System and method for monitoring computing servers for possible unauthorized access

• US 9,794,293 B1
• Filed: 03/18/2016
• Issued: 10/17/2017
• Est. Priority Date: 12/16/2013
• Status: Active Grant

• Current Assignee: 8X8, Inc.
• Original Assignee: 8X8, Inc.
• Inventors: Martin, Bryan, Liu, Zhishen, Zhao, Qing
• Primary Examiner(s): Thiaw, Catherine
• Application Number:
  US15/074,147
• Time in Patent Office: 578 Days
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system is provided that includes one or more computing servers and a processing circuit for monitoring data transactions of the computing servers. Each of the computing servers is configured to provide respective services to remote users. The processing circuit is configured to monitor data transactions of at least one of the computing servers, which is associated with a user account. A security policy of the user account includes a set of conditions that are indicative of unauthorized access when the conditions are satisfied by various characteristics of the monitored data. The processing circuit is configured to determine a threat level based on the characteristics of the data transactions and the conditions of the security policy. In response to the threat level exceeding a first threshold level indicated in the security policy of the user account, the processing circuit sends a notification to an authorized user of the user account.

Claims

1. A system, comprising:

one or more VoIP servers, each configured and arranged to provide respective VoIP services to remote users; and

a processing circuit communicatively-coupled to the one or more VoIP servers and configured and arranged to;

monitor a frequency of access to the VoIP services on behalf of a particular user account corresponding to frequency characteristics indicative of unauthorized access including at least a call loop;

determine a threat level as a function of the frequency of the access relative to an average frequency of access for the VoIP services; and

disable, in response to the threat level exceeding a threshold level indicated in a security policy of the particular user account, at least one of the VoIP services for the particular user account.

2. The system of claim 1, wherein the processing circuit is further configured and arranged to determine the threat level as a function of a cost of the access to the VoIP services.

3. The system of claim 1, wherein the threat level is a threat level for the particular user account, and the processing circuit is further configured and arranged to determine the threat level as a function of whether the accesses to the VoIP services corresponds to inbound or outbound calls relative to the VoIP server.

4. The system of claim 1, wherein the processing circuit is further configured and arranged to determine the threat level as a function of whether the accesses to the VoIP services include use of voicemail services.

5. The system of claim 4, wherein the processing circuit is further configured and arranged to determine the threat level based upon an amount of VoIP content that is downloaded from the voicemail services.

6. The system of claim 1, wherein the processing circuit is further configured and arranged to generate a notification to a user indicated in the security policy.

7. The system of claim 6, wherein the processing circuit is further configured and arranged to generate and send multiple notifications to multiple recipients.

8. The system of claim 6, wherein the notification includes selectable options for a recipient of the notification.

9. The system of claim 1, wherein the processing circuit is further configured and arranged to determine the threat level based upon different levels of sensitivity for different VoIP services.

10. The system of claim 1, wherein the processing circuit is further configured and arranged to:

monitor a size of data transactions executed by the particular user account; and

determine the threat level as a function of the size of data transactions executed by the particular user account relative to a threshold transaction size indicated in the security policy.

11. The system of claim 10, wherein the processing circuit is further configured and arranged to determine the threat level as a function of the size of data transactions executed by the particular user account relative to a data transfer limit for the particular user account.

12. A method for use with one or more VoIP servers that are each configured and arranged to provide respective VoIP services to remote users, the method comprising:

using a processing circuit communicatively-coupled to the one or more VoIP servers to;

monitor a frequency of access to the VoIP services on behalf of a particular user account corresponding to frequency characteristics indicative of unauthorized access including at least a call loop;

determine a threat level as a function of the frequency of the access relative to an average frequency of access for the VoIP services; and

disable, in response to the threat level exceeding a threshold level indicated in a security policy of the particular user account, at least one of the VoIP services for the particular user account.

13. The method of claim 12, wherein the processing circuit is further configured and arranged to determine the threat level as a function of a cost of the access to the VoIP services, and wherein the unauthorized access includes access to the VoIP services by an unauthorized internet protocol (IP) address.

14. The method of claim 12, further comprising using the processing circuit to determine the threat level as a function of whether the accesses to the VoIP services corresponds to inbound or outbound calls relative to the VoIP server, and to monitor the frequency of access for network connectivity problems between the VoIP server and the remote users.

15. The method of claim 12, further comprising using the processing circuit to determine the threat level as a function of whether the accesses to the VoIP services include use of voicemail services.

16. The method of claim 15, further comprising using the processing circuit to determine the threat level based upon an amount of VoIP content that is downloaded from the voicemail services.

17. The method of claim 12, further comprising using the processing circuit to generate a notification to a user indicated in the security policy.

18. The method of claim 17, further comprising using the processing circuit to generate and send multiple notifications to multiple recipients.

19. The method of claim 17, wherein the notification includes selectable options for a recipient of the notification.

20. The method of claim 12, further comprising using the processing circuit to determine the threat level based upon different levels of sensitivity for different VoIP services.