User behavior profile including temporal detail corresponding to user interaction

• US 10,326,776 B2
• Filed: 05/14/2018
• Issued: 06/18/2019
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Inventors: Ford, Richard Anthony, Swafford, Brandon L.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/978,905
• Publication Number:
  US 20180332072A1
• Time in Patent Office: 400 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system, method, and computer-usable medium are disclosed for generating a cyber behavior profile comprising monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions, the electronic information representing the user interactions comprising temporal detail corresponding to the user interaction; and generating a user behavior profile based upon the electronic information representing the user interactions, the generating the user profile including a layer of detail corresponding to the temporal detail corresponding to the user interaction.

Claims

1. A computer-implementable method for generating a cyber behavior profile, comprising:

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the user interactions comprising temporal detail corresponding to the user interaction, the temporal detail corresponding to a plurality of temporal user behavior factors associated with the user interaction, at least one temporal user behavior factor being implemented as an ontological time user behavior factor, the ontological time user behavior factor referring to how one instant in time relates to another instant in time in a chronological sense, at least one temporal user behavior factor is implemented as a societal time user behavior factor, the societal time user behavior factor referring to how a user interaction at a particular instant in time correlates to another user interaction at another particular instant in time;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the generating the user profile including information relating to the temporal detail corresponding to the user interaction, the user behavior profile comprising at least one of the ontological time user behavior factor and the societal time user behavior factor; and

, using the user behavior profile with at least one of the ontological time user behavior factor and the societal time user behavior factor to determine whether a particular user behavior is one of acceptable, anomalous and malicious.

2. The method of claim 1, wherein:

the plurality of temporal user behavior factors comprise a date/time/frequency user behavior factor.

3. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the user interactions comprising temporal detail corresponding to the user interaction, the temporal detail corresponding to a plurality of temporal user behavior factors associated with the user interaction, at least one temporal user behavior factor being implemented as an ontological time user behavior factor, the ontological time user behavior factor referring to how one instant in time relates to another instant in time in a chronological sense, at least one temporal user behavior factor is implemented as a societal time user behavior factor, the societal time user behavior factor referring to how a user interaction at a particular instant in time correlates to another user interaction at another particular instant in time;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the generating the user profile including information relating to the temporal detail corresponding to the user interaction, the user behavior profile comprising at least one of the ontological time user behavior factor and the societal time user behavior factor; and

, using the user behavior profile with at least one of the ontological time user behavior factor and the societal time user behavior factor to determine whether a particular user behavior is one of acceptable, anomalous and malicious.

4. The system of claim 3, wherein:

the plurality of temporal user behavior factors comprise a date/time/frequency user behavior factor.

5. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the user interactions comprising temporal detail corresponding to the user interaction, the temporal detail corresponding to a plurality of temporal user behavior factors associated with the user interaction, at least one temporal user behavior factor being implemented as an ontological time user behavior factor, the ontological time user behavior factor referring to how one instant in time relates to another instant in time in a chronological sense, at least one temporal user behavior factor is implemented as a societal time user behavior factor, the societal time user behavior factor referring to how a user interaction at a particular instant in time correlates to another user interaction at another particular instant in time;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the generating the user profile including information relating to the temporal detail corresponding to the user interaction, the user behavior profile comprising at least one of the ontological time user behavior factor and the societal time user behavior factor; and

, using the user behavior profile with at least one of the ontological time user behavior factor and the societal time user behavior factor to determine whether a particular user behavior is one of acceptable, anomalous and malicious.

6. The non-transitory, computer-readable storage medium of claim 5, wherein:

the plurality of temporal user behavior factors comprise a date/time/frequency user behavior factor.

7. The non-transitory, computer-readable storage medium of claim 5, wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

8. The non-transitory, computer-readable storage medium of claim 5, wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.