Patent ID: 11962615
Assignee: BANK OF AMERICA CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 12:
13. A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:
detect a first number of invalid sign-on attempts with respect to a plurality of user profiles during a first time interval, wherein the first time interval is from an initial timestamp to a first timestamp;
detect a second number of invalid sign-on attempts with respect to the plurality of user profiles during a second time interval, wherein the second time interval is from the first timestamp to a second timestamp;
determine a difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
determine whether the first number of invalid sign-on attempts is more than a first threshold number, wherein:
the first threshold number is associated with invalid sign-on attempts, and
the first threshold number is determined with respect to the first time interval;

in response to determining that the difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the first threshold number, trigger a first alert that indicates detection of a first DoS attack on multiple user profiles during the second time interval;
combine the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
determine whether the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than a second threshold number, wherein:
the second threshold number is associated with the second time interval, and
the second time interval has a more duration than the first time interval; and

in response to determining that the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the second threshold number, trigger a second alert that indicates detection of a second DoS attack on multiple user profiles during the first time interval and the second time interval.