Detecting unauthorized, risky, or inefficient usage of privileged credentials through analysis of remote shell protocol bandwidth

Patent metadata

Field	Value
Publication number	US-2016315959-A1
Application number	US-201514694634-A
Country	US
Kind code	A1
Filing date	Apr 23, 2015
Priority date	Apr 23, 2015
Publication date	Oct 27, 2016
Grant date	—

Abstract

A privileged account management system can maintain a database that defines a normal amount of data that should be transferred over a remote session and/or a normal rate at which the data should be transferred when performing a particular task. Using a reason code used to obtain a remote session and possibly a combination of various different characteristics of the remote session, the system can access the database to identify the appropriate normal amount and/or normal rate. The system can then compare the amount and/or rate of data transferred over the remote session to the appropriate normal amount and/or normal rate to detect when an abnormal amount and/or abnormal rate is being transferred. In cases where abnormal behavior is detected, the system can determine that the remote session is likely being used in an improper manner, and can take action to mitigate any potential harm to the server.

First claim

1 . A method, implemented by a privileged account management system,
for detecting unauthorized, risky, or inefficient usage of admin credentials, the method comprising: maintaining a database that defines a plurality of reason code entries, each reason code entry being associated with one of a plurality of reason codes, a protocol, and one or more of a normal amount of data that is transferred over a remote session or a normal rate at which data is transferred over a remote session when accomplishing a task identified by the associated reason code; receiving, from a client device, a request to access a first server via a first remote session using a first protocol, the request including a first reason code that identifies a first task that a first administrator intends to accomplish by accessing the first server over the first remote session; accessing the database to identify a first reason code entry that is associated with the first reason code and the first protocol, and obtaining one or more of a first normal amount or a first normal rate associated with the first reason code entry; monitoring the first remote session to identify one or more of an amount of data that is transferred over the first remote session or a rate that data is transferred over the first remote session; comparing the one or more of the amount or rate to the corresponding one or more of the first normal amount or first normal rate; and when at least one of the one or more of the amount or rate exceeds the corresponding one or more of the first normal amount or first normal rate by a defined threshold, taking an action to mitigate harm to the server.

2 . The method of claim 1 , wherein at least one of the reason code entries is associated with a normal amount that comprises both:
a normal amount of incoming data transferred from a client device to a server when accomplishing the associated task; and a normal amount of outgoing data transferred from a server to a client device when accomplishing the associated task.

3 . The method of claim 2 , wherein monitoring the first remote session includes identifying an amount of incoming data that is transferred from the client device to the first server and an amount of outgoing data that is transferred from the first server to the client device; and
wherein comparing the one or more of the amount or rate includes comparing the amount of incoming data and the amount of outgoing data to a first normal amount of incoming data and a first normal amount of outgoing data respectively associated with the first reason code entry.

4 . The method of claim 1 , wherein at least one of the reason code entries is associated with a normal amount that comprises both:
a normal rate of incoming data that is transferred from a client device to a server when accomplishing the associated task; and a normal rate of outgoing data transferred from a server to a client device when accomplishing the associated task.

5 . The method of claim 4 , wherein monitoring the first remote session includes identifying a rate of incoming data that is transferred from the client device to the first server and a rate of outgoing data that is transferred from the first server to the client device; and
wherein comparing the one or more of the amount or rate includes comparing the rate of incoming data and the rate of outgoing data to a first normal rate of incoming data and a first normal rate of outgoing data respectively associated with the first reason code entry.

6 . The method of claim 1 , wherein at least one of the reason code entries is also associated with one or both of a particular server or a particular administrator.

7 . The method of claim 1 , wherein at least one of the reason code entries is also associated with a particular server and a particular administrator.

8 . The method of claim 1 , wherein at least one of the reason code entries is also associated with one or both of a particular server or a particular group of administrators.

9 . The method of claim 1 , wherein at least one of the reason code entries is associated with each of a normal amount of incoming data, a normal amount of outgoing data, a normal rate of incoming data, and a normal rate of outgoing data.

10 . The method of claim 9 , wherein the at least one of the reason code entries is also associated with a particular server and a particular administrator.

11 . The method of claim 1 , wherein the action comprises one or more of:
flagging the first remote session for review by a security officer; recording communications that are transmitted over the first remote session; capturing one or more screenshots of the client device; or terminating the first remote session.

12 . The method of claim 1 , wherein maintaining the database comprises:
for each reason code entry, monitoring a number of remote sessions that are established using the associated protocol to accomplish the task identified by the associated reason code to identify one or more of an amount of data transferred over each remote session or a rate at which the data is transferred over each remote session, and generating the one or more of the associated normal amount or normal rate from the identified amounts or identified rates.

13 . The method of claim 12 , wherein generating the one or more of the associated normal amount or normal rate from the identified amounts or identified rates comprises generating a normal amount of incoming data, a normal amount of outgoing data, a normal rate of incoming data, and a normal rate of outgoing data from the identified amounts and identified rates.

14 . A method, implemented by a privileged account management system, for creating a database that defines a plurality of reason code entries, each reason code entry being associated with one of a plurality of reason codes, a protocol, and one or more of a normal amount of data that is transferred over a remote session or a normal rate at which data is transferred over a remote session when accomplishing a task identified by the associated reason code, the method comprising:
monitoring each of a plurality of remote sessions to identify one or more of an amount of data that is transferred over the remote session or a rate that data is transferred over the remote session, each remote session being associated with a reason code that defines a task to be accomplished over the remote session, each remote session being established using a particular protocol; from each of a plurality of sets of remote sessions, generating one or more of a normal amount or a normal rate from the one or more of the identified amounts or rates from the set of remote sessions, wherein each of the remote sessions in the set is associated with the same reason code and was established using the same protocol; for each set of remote sessions, storing, in the database, a reason code entry in association with the reason code, the protocol, and the one or more of the normal amount or normal rate for the set such that each reason code entry in the database defines one or more of a normal amount or a normal rate of data that is transferred when performing the task associated with the reason code over a remote session established using the associated protocol.

15 . The method of claim 14 , wherein monitoring each of a plurality of remote sessions includes identifying a server with which the remote session is established, wherein for each of the plurality of sets of remote sessions, each remote session in the set is established with the same server, and wherein each reason code entry is also associated with the server

Assignees

• Dell Software Inc

Inventors

• Peterson Matthew T
• Peterson Daniel F
• Jones Jordan S

Classifications

• H04L67/143

  Termination or inactivation of sessions, e.g. event-controlled end of session · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title