User behavior profile

• US 10,171,488 B2
• Filed: 01/11/2018
• Issued: 01/01/2019
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Moynahan, Matthew P., Ford, Richard Anthony, Shirey, Christopher Brian, Swafford, Brandon L., Thompson, Richard Heath
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/867,960
• Publication Number:
  US 20180332066A1
• Time in Patent Office: 355 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method, system and computer-usable medium are disclosed for generating a cyber behavior profile comprising monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions, the electronic information representing the user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction; and generating a unique multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions.

Claims

1. A computer-implementable method for generating a cyber behavior profile, comprising:

monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction; and

generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;

identifying a known good interaction between the user and the information handling system;

storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;

identifying an anomalous interaction between the user and the information handling system;

storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;

generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and

,

storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.

2. The method of claim 1, further comprising:

associating the multi-dimensional cyber behavior profile with the user.

3. The method of claim 2, wherein:

the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and

,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

4. The method of claim 1, wherein:

at least one of the respective layer of user interactions correspond to temporal user interactions.

5. The method of claim 1, wherein:

the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

6. The method of claim 3, wherein:

the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.

7. The method of claim 1, further comprising:

identifying the known good interactions as known good behavior;

determining whether additional interactions do not correspond to the known good behavior; and

,

performing an enforcement operation when the additional interactions do not correspond to the known good behavior.

8. The method of claim 1, further comprising:

storing the multi-dimensional cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of cyber behavior profiles, each the plurality of cyber behavior profiles corresponding to a respective user.

9. The method of claim 8, further comprising:

securing each of the plurality of cyber behavior profiles prior to storing within the cyber behavior repository.

10. The method of claim 8, further comprising:

monitoring an information technology environment using the plurality of behavioral identifiers;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of cyber behavior profiles.