Method and apparatus for detecting irregularities on a device

• US 9,767,278 B2
• Filed: 09/12/2014
• Issued: 09/19/2017
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: Elasticsearch Global B.V. (Elastic N.V.)
• Original Assignee: Elasticsearch Global B.V. (Elastic N.V.)
• Inventors: Dodson, Stephen
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US14/484,633
• Publication Number:
  US 20150082437A1
• Time in Patent Office: 1,103 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A system and method for the detection of irregularities, such as fraud or malware, running on a device, is disclosed. The system comprises a monitoring program for reviewing data relating to operation of the device, a device profile including data items relating to typical operation of the device generated from messages relating to the device; and an alert module for generating an alert on detection of unusual activity relating to the device.

Claims

1. A system for the detection of irregularities of a device, the system comprising:

a hardware processor; and

a memory communicatively coupled with the hardware processor, the memory storing instructions which when executed by the hardware processor performs a method, the method comprising;

creating, by a monitoring program, a device baseline profile comprising data items relating to a typical operation of the device, the data items comprising at least two of;

(i) ports associated with processes,

(ii) addresses of connectable devices, and

(iii) volumes of data;

storing, in a user profile database, the device baseline profile;

receiving, by the monitoring program, new ones of data items indicative of a current operation of the device;

determining, by the monitoring program, whether the new ones of data items deviate from the typical operation of the device by comparing the new ones of data items to the stored device baseline profile;

based on the determining, updating, by the monitoring program, the stored device baseline profile to create an updated device baseline profile with the new ones of data items if the new ones of data items do not deviate from the typical operation of the device; and

based on the determining, generating, by an alert module, an alert based on detection of the deviating from the typical operation of the device, the deviating from the typical operation of the device being transferring unusual amounts of data, continually accessing a new website, connecting to an unexpected IP address, or using an infrequently used port.

2. The system of claim 1, wherein the irregularities are one or more of malware or fraud.

3. A method for the detection of irregularities of a device, the method comprising:

reviewing, by a monitoring program, data items of a device;

detecting, by the monitoring program, a plurality of the data items relating to a typical operation of the device;

creating, by the monitoring program, a device baseline profile including the plurality of the data items relating to the typical operation of the device, the plurality of the data items comprising at least two of;

(i) ports associated with processes,

(ii) addresses of connectable devices, and

(iii) volumes of data;

receiving, by the monitoring program, new ones of data items indicative of a current operation of the device;

determining, by the monitoring program, whether the new ones of data items deviate from the typical operation of the device by comparing the new ones of data items to the device baseline profile;

based on the determining, updating, by the monitoring program, the device baseline profile to create an updated device baseline profile with the new ones of data items if the new ones of data items do not deviate from the typical operation of the device; and

based on the determining, generating an alert based on the determining of the deviating from the typical operation of the device, the deviating from the typical operation of the device being transferring unusual amounts of data, continually accessing a new website, connecting to an unexpected IP address, or using an infrequently used port.

4. A method for the detection of irregularities in a network, the network comprising at least one computer having a plurality of outgoing connections and a plurality of incoming connections connected to one or more servers and wherein a plurality of processes are running on the at least one computer, the method comprising the steps of:

continuously receiving, by a monitoring program, data items relating to the network, the computer, and messages exchanged within the network, the monitoring program connected to the network;

automatically reviewing, by the monitoring program, the received data items;

detecting a plurality of the data items relating to a typical operation of a device;

creating, by the monitoring program, and storing in a database a device baseline profile including the plurality of the data items relating to the typical operation of the device connected to the network, the plurality of the data items comprising at least two of;

(i) ports associated with processes,

(ii) addresses of connectable devices, and

(iii) volumes of data;

receiving, by the monitoring program, new ones of data items indicative of a current operation of the device;

determining, by the monitoring program, whether the new ones of data items deviate from the typical operation of the device by comparing the new ones of data items to the stored device baseline profile;

based on the determining, updating, by the monitoring program, the stored device baseline profile to create an updated device baseline profile with the new ones of data items if the new ones of data items do not deviate from the typical operation of the device; and

based on the determining, generating an alert based on the determining of the deviating from the typical operation of the device, the deviating from the typical operation of the device being transferring unusual amounts of data, continually accessing a new website, connecting to an unexpected IP address, or using an infrequently used port.