System, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on the classifications

• US 10,496,815 B1
• Filed: 12/18/2015
• Issued: 12/03/2019
• Est. Priority Date: 12/18/2015
• Status: Active Grant

• Current Assignee: Exabeam, Inc.
• Original Assignee: Exabeam, Inc.
• Inventors: Steiman, Barry, Lin, Derek, Gil, Sylvain, Mihovilovic, Domingo
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Hoover, Brent Johnston
• Application Number:
  US14/974,766
• Time in Patent Office: 1,446 Days
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/105 Human resources

Abstract

The present disclosure describes a system, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on said classifications. Machine-learning-based modeling is used to classify one or more types of monitored assets with a select user label. A data model is created that reflects monitored assets used by users associated with the select user label. Each a time a user with the select user label accesses an applicable type of monitored asset, the data model is updated to reflect the event. The data model is used to classify one or more monitored assets with the select user label. If a user without the select user label uses a monitored asset classified with the select user label, a potential misuse of the monitored asset is detected.

Claims

1. A method, performed by a computer system, for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on said classifications, the method comprising:

accessing a mapping of users to user labels;

using machine-learning-based modeling to classify one or more types of monitored assets with a select user label by performing the following;

creating a data model that reflects monitored assets used by users associated with the select user label, wherein each time a user with the select user label accesses an applicable type of monitored asset, the data model is updated,

creating a counter data model that reflects monitored assets used by users without the select user label,

automatically determining whether an asset is a personal asset or a shared asset using the data model and counter data model, wherein a personal asset is a monitored asset used by users with the select user label and a shared asset is a monitored asset used by both users with and without the select user label, and

using the data model to classify one or more monitored assets that are determined to be personal assets with the select user label; and

detecting a potential misuse of a personal monitored asset classified with the select user label in response to a user without the select user label using the personal monitored asset, wherein detecting a potential misuse of a personal monitored asset results in increasing a risk assessment associated with the user'"'"'s activities and wherein in response to the risk assessment meeting certain criteria, an alert is displayed in an administrative interface.

2. The method of claim 1, wherein using the data model to classify one or more monitored assets with the select user label comprises:

identifying personal, monitored assets above a threshold frequency-of-use value in the data model; and

classifying the identified monitored assets with the select user label.

3. The method of claim 1, wherein the select user label indicates that the user is an executive or high-privileged user in an enterprise.

4. The method of claim 1, wherein the data model is a histogram with the monitored assets on one axis, and frequency-of-use values on another axis.

5. The method of claim 1, wherein personal assets include workstations, phones, tablet computing devices, and personal offices.

6. The method of claim 1, wherein the computer system calculates a risk score for each user session in the system, and the data model is updated with a qualifying access event only in response to the user'"'"'s risk score being below a risk threshold.

7. A non-transitory, computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on said classifications, the method comprising:

accessing a mapping of users to user labels;

using machine-learning-based modeling to classify one or more types of monitored assets with a select user label by performing the following;

creating a data model that reflects monitored assets used by users associated with the select user label, wherein each time a user with the select user label accesses an applicable type of monitored asset, the data model is updated,

creating a counter data model that reflects monitored assets used by users without the select user label,

automatically determining whether an asset is a personal asset or a shared asset using the data model and counter data model, wherein a personal asset is a monitored asset used by users with the select user label and a shared asset is a monitored asset used by both users with and without the select user label, and

using the data model to classify one or more monitored assets that are determined to be personal assets with the select user label; and

detecting a potential misuse of a personal monitored asset classified with the select user label in response to a user without the select user label using the personal monitored asset, wherein detecting a potential misuse of a personal monitored asset results in increasing a risk assessment associated with the user'"'"'s activities and wherein in response to the risk assessment meeting certain criteria, an alert is displayed in an administrative interface.

8. The non-transitory, computer-readable medium of claim 7, wherein using the data model to classify one or more monitored assets with the select user label comprises:

identifying personal, monitored assets above a threshold frequency-of-use value in the data model; and

classifying the identified monitored assets with the select user label.

9. The non-transitory, computer-readable medium of claim 7,

wherein the select user label indicates that the user is an executive or high-privileged user in an enterprise.

10. The non-transitory, computer-readable medium of claim 7, wherein the data model is a histogram with the monitored assets on one axis, and frequency-of-use values on another axis.

11. The non-transitory, computer-readable medium of claim 7, wherein personal assets include workstations, phones, tablet computing devices, and personal offices.

12. The non-transitory, computer-readable medium of claim 7, wherein the computer system calculates a risk score for each user session in the system, and the data model is updated with a qualifying access event only in response to the user'"'"'s risk score being below a risk threshold.

13. A computer system for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on said classifications, the system comprising:

one or more processors;

one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of;

accessing a mapping of users to user labels;

using machine-learning-based modeling to classify one or more types of monitored assets with a select user label by performing the following;

creating a data model that reflects monitored assets used by users associated with the select user label, wherein each time a user with the select user label accesses an applicable type of monitored asset, the data model is updated,

creating a counter data model that reflects monitored assets used by users without the select user label,

automatically determining whether an asset is a personal asset or a shared asset using the data model and counter data model, wherein a personal asset is a monitored asset used by users with the select user label and a shared asset is a monitored asset used by both users with and without the select user label, and

using the data model to classify one or more monitored assets that are determined to be personal assets with the select user label; and

detecting a potential misuse of a personal monitored asset classified with the select user label in response to a user without the select user label using the personal monitored asset, wherein detecting a potential misuse of a personal monitored asset results in increasing a risk assessment associated with the user'"'"'s activities and wherein in response to the risk assessment meeting certain criteria, an alert is displayed in an administrative interface.

14. The system of claim 13, wherein using the data model to classify one or more monitored assets with the select user label comprises:

identifying personal, monitored assets above a threshold frequency-of-use value in the data model; and

classifying the identified monitored assets with the select user label.

15. The system of claim 13, wherein the select user label indicates that the user is an executive or high-privileged user in an enterprise.

16. The system of claim 13, wherein the data model is a histogram with the monitored assets on one axis, and frequency-of-use values on another axis.

17. The system of claim 13, wherein personal assets include workstations, phones, tablet computing devices, and personal offices.

18. The system of claim 13, wherein the system calculates a risk score for each user session in the system, and the data model is updated with a qualifying access event only in response to the user'"'"'s risk score being below a risk threshold.