Patent ID: 11943200
Assignee: SAUDI ARABIAN OIL COMPANY
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method comprising:
obtaining, using one or more processors, first data indicating a plurality of properties of a first virtual private network (VPN) session by a computer system on a communications network, wherein the properties of the first VPN session comprise:
a number of allowed connection attempts by the computer system to each of a plurality of first subnets of the communications network during the first VPN session,
a number of blocked connection attempts by the computer system to each of a plurality of second subnets of the communications network during the first VPN session,
a number of allowed connection attempts by the computer system using each of a plurality of first network ports during the first VPN session, and
a number of blocked connection attempts by the computer system using each of a plurality of second network ports during the first VPN session;

determining, using a computerized neural network implemented by the one or more processors, a metric for the first VPN session based on the first data, wherein the metric represents an estimated likelihood that the first VPN session is associated with a malicious activity; and
controlling, by the one or more processors, the first VPN session based on the metric.