Patent ID: 9635045
Date: 2017-04-25
CPC Classifications: H04L

Claim:
1. A method, implemented by a privileged account management system, for detecting unauthorized, risky, or inefficient usage of admin credentials, the method comprising: maintaining a database that defines a plurality of reason code entries, each reason code entry being associated with one of a plurality of reason codes, a protocol, and one or more of a normal amount of data that is transferred over a remote session or a normal rate at which data is transferred over a remote session when accomplishing a task identified by the associated reason code; receiving, from a client device, a request to access a first server via a first remote session using a first protocol, the request including a first reason code that identifies a first task that a first administrator intends to accomplish while logged in to the first server via the first remote session; accessing the database to identify a first reason code entry that is associated with the first reason code and the first protocol, and obtaining one or more of a first normal amount or a first normal rate associated with the first reason code entry; monitoring the first remote session to identify one or more of an amount of data that is transferred over the first remote session or a rate that data is transferred over the first remote session; comparing the one or more of the amount or rate to the corresponding one or more of the first normal amount or first normal rate; and when at least one of the one or more of the amount or rate exceeds the corresponding one or more of the first normal amount or first normal rate by a defined threshold, taking an action to mitigate harm to the server.