhir Kumar, Mao, Zhuoxing
• Granted Patent: US 10,530,790 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A privileged account manager is provided for monitoring privileged sessions on target systems of an enterprise. In an embodiment, the privileged account manager is configured to capture metadata related to a privileged session and generate a first activity pattern for the privileged session based on the captured metadata. The first activity pattern may include a sequence of one or more activities performed by a first user during the privileged session. The privileged account manager may be configured to identify a second activity pattern that comprises at least a subset of the one or more activities performed by the first user during the privileged session and determine an appropriate action to be performed for the first activity pattern based on the identification of the second activity pattern. In some embodiments, the privileged account manager may be configured to transmit the action to a second user on a client device.

Claims

1. A system comprising:

a processor; and

a memory device including instructions that, when executed by a processor, cause the processor to;

capture metadata related to a privileged session;

generate a first activity pattern for the privileged session based at least in part on the captured metadata, the first activity pattern comprising a sequence of one or more activities performed by a first user during the privileged session;

identify, from a set of stored activity patterns, a second activity pattern, the second activity pattern comprising at least a subset of the one or more activities performed by the first user during the privileged session;

determine an action to be performed for the first activity pattern based at least in part on the identification of the second activity pattern; and

transmit the action to a second user on a client device.

2. The system of claim 1, wherein the processor is further configured to determine a weight to be assigned to an activity of the one or more activities performed by the user during the privileged session.

3. The system of claim 2, wherein the processor is further configured to determine the weight based on a position of occurrence of the activity in the sequence of the one or more activities comprising the first activity pattern.

4. The system of claim 2, wherein the processor is further configured to determine the weight to be assigned to the activity of the one or more activities based on a threat level associated with the activity.

5. The system of claim 1, wherein the processor is further configured to identify the second activity pattern based at least in part on identifying a longest matching subsequence between the one or more activities of the first activity pattern and one or more activities of the second activity pattern.

6. The system of claim 1, wherein the processor is further configured to:

receive, from the first user, a request to access a privileged account stored on a target system;

provide, to the first user, access to the privileged account on the target system; and

establish the privileged session between a client device of the first user and the target system.

7. The system of claim 1, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information related to the privileged session.

8. The system of claim 1, wherein the processor is further configured to transmit information related to the first activity pattern to the second user on the client device.

9. A computer-implemented method comprising:

capturing metadata related to a privileged session;

generating a first activity pattern for the privileged session based at least in part on the captured metadata, the first activity pattern comprising a sequence of one or more activities performed by a first user during the privileged session;

identifying, from a set of stored activity patterns, a second activity pattern, the second activity pattern comprising at least a subset of the one or more activities performed by the first user during the privileged session;

determining an action to be performed for the first activity pattern based at least in part on the identification of the second activity pattern; and

transmitting the action to a second user on a client device.

10. The computer-implemented method of claim 9, further comprising determining a weight to be assigned to an activity of the one or more activities performed by the user during the privileged session.

11. The computer-implemented method of claim 10, wherein the weight is determined based on a position of occurrence of the activity in the sequence of the one or more activities comprising the first activity pattern.

12. The computer-implemented method of claim 9 further comprising identifying the second activity pattern based at least in part on identifying a longest matching subsequence between the one or more activities of the first activity pattern and one or more activities of the second activity pattern.

13. The computer-implemented method of claim 9 further comprising:

receiving, from the first user, a request to access a privileged account stored on a target system;

providing, to the first user, access to the privileged account on the target system; and

establishing the privileged session between a client device of the first user and the target system.

14. The computer-implemented method of claim 9, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information related to the privileged session.

15. The computer-implemented method of claim 9 further comprising transmitting the first activity pattern to the second user on the client device.

16. A non-transitory computer-readable media storing computer-executable instructions executable by one or more processors, the computer-executable instructions comprising:

instructions that cause the one or more processors to capture metadata related to a privileged session;

instructions that cause the one or more processors to generate a first activity pattern for the privileged session based at least in part on the captured metadata, the first activity pattern comprising a sequence of one or more activities performed by a first user during the privileged session;

instructions that cause the one or more processors to identify, from a set of stored activity patterns, a second activity pattern, the second activity pattern comprising at least a subset of the one or more activities performed by the first user during the privileged session;

instructions that cause the one or more processors to determine an action to be performed for the first activity pattern based at least in part on the identification of the second activity pattern; and

instructions that cause the one or more processors to transmit the action to a second user on a client device.

17. The computer-readable media of claim 16, the instructions further comprising instructions that cause the one or more processors to:

determine a weight to be assigned to an activity of the one or more activities performed by the user during the privileged session, wherein the weight is determined based on a threat level associated with the activity.

18. The computer-readable media of claim 16, the instructions further comprising instructions that cause the one or more processors to:

determine a weight to be assigned to an activity of the one or more activities based on a position of occurrence of the activity in the sequence of the one or more activities comprising the first activity pattern.

19. The computer-readable media of claim 16, the instructions further comprising instructions that cause the one or more processors to:

identify the second activity pattern based at least in part on identifying a longest matching subsequence between the one or more activities of the first activity pattern and one or more activities of the second activity pattern.

20. The computer-readable media of claim 16, wherein the metadata comprises at least one of application information, system information, network activity information, textual information, visual information and audio information related to the privileged session.