Methods, systems and computer program products for geography and time monitoring of a server application user
Methods, systems and computer program products are disclosed for geography and time monitoring of a server application user in a computer network. The methods, systems, and computer program products can monitor communication data between a server application and a client. The methods, systems, and computer program products can also include applying one or more detectors to the communication data to identify a variety of predetermined activity. Further, the methods, systems, and computer program products can include generating a threat score associated with the predetermined activity by comparing the identified predetermined activity with a security threshold criteria.
1 . A method for monitoring login session activity for a client of a server application, the method comprising:
(a) identifying a first geographic location of a first client initiating a first login session;
(b) identifying a second geographic location of a second client initiating a second login session;
(c) analyzing the first and second geographic locations to identify any geographic difference;
(d) identifying a time interval between the initiation of the first login session and the second login session; and
(e) analyzing the geographical difference and the time interval.
2 . The method of claim 1 , comprising generating a threat score based upon the analysis of the geographical difference and the time interval.
3 . The method of claim 1 , wherein step (a) comprises determining a protocol address of the first client.
4 . The method of claim 3 , wherein step (a) comprises determining the first geographic location based on the protocol address of the first client.
5 . The method of claim 3 , wherein the protocol address is an Internet protocol address.
6 . The method of claim 1 , wherein step (b) comprises determining a protocol address of the second client.
7 . The method of claim 6 , wherein step (b) comprises determining the second geographic location based on the protocol address of the second client.
8 . The method of claim 6 , wherein the protocol address is an Internet protocol address.
9 . The method of claim 1 , comprising:
(a) determining a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) comparing the first time interval to a second time interval.
10 . The method of claim 9 , comprising:
(a) determining whether the first time interval is greater than the second time interval; and
(b) if the first time interval is greater than the second time interval, generating a threat score of zero.
11 . The method of claim 9 , comprising:
(a) determining whether the first time interval is less than the second time interval; and
(b) if the first time interval is less than the second time interval, generating a positive threat score.
12 . The method of claim 1 , comprising determining a geographic difference between the first and second geographic locations.
13 . The method of claim 1 , wherein the geographic difference is a first geographic difference, and comprising:
(a) determining a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) comparing the first geographic difference and the first time interval to a second geographic difference and a second time interval to generate a security value.
14 . A system for monitoring login session activity for a client of a server application, the system comprising:
(a) a network interface operable to monitor communication data of a server application; and
(b) a detector operable to:
(i) identify a first geographic location of a first client initiating a first login session with the server application;
(ii) identify a second geographic location of a second client initiating a second login session with the server application;
(iii) analyze the first and second geographic locations to identify any geographic difference;
(iv) identify a time interval between the initiation of the first login session and the second login session; and
(v) analyze the geographical difference and the time interval.
15 . The system of claim 14 , wherein the detector is operable to generate a threat score based upon the analysis of the geographical difference and time interval.
16 . The system of claim 15 , wherein the detector is operable to determine a protocol address of the first client.
17 . The system of claim 16 , wherein the detector is operable to determine the first geographic location based on the protocol address of the first client.
18 . The system of claim 17 , wherein the protocol address is an Internet protocol address.
19 . The system of claim 15 , the detector is operable to determine a protocol address of the second client.
20 . The system of claim 19 , the detector is operable to determine the second geographic location based on the protocol address of the second client.
21 . The system of claim 19 , wherein the protocol address is an Internet protocol address.
22 . The system of claim 15 , wherein the detector is operable to:
(a) determine a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) compare the first time interval to a second time interval.
23 . The system of claim 22 , wherein the detector is operable to:
(a) determine whether the first time interval is greater than the second time interval; and
(b) if the first time interval is greater than the second time interval, generate a threat score of zero.
24 . The system of claim 22 , wherein the detector is operable to:
(a) determine whether the first time interval is less than the second time interval; and
(b) if the first time interval is less than the second time interval, generate a positive threat score.
25 . The system of claim 14 , the detector is operable to determine a geographic difference between the first and second geographic locations.
26 . The system of claim 14 , wherein the geographic difference is a first geographic difference, and the detector is operable to:
(a) determine a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) compare the first geographic difference and the first time interval to a second geographic difference and a second time interval to generate a security value.
27 . A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:
(a) identifying a first geographic location of a first client initiating a first login session;
(b) identifying a second geographic location of a second client initiating a second login session;
(c) analyzing the first and second geographic locations to identify any geographic difference;
(d) identifying a time interval between the initiation of the first login session and the second login session; and
(e) analyzing the geographical difference and the time interval.
28 . The computer program product of claim 27 , comprising generating a threat score based upon the analysis of the geographical difference and the time interval.
29 . The computer program product of claim 28 , wherein step (a) comprises determining a protocol address of the first client.
30 . The computer program product of claim 29 , wherein step (a) comprises determining the first geographic location based on the protocol address of the first client.
31 . The computer program product of claim 29 , wherein the protocol address is an Internet protocol address.
32 . The computer program product of claim 28 , wherein step (b) comprises determining a protocol address of the second client.
33 . The computer program product of claim 32 , wherein step (b) comprises determining the second geographic location based on the protocol address of the second client.
34 . The computer program product of claim 32 , wherein the protocol address is an Internet protocol address.
35 . The computer program product of claim 28 , comprising:
(a) determining a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) comparing the first time interval to a second time interval.
36 . The computer program product of claim 35 , comprising:
(a) determining whether the first time interval is greater than the second time interval; and
(b) if the first time interval is greater than the second time interval, generating a security value of zero.
37 . The computer program product of claim 35 , comprising:
(a) determining whether the first time interval is less than the second time interval; and
(b) if the first time interval is less than the second time interval, generating a positive threat score.
38 . The computer program product of claim 27 , comprising determining a geographic difference between the first and second geographic locations.
39 . The computer program product of claim 27 , wherein the geographic difference is a first geographic difference, and comprising:
(a) determining a first time interval between the initiation of the first login session and the initiation of the second login session; and
(b) comparing the first geographic difference and the first time interval to a second geographic difference and a second time interval to generate a security value.