Techniques for monitoring privileged users and detecting anomalous activities in a computing environment
US-2018375886-A1 · Dec 27, 2018 · US
US11609929B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11609929-B2 |
| Application number | US-202017009337-A |
| Country | US |
| Kind code | B2 |
| Filing date | Sep 1, 2020 |
| Priority date | Dec 27, 2017 |
| Publication date | Mar 21, 2023 |
| Grant date | Mar 21, 2023 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
A method is provided that includes accessing, by a server provider server of a service provider, a database storing associations between network addresses and locations. Additionally, the method includes determining a subset of the database corresponding to a first network address, each association included in the subset corresponding to an association between the first network address and a respective location. The method also includes in response to determining that the subset of the database satisfies one or more clustering criteria, calculating a representative location corresponding to the first network address, and storing an association between the first network address and the representative location in a second database.
Opening claim text (preview).
What is claimed is: 1. A system, comprising: one or more hardware processors; and a memory storing computer-executable instructions, that in response to execution by the one or more hardware processors, causes the system to perform operations comprising: accessing, via an electronic network, a first database storing a first set of database entries, wherein each database entry of the first set of database entries includes a network address of a first type and a location corresponding to the network address; determining that multiple locations for a first network address of a first entry of the first set of database entries exist but a single representative location for the first network address lacks accuracy, wherein the determining that the single representative location lacks accuracy is based on a cluster density associated with the multiple locations being less than a predefined threshold; in response to determining that the single representative location for the first network address lacks accuracy, accessing, via the electronic network, a second database storing a second set of database entries, wherein the second set of database entries comprise associations between network addresses of the first type and locations corresponding to the network addresses; identifying a second entry in the second database that comprises an association between the first network address and a particular location; and storing the particular location as the single representative location for the first network address corresponding to the first entry. 2. The system of claim 1 , wherein the second set of database entries includes information associated with at least one of transactions conducted with the third-party or network traffic monitored by the third-party. 3. The system of claim 1 , wherein the second database is accessed using the first network address as a key or index into the second database. 4. The system of claim 1 , wherein the particular location is stored on a third database as Global Positioning System (GPS) coordinates. 5. The system of claim 1 , wherein the operations further comprise determining a risk level of a transaction involving the first network address. 6. The system of claim 1 , wherein the first network address corresponds to an Internet Protocol (IP) address. 7. The system of claim 1 , wherein the operations further comprise calculating the cluster density based on a centroid of the multiple locations. 8. A method, comprising: accessing, via an electronic network, a first database storing a first set of database entries, wherein each database entry of the first set of database entries includes a network address of a first type and a location corresponding to the network address; determining that multiple locations for a first network address of a first entry of the first set of database entries exist while the first network address lacks a single accurate representative location for the first network address, wherein the determining that the first network address lacks the single accurate representative location is based on a cluster density associated with the multiple locations being less than a predefined threshold; in response to determining that the first network address lacks the single accurate representative location for the first network address, accessing, via the electronic network, a second database storing a second set of database entries, wherein the second set of database entries comprise associations between network addresses of the first type and locations corresponding to the network addresses; identifying a second entry in the second database that stores an association between the first network address and a particular location; and storing the particular location as the single representative location for the first network address corresponding to the first entry. 9. The method of claim 8 , wherein the second set of database entries includes information associated with at least one of transactions conducted with the third-party or network traffic monitored by the third-party. 10. The method of claim 8 , wherein the second database is accessed using the first network address as a key or index into the second database. 11. The method of claim 8 , wherein the particular location is stored on a third database as Global Positioning System (GPS) coordinates. 12. The method of claim 8 , further comprising determining a risk level of a transaction involving the first network address. 13. The method of claim 8 , wherein the first network address corresponds to an Internet Protocol (IP) address. 14. The method of claim 8 , further comprising calculating the cluster density based on a centroid of the multiple locations. 15. A non-transitory computer readable medium storing computer-executable instructions that in response to execution by one or more hardware processors, causes a service provider system to perform operations comprising: accessing, via an electronic network, a first database storing a first set of database entries, wherein each database entry of the first set of database entries includes a network address of a first type and a location corresponding to the network address; determining multiple locations for a first network address of a first entry of the first set of database entries; determining an accuracy measure of each location of the multiple locations, the accuracy measure indicating a confidence level with respect to an estimation of each location being an accurate representative location for the first network address; in response to each of the determined accuracy measure failing to meet a predefined threshold, accessing, via the electronic network, a second database storing a second set of database entries, wherein the second set of database entries comprise associations between network addresses of the first type and locations corresponding to the network addresses; identifying a second entry in the second database that stores an association between the first network address and a particular location; and storing the particular location as an accurate representative location for the first network address corresponding to the first entry. 16. The non-transitory computer readable medium of claim 15 , wherein the storing comprises storing the particular location as a single accurate representative location for the first network address. 17. The non-transitory computer readable medium of claim 15 , wherein the second set of database entries includes information associated with at least one of transactions conducted with the third-party or network traffic monitored by the third-party. 18. The non-transitory computer readable medium of claim 15 , wherein the second database is accessed using the first network address as a key or index into the second database. 19. The non-transitory computer readable medium of claim 15 , wherein the particular location is stored on a third database as Global Positioning System (GPS) coordinates. 20. The non-transitory computer readable medium of claim 19 , wherein the first network address is in a format of an Internet Protocol (IP) address.
using geographic information, e.g. room number · CPC title
Spatial or temporal dependent retrieval, e.g. spatiotemporal queries · CPC title
Network directories; Name-to-address mapping · CPC title
Clustering or classification · CPC title
Transactions dependent on location of M-devices · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.