US 12,443,709 B2
Anomaly detection based on multi-level authentication
Douglas Max Grover, Rigby, ID (US); and Michael F. Angelo, Houston, TX (US)
Assigned to Micro Focus LLC, Santa Clara, CA (US)
Filed by MICRO FOCUS LLC, Santa Clara, CA (US)
Filed on Aug. 17, 2023, as Appl. No. 18/451,304.
Prior Publication US 2025/0061194 A1, Feb. 20, 2025
Int. Cl. G06F 21/55 (2013.01); G06F 21/31 (2013.01); H04L 67/50 (2022.01)
CPC G06F 21/554 (2013.01) [G06F 21/316 (2013.01); H04L 67/535 (2022.05)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
determining, by a microprocessor, that a user has authenticated to a computer system using a plurality of authentication levels;
separately tracking, by the microprocessor, behavior of the user at each of the plurality of authentication levels to identify separate usage patterns of the user at each of the plurality of authentication levels;
identifying, by the microprocessor, anomalous behavior of the user based on one or more variations from the separate usage patterns of the user at, at least one of the plurality of authentication levels; and
taking, by the microprocessor, an action based on identifying the anomalous behavior of the user,
wherein the separate usage patterns of the user at each of the plurality of authentication levels comprises a plurality of separate usage patterns of the user at one or more of the plurality of authentication levels, and
wherein the plurality of separate usage patterns of the user at the one or more of the plurality of authentication levels are based on at least one of: whether the user logs in at a lower authentication level and then logs in at a higher authentication level at a later point in time, and whether the user first logs in at the higher authentication level.