Granted Patent B2

US 12,470,574 · App. 17/726,817 · Granted Nov 11, 2025

Inventors: Vaneeswaran N (Erode, IN); Anushree Priyadarshini (Bangalore, IN); Rahul Deo Vishwakarma (Los Angeles, CA)

Assignee: DELL PRODUCTS L.P.

H04L63/1425H04L63/10

Abstract

Claims (77)

1 . A method for holding an anomalous privileged operation, comprising:

receiving, by a privileged operations monitor executing on a data server, a privileged operation request from a client device;

obtaining a plurality of metrics for the privileged operation request, wherein the plurality of metrics is combined into a single operation metrics entry for the privileged operation request;

calculating an anomaly score for the privileged operation request, based on the single operation metrics entry, wherein calculating the anomaly score comprises:

assigning a numerical value to each metric of the plurality of metrics in the single operation metrics entry, and

performing a plurality of mathematical operations on the numerical value assigned to each metric of the plurality of metrics to obtain the anomaly score;

making a first determination, based on the anomaly score, that the privileged operation request is anomalous;

placing, based on the first determination, a hold on the privileged operation request, wherein a false status is provided to the client device in response to the hold, wherein the false status indicates the privileged operation request is being performed at a slower rate than normal;

making a second determination, based on the first determination and the anomaly score, that additional verification was provided to the client device by a user using the client device; and

allowing, based on the second determination, the privileged operation request to proceed.

2 . The method of claim 1 , wherein making the first determination that the privileged operation request is anomalous, comprises:

comparing the anomaly score for the privileged operation request to a plurality of anomaly scores in a comparative subset of operation metrics entries, wherein the anomaly score for the privileged operation request exceeds a threshold based on the plurality of anomaly scores.

3 . The method of claim 2 , wherein prior to making the first determination that the privileged operation request is anomalous, the method further comprises:

obtaining the comparative subset of operations metrics entries, comprising:

identifying, in an operations database, a subset of operation metrics entries, wherein at least one of a plurality of metrics from the subset of operation metrics entries is identical to at least one of the plurality of metrics for the privileged operation request; and

selecting the subset of operation metrics entries as the comparative subset of operations metrics entries.

4 . The method of claim 3 , wherein the identical metric is one selected from a group consisting of a user and a client device identifier.

5 . The method of claim 3 , wherein after receiving the privileged operation request, the method further comprises:

adding the privileged operation request to the operations database.

6 . The method of claim 1 , wherein based on the first determination and after placing the hold on the privileged operation request, the method further comprises:

notifying a security manager that the privileged operation request is anomalous.

7 . The method of claim 6 , wherein after notifying the security manager, the method further comprises:

making a third determination that a security manager override is not received; and

based on the third determination:

blocking the privileged operation request from proceeding.

8 . The method of claim 6 , wherein after notifying the security manager, the method further comprises:

making a third determination that the security manager override is received; and

based on the third determination:

allowing the privileged operation request to proceed.

9 . A non-transitory computer readable medium comprising instructions which, when executed by a computer processor, enables the computer processor to perform a method for holding an anomalous privileged operation, comprising:

receiving, by a privileged operations monitor executing on a data server, a privileged operation request from a client device;

obtaining a plurality of metrics for the privileged operation request, wherein the plurality of metrics is combined into a single operation metrics entry for the privileged operation request;

calculating an anomaly score for the privileged operation request, based on the single operation metrics entry, wherein calculating the anomaly score comprises:

assigning a numerical value to each metric of the plurality of metrics in the single operation metrics entry, and

performing a plurality of mathematical operations on the numeric value assigned to each metric of the plurality of metric to obtain the anomaly score;

making a first determination, based on the anomaly score, that the privileged operation request is anomalous;

placing, based on the first determination, a hold on the privileged operation request, wherein a false status is provided to the client device in response to the hold, wherein the false status indicates the privileged operation request is being performed at a slower rate than normal;

making a second determination, based on the first determination and the anomaly score, that additional verification was provided to the client device by a user using the client device; and

allowing, based on the second determination, the privileged operation request to proceed.

