Patent ID: 11936533
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method comprising:
receiving, at a service, administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyzing, by the service, the administration traffic data to determine whether any portion of the administration traffic data results from an administration session involving a trusted administrator;
flagging, by the service, a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the trusted administrator, wherein a second portion of the administration traffic data is non-flagged;
assessing, by the service, the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
performing, by the service and based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.