Discerning psychological state from correlated user behavior and contextual information

• US 10,623,431 B2
• Filed: 05/09/2018
• Issued: 04/14/2020
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Inventors: Ford, Richard A.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/975,289
• Publication Number:
  US 20180332062A1
• Time in Patent Office: 706 Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A method, system and computer-usable medium for performing a psychological profile operation. The psychological profile operation includes: monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions; determining when the user interactions are associated with generation of an electronic communication; associating the user interactions with the electronic communication; and, generating a psychological profile of the user based upon the user interactions and the electronic communication, the psychological profile comprising information regarding a psychological state of the user.

Claims

1. A computer-implementable method for performing a psychological profile operation, comprising:

monitoring user interactions between a user and an information handling system;

converting the user interactions into electronic information representing the user interactions, at least some of the user interactions being associated with corresponding user behaviors, at least some of the user interactions comprising a cyberprofile element;

identifying contextual information related to a particular user behavior, the particular user behavior comprising a focus of the user, the focus of the user providing contextual information for the particular user behavior, the contextual information including information related to content occurring at a particular point of focus, the point of focus providing a correlation between a particular instance of focus and an associated cyberprofile element, the particular instance of focus being associated with a time interval, each of a plurality of points of focus corresponding to respective cyberprofile elements, each of the plurality of points of focus being associated with respective time intervals;

determining when the user interactions are associated with generation of an electronic communication;

associating the user interactions with the electronic communication;

generating a psychological profile of the user based upon the user interactions, the contextual information, the plurality of points of focus, the correlation between the particular instances of focus and the associated cyber profile elements and the electronic communication, the psychological profile comprising information regarding a psychological state of the user;

performing an analysis of the psychological profile of the user to determine whether the user presents a security threat due to the psychological state of the user, the analysis being performed via a security analytics system executing on a hardware processor; and

,

performing a threat remediation operation when the analysis of the psychological profile of the user indicates the user presents the security threat, the thread remediation operation being performed via the security analytics system.

2. The method of claim 1, wherein:

the user interactions comprise keystrokes; and

,

the converting the user interactions converts the keystrokes into keystroke data representing each entered keystroke.

3. The method of claim 1, wherein:

the user interactions comprise user gestures;

the converting user interactions coverts the user gestures into user gesture data; and

,

the generating the psychological profile takes into account the user gesture data.

4. The method of claim 1, wherein:

the monitoring comprises monitoring audio information associated with the user; and

further comprising

associating the audio information with the user interactions.

5. The method of claim 4, wherein:

the generating the psychological profile takes into account the audio information associated with the user interactions.

6. The method of claim 1, further comprising:

determining the focus of the user;

associating the focus of the user with a subset of user interactions; and

determining when the subset of user interactions are associated with the electronic communication.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code for performing a psychological profile operation, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring user interactions between a user and an information handling system;

converting the user interactions into electronic information representing the user interactions, at least some of the user interactions being associated with corresponding user behaviors, at least some of the user interactions comprising a cyberprofile element;

identifying contextual information related to a particular user behavior, the particular user behavior comprising a focus of the user, the focus of the user providing contextual information for the particular user behavior, the contextual information including information related to content occurring at a particular point of focus, the point of focus providing a correlation between a particular instance of focus and an associated cyberprofile element, the particular instance of focus being associated with a time interval, each of a plurality of points of focus corresponding to respective cyberprofile elements, each of the plurality of points of focus being associated with respective time intervals;

determining when the user interactions are associated with generation of an electronic communication;

associating the user interactions with the electronic communication;

generating a psychological profile of the user based upon the user interactions, the contextual information, the plurality of points of focus, the correlation between the particular instances of focus and the associated cyber profile elements and the electronic communication, the psychological profile comprising information regarding a psychological state of the user

performing an analysis of the psychological profile of the user to determine whether the user presents a security threat due to the psychological state of the user, the analysis being performed via a security analytics system executing on a hardware processor; and

,

performing a threat remediation operation when the analysis of the psychological profile of the user indicates the user presents the security threat, the thread remediation operation being performed via the security analytics system.

8. The system of claim 7, wherein:

the user interactions comprise keystrokes; and

,

the converting the user interactions converts the keystrokes into keystroke data representing each entered keystroke.

9. The system of claim 7, wherein:

the user interactions comprise user gestures;

the converting user interactions coverts the user gestures into user gesture data; and

,

the generating the psychological profile takes into account the user gesture data.

10. The system of claim 7, wherein:

the monitoring comprises monitoring audio information associated with the user; and

the instructions executable by the processor are further configured for;

associating the audio information with the user interactions.

11. The system of claim 10, wherein:

the generating the psychological profile takes into account the audio information associated with the user interactions.

12. The system of claim 7, wherein the instructions executable by the processor are further configured for:

determining the focus of the user;

associating the focus of the user with a subset of user interactions; and

determining when the subset of user interactions are associated with the electronic communication.

13. A non-transitory, computer-readable storage medium embodying computer program code for performing a psychological profile operation, the computer program code comprising computer executable instructions configured for:

monitoring user interactions between a user and an information handling system;

converting the user interactions into electronic information representing the user interactions, at least some of the user interactions being associated with corresponding user behaviors, at least some of the user interactions comprising a cyberprofile element;

identifying contextual information related to a particular user behavior, the particular user behavior comprising a focus of the user, the focus of the user providing contextual information for the particular user behavior, the contextual information including information related to content occurring at a particular point of focus, the point of focus providing a correlation between a particular instance of focus and an associated cyberprofile element, the particular instance of focus being associated with a time interval, each of a plurality of points of focus corresponding to respective cyberprofile elements, each of the plurality of points of focus being associated with respective time intervals;

determining when the user interactions are associated with generation of an electronic communication;

associating the user interactions with the electronic communication;

generating a psychological profile of the user based upon the user interactions, the contextual information, the plurality of points of focus, the correlation between the particular instances of focus and the associated cyber profile elements and the electronic communication, the psychological profile comprising information regarding a psychological state of the user;

performing an analysis of the psychological profile of the user to determine whether the user presents a security threat due to the psychological state of the user, the analysis being performed via a security analytics system executing on a hardware processor; and

,

performing a threat remediation operation when the analysis of the psychological profile of the user indicates the user presents the security threat, the thread remediation operation being performed via the security analytics system.

14. The non-transitory, computer-readable storage medium of claim 13, wherein:

the user interactions comprise keystrokes; and

,

the converting the user interactions converts the keystrokes into keystroke data representing each entered keystroke.

15. The non-transitory, computer-readable storage medium of claim 13, wherein:

the user interactions comprise user gestures;

the converting user interactions coverts the user gestures into user gesture data; and

,

the generating the psychological profile takes into account the user gesture data.

16. The non-transitory, computer-readable storage medium of claim 15, wherein:

the monitoring comprises monitoring audio information associated with the user; and

the computer executable instructions are further configured for;

associating the audio information with the user interactions.

17. The non-transitory, computer-readable storage medium of claim 13, wherein:

the generating the psychological profile takes into account the audio information associated with the user interactions.

18. The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for:

determining the focus of the user;

associating the focus of the user with a subset of user interactions; and

determining when the subset of user interactions are associated with the electronic communication.

19. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.