PATENT CLAIM ANALYSIS

Application Number: 15891873
Application Type: Utility
Filing Date: 2018-02
Publication Date: 2018-06
Patent Classification: ["726", "023000"]

Abstract:
Various systems and methods are provided that detect malicious network tunneling. For example, VPN logs and data connection logs may be accessed. The VPN logs may list client IP addresses that have established a VPN connection with an enterprise network. The data connection logs may list client IP addresses that have requested connections external to the enterprise network and remote IP addresses to which connections are requested. The VPN logs and the data connection logs may be parsed to identify IP addresses that are present in the VPN logs as a client IP address and in the data connection logs as a remote IP address. If an IP address is so present, user data and traffic data associated with the IP address may be retrieved to generate a risk score. If the risk score exceeds a threshold, an alert to be displayed in a GUI is generated.

Claim (Index 1):
A computing system comprising:\n a computer processor; and a non-transitory computer readable storage medium storing program instructions configured for execution by the computer processor in order to cause the computing system to:\n access a first log including a listing of one or more client IP addresses corresponding to one or more remote users granted access to a network; \n access a second log including a listing of one or more remote IP addresses requested via the network; \n identify a first IP address included in the first log and in the second log; \n generate a risk score based on data associated with the first IP address, the risk score at least partly indicative of a likelihood that a malicious tunneling connection is present; and \n generate user interface data that, when executed, causes a user device to display a user interface depicting one or more alerts generated using the risk score.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 88.0
- Lexical Diversity: 2.53226
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14823935', '15228297', '14632514', '15079219', '14147402']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2464403648235422
- 35 USC 102 Novelty (BERT): 0.550073749119361
- Combined Prediction Score: 0.2768037032531241
- Mean Citation Score: 269.241482
- Max Citation Score: 401.59933
- Similarity Product: 351.4335003020191

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test