Patent ID: 8353032

Claim:
A method for detecting an anomaly relating to computing resource access, the method comprising: logging in to a computing resource using identity information of a user; storing a current login time in an access time database; accessing a last local login time for the computing resource from the access time database; determining a last resource login time from the computing resource; comparing, using at least one computer processor, the last local login time to the last resource login time, wherein a result of the comparison indicates a resource access anomaly if the last local login time is different from the last resource login time and wherein a result of the comparison indicates no resource access anomaly if the last local login time is the same as the last resource login time; if the last local login time is more recent than the last resource login time, ascertaining that the resource access anomaly is that (i) a user previously provided the identity information to a different computing resource from the user's intended computing resource, and (ii) an unauthorized access has occurred previously and the identity information has been exploited without user consent; and if the last local login time is less recent than the last resource login time, ascertaining that the resource access anomaly is that the identity information is compromised by at least one of (i) the identity information having previously been phished when the user previously provided the identity information to the different computing resource, (ii) the identity information is presently being phished during the current login to the computing resource for the purpose of determining identity information or user habits.