Patent ID: 11943200
Assignee: SAUDI ARABIAN OIL COMPANY
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 18:
19. A system comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
obtaining first data indicating a plurality of properties of a first virtual private network (VPN) session by a computer system on a communications network, wherein the properties of the first VPN session comprise at least one of:
a number of allowed connection attempts by the computer system to each of a plurality of first subnets of the communications network during the first VPN session,
a number of blocked connection attempts by the computer system to each of a plurality of second subnets of the communications network during the first VPN session,
a number of allowed connection attempts by the computer system using each of a plurality of first network ports during the first VPN session, and
a number of blocked connection attempts by the computer system using each of a plurality of second network ports during the first VPN session;

determining, using a computerized neural network implemented, a metric for the first VPN session based on the first data, wherein the metric represents an estimated likelihood that the first VPN session is associated with a malicious activity; and
controlling the first VPN session based on the metric.