Patent ID: 9197653
Filing Date: 2015-11-24
Classification: G06F,G06N,H04L

Abstract:
1. A method to detect server-side multi-target intrusions through cross-user correlation, the method comprising: detecting a low-probability administrative event associated with a user of a datacenter, wherein the administrative event is one or more of a change to a user status, a change to a file associated with user status, a replacement of a key executable file associated with the user, a change to a data file associated with the user, a transfer, an update of status, an unusual port use, and/or an unusual hardware use; monitoring confluences of the administrative event within virtual machines of the datacenter across multiple users; in response to a determination that the administrative event is detected across the multiple users at a level higher than a predefined probability threshold, classifying the administrative event as an attack; preventing another attack within the datacenter prior to an identification of a vulnerability of the datacenter, through which the attack occurred, by combining a side channel technique with automated actions, the automated actions designed to alter a security environment within the datacenter and linked to a possible mass attack alert to provide a solution for the attack; and providing one or more signatures generated for the administrative event based on one or more anomalous characteristics of the administrative event to one or more other datacenters within a same cloud such that the one or more other datacenters are enabled to prevent the attack universally within the cloud prior to the identification of the vulnerability of the datacenter.