Patent ID: 9537880
Date: 2017-01-03
CPC Classifications: G06F,H04L

Claim:
1. A computerized method performed by one or more computer systems configured to access one or more electronic data sources in response to requests received from an interactive user interface, the requests configured to detect high-risk behavior by potential attackers of a network associated with the computer systems, the method comprising: obtaining logs from at least one network, the network comprising: determining respective network actions of the user accounts based on the logs, wherein one or more determined network actions of a particular user account include transitions to one or more different user accounts, wherein at least one transition is associated with escalations of user privileges; maintaining, in one or more databases, information identifying the respective network actions of the user accounts; determining, for each of the user accounts, one or more user compromise scores associated with the user account based on the network actions maintained in the one or more databases, the user compromise scores measuring respective types of user behavior associated with a risk of compromise, wherein the user compromise scores include a user chaining score, and wherein determining the user chaining score for the particular user account is based on the different user accounts transitioned to, or accessed by, the particular user account, and wherein determining the user chaining score includes monitoring IP addresses specified in the logs; determining, based on the user compromise scores associated with each user account, a set of user accounts of the plurality of user accounts for review, the determined set of user accounts representing potential high-risk behavior such that the users associated with the user accounts are potential attackers of the network; providing, for presentation in an interactive user interface, information describing user accounts of the set of user accounts and respective user compromise scores associated with user accounts of the set of user accounts; and taking action to prevent an attack.