10 . The non-transitory computer readable medium of claim 9 , wherein making the first determination that the privileged operation request is anomalous, comprises:

comparing the anomaly score for the privileged operation request to a plurality of anomaly scores in a comparative subset of operation metrics entries, wherein the anomaly score for the privileged operation request exceeds a threshold based on the plurality of anomaly scores.

11 . The non-transitory computer readable medium of claim 10 , wherein prior to making the first determination that the privileged operation request is anomalous, the method further comprises:

obtaining the comparative subset of operations metrics entries, comprising:

identifying, in an operations database, a subset of operation metrics entries, wherein at least one of a plurality of metrics from the subset of operation metrics entries is identical to at least one of the plurality of metrics for the privileged operation request; and

selecting the subset of operation metrics entries as the comparative subset of operations metrics entries.

12 . The non-transitory computer readable medium of claim 11 , wherein the identical metric is one selected from a group consisting of a user and a client device identifier.

13 . The non-transitory computer readable medium of claim 11 , wherein after receiving the privileged operation request, the method further comprises:

adding the privileged operation request to the operations database.

14 . The non-transitory computer readable medium of claim 9 , wherein based on the first determination and after placing the hold on the privileged operation request, the method further comprises:

notifying a security manager that the privileged operation request is anomalous.

15 . The non-transitory computer readable medium of claim 14 , wherein after notifying the security manager, the method further comprises:

making a third determination that a security manager override is not received; and

based on the third determination:

blocking the privileged operation request from proceeding.

16 . The non-transitory computer readable medium of claim 14 , wherein after notifying the security manager, the method further comprises:

making a third determination that the security manager override is received; and

based on the third determination:

allowing the privileged operation request to proceed.

17 . A data server, comprising:

a computer processor for executing instructions;

a storage comprising the instructions that when executed by the computer processor, the instructions cause the processor to perform a method for holding an anomalous privileged operation, comprising:

receiving a privileged operation request from a client device;

obtaining a plurality of metrics for the privileged operation request, wherein the plurality of metrics is combined into a single operation metrics entry for the privileged operation request;

calculating an anomaly score for the privileged operation request, based on the single operation metrics entry, wherein calculating the anomaly score comprises:

assigning a numerical value to each metric of the plurality of metrics in the single operation metrics entry, and

performing a plurality of mathematical operations on the numerical value assigned to each metric of the plurality of metrics to obtain the anomaly score;

making a first determination, based on the anomaly score, that the privileged operation request is anomalous;

placing, based on the first determination, a hold on the privileged operation request, wherein a false status is provided to the client device in response to the hold, wherein the false status indicates the privileged operation request is being performed at a slower rate than normal;

making a second determination, based on the first determination and the anomaly score, that additional verification was provided to the client device by a user using the client device; and

allowing, based on the second determination, the privileged operation request to proceed.

18 . The data server of claim 17 , wherein making the first determination that the privileged operation request is anomalous, comprises:

comparing the anomaly score for the privileged operation request to a plurality of anomaly scores in a comparative subset of operation metrics entries, wherein the anomaly score for the privileged operation request exceeds a threshold based on the plurality of anomaly scores.

19 . The data server of claim 18 , wherein prior to making the first determination that the privileged operation request is anomalous, the method further comprises:

obtaining the comparative subset of operations metrics entries, comprising:

identifying, in an operations database, a subset of operation metrics entries, wherein at least one of a plurality of metrics from the subset of operation metrics entries is identical to at least one of the plurality of metrics for the privileged operation request; and

selecting the subset of operation metrics entries as the comparative subset of operations metrics entries.

20 . The data server of claim 19 , wherein the identical metric is one selected from a group consisting of a user and a client device identifier.

Assignments (1)

Continuity (1)

References Cited (13)