Patent ID: 11936533
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 14:
15. A tangible, non-transitory, computer-readable medium that program instructions that cause a device to execute a process comprising:
receiving administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyzing the administration traffic data to determine whether any portion of the administration traffic data results from an administration session involving a trusted administrator;
flagging a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the trusted administrator, wherein a second portion of the administration traffic data is non-flagged;
assessing the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
performing, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.