Methods and systems for enforcing network and computer use policy

• US 20060037076A1
• Filed: 06/28/2005
• Published: 02/16/2006
• Est. Priority Date: 05/04/2004
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Next IT Corporation (Verint Systems Incorporated)
• Inventors: Roy, Shantu
• Granted Patent: US 7,603,705 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 16/3329 Natural language query formulation or dialogue systems
• CPC Class Codes: G06F 16/3344 using natural language analysis
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 40/284 Lexical analysis, e.g. tokenisation or collocates
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Network and computer use policy is enforced by employing client-side systems that analyze data usage at the client in terms of what the data is, who is using the data, and the context of the data, and then make an intelligent decision on what action(s) to take responsive to the analysis that is performed. Such systems and related methods can protect organizational resources from inappropriate activities that originate from within the organization.

Claims

1. A computer-implemented method comprising:

receiving data associated with a user'"'"'s interaction with a client computing device;

probabilistically analyzing said data to ascertain whether the data likely constitutes data of interest; and

in an event the data likely constitutes data of interest, applying one or more rules to ascertain whether any actions should be taken responsive to the user'"'"'s interaction.

2. The method of claim 1, wherein the data is associated with a user'"'"'s keyboard interaction.

3. The method of claim 1, wherein the data is associated with a user'"'"'s clipboard interaction.

4. The method of claim 1, wherein the data is associated with a user'"'"'s file system interaction.

5. The method of claim 1, wherein the data is associated with a user'"'"'s network interaction.

6. The method of claim 1, wherein the data is associated with a user'"'"'s interaction with one or more peripheral devices.

7. The method of claim 1, wherein an action can comprise making an entry in a log.

8. The method of claim 1, wherein an action is can comprise capturing a screen associated with the user'"'"'s interaction.

9. The method of claim 1, wherein an action can comprise generating a notification.

10. The method of claim 1, wherein an action can comprise shutting down an application.

11. The method of claim 1, wherein an action can comprise shutting down the client computing device.

12. The method of claim 1, wherein the act of probabilistically analyzing comprises performing lexical analysis on the data.

13. The method of claim 1, wherein the act of probabilistically analyzing comprises using:

one or more runtime objects that are configured to receive and process data, and

one or more knowledge base objects, individual knowledge base objects being associated with one or more runtime objects;

wherein individual knowledge base objects are associated with a hierarchical, tag-based file that defines;

cases of data that can be matched to data received by associated runtime objects; and

responses that are triggered in an event of a match.

14. The method of claim 13, wherein knowledge base objects are configured to process data received from runtime objects and return a score and an indication of an associated node that generated the score to runtime objects from which the data was received.

15. A system comprising:

one or more computer-readable media;

computer-readable instructions on the computer-readable media which, when executed, implement a system comprising;

an engine component configured to receive data associated with a user'"'"'s interaction with a client computing device and probabilistically analyze said data to ascertain whether the data likely constitutes data of interest; and

a decision framework component communicatively coupled with the engine component and configured to, in an event the data likely constitutes data of interest, apply one or more rules to ascertain whether any actions should be taken responsive to the user'"'"'s interaction.

16. The system of claim 15, wherein the data is associated with one or more of a user'"'"'s keyboard interaction, a user'"'"'s clipboard interaction, a user'"'"'s file system interaction, a user'"'"'s network interaction, or a user'"'"'s interaction with one or more peripheral devices.

17. The system of claim 15, wherein an action can comprise one or more of making an entry in a log, capturing a screen associated with the user'"'"'s interaction, generating a notification, shutting down an application, or shutting down the client computing device.

18. The system of claim 15, wherein the engine component is configured to probabilistically analyze the data by performing lexical analysis on the data.

19. The system of claim 15, wherein the engine component comprises:

one or more runtime objects that are configured to receive and process data, and

one or more knowledge base objects, individual knowledge base objects being associated with one or more runtime objects;

wherein individual knowledge base objects are associated with a hierarchical, tag-based file that defines;

cases of data that can be matched to data received by associated runtime objects; and

responses that are triggered in an event of a match.

20. The system of claim 19, wherein knowledge base objects are configured to process data received from runtime objects and return a score and an indication of an associated node that generated the score.

21. A computer-implemented method comprising:

receiving configuration information that describes one or more heuristics that are to be applied to data associated with a user'"'"'s interactions on a client computing device, said configuration information being structured in a hierarchical, tag-based language;

using the configuration information to configure a decision framework component;

receiving, with an engine component, data associated with a user'"'"'s interaction with a client computing device;

probabilistically analyzing, with the engine component, said data to ascertain whether the data likely constitutes data of interest; and

in an event the data likely constitutes data of interest, applying, with the configured decision framework component, one or more rules to ascertain whether any actions should be taken responsive to the user'"'"'s interaction.

22. The method of claim 21, wherein the data is associated with one or more of a user'"'"'s keyboard interaction, a user'"'"'s clipboard interaction, a user'"'"'s file system interaction, a user'"'"'s network interaction, or a user'"'"'s interaction with one or more peripheral devices.

23. The method of claim 21, wherein an action can comprise one or more of making an entry in a log, capturing a screen associated with the user'"'"'s interaction, generating a notification, shutting down an application, or shutting down the client computing device.

24. The method of claim 21, wherein the hierarchical tag-based language comprises a top level tag that can contain a profile tag associated with a set of rules for deciding when certain actions should be taken, and a filter tag associated with a single rule, keyword or lexical program.

25. The method of claim 24, wherein the profile tag can contain an expression tag associated with an expression that is to be used to evaluate data, a filter reference tag associated with a filter that can be applied to the data, and/or an action tag associated with a type of action that can be performed.

26. The method of claim 25, wherein the filter reference tag can contain a context item tag which is associated with specific data that are applied to a filter associated with the filter reference tag.