Patent ID: 11936533
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 7:
8. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and executing one or more operations; and
a memory storing a process that is executable by the processor, the process when executed causing the apparatus to:
receive administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyze the administration traffic data to determine whether any portion of the administration traffic data results from an administration session involving a trusted administrator;
flag a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the trusted administrator, wherein a second portion of the administration traffic data is non-flagged;
assess the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
perform, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.