User behavior profile

• US 10,264,012 B2
• Filed: 04/20/2018
• Issued: 04/16/2019
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Inventors: Moynahan, Matthew P., Ford, Richard Anthony, Shirey, Christopher Brian, Swafford, Brandon L., Thompson, Richard Heath
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/958,738
• Publication Number:
  US 20180332068A1
• Time in Patent Office: 361 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method, system and computer-usable medium are disclosed for generating a cyber behavior profile comprising monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions, the electronic information representing the user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction; and generating a unique multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions.

Claims

1. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code for generating a cyber behavior profile, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction;

generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;

identifying a known good interaction between the user and the information handling system;

storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;

identifying an anomalous interaction between the user and the information handling system;

storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;

generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and

,

storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.

2. The system of claim 1, wherein the instructions executable by the processor are further configured for:

associating the unique multi-dimensional cyber behavior profile with the user.

3. The system of claim 2, wherein:

the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and

,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

4. The system of claim 1, wherein:

at least one respective layer of user interaction corresponds to temporal user interactions.

5. The system of claim 1, wherein:

the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

6. The system of claim 3, wherein:

the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.

7. The system of claim 1, wherein the instructions executable by the processor are further configured for:

identifying the interactions between the user and the information handling system used for generating the unique cyber behavior profile as known good behavior;

determining whether additional interactions identified as between the user and the information handling system do not correspond to the known good behavior; and

,

performing an enforcement operation when additional interactions identified as between the user and the information handling system do not correspond to the known good behavior.

8. The method of claim 1, wherein the instructions executable by the processor are further configured for:

storing the unique cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of unique cyber behavior profiles, each the plurality of unique cyber behavior profiles corresponding to a respective user.

9. The method of claim 8, wherein the instructions executable by the processor are further configured for:

securing each of the plurality of unique cyber behavior profiles prior to storing within the cyber behavior repository.

10. The method of claim 8, wherein the instructions executable by the processor are further configured for:

monitoring an information technology environment using the plurality of unique behavioral identifiers;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of unique cyber behavior profiles.

11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction;

generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;

identifying a known good interaction between the user and the information handling system;

storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;

identifying an anomalous interaction between the user and the information handling system;

storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;

generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and

,

storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.

12. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for:

associating the unique multi-dimensional cyber behavior profile with the user.

13. The non-transitory, computer-readable storage medium of claim 12, wherein:

the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and

,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

14. The non-transitory, computer-readable storage medium of claim 11, wherein:

at least one respective layer of user interaction corresponds to temporal user interactions.

15. The non-transitory, computer-readable storage medium of claim 11, wherein:

the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

16. The non-transitory, computer-readable storage medium of claim 13, wherein:

the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.

17. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for:

identifying the interactions between the user and the information handling system used for generating the unique cyber behavior profile as known good behavior;

determining whether additional interactions identified as between the user and the information handling system do not correspond to the known good behavior; and

,

performing an enforcement operation when additional interactions identified as between the user and the information handling system do not correspond to the known good behavior.

18. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for:

storing the unique cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of unique cyber behavior profiles, each the plurality of unique cyber behavior profiles corresponding to a respective user.

19. The non-transitory, computer-readable storage medium of claim 18, wherein the computer executable instructions are further configured for:

securing each of the plurality of unique cyber behavior profiles prior to storing within the cyber behavior repository.

20. The non-transitory, computer-readable storage medium of claim 18, wherein the computer executable instructions are further configured for:

monitoring an information technology environment using the plurality of unique behavioral identifiers;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of unique cyber behavior profiles.