Detecting Behavioral Patterns and Anomalies Using Activity Profiles

• US 20080059474A1
• Filed: 10/30/2007
• Published: 03/06/2008
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 8,321,437 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: Y10S 707/922 : Communications

Abstract

Activity data is analyzed or evaluated to detect behavioral patterns and anomalies. When a particular pattern or anomaly is detected, a system may send a notification or perform a particular task. This activity data may be collected in an information management system, which may be policy based. Notification may be by way e-mail, report, pop-up message, or system message. Some tasks to perform upon detection may include implementing a policy in the information management system, disallowing a user from connecting to the system, and restricting a user from being allowed to perform certain actions. To detect a pattern, activity data may be compared to a previously defined or generated activity profile.

Claims

1. A method of an information management system comprising:

providing a plurality of devices;

providing an activity database;

providing a first activity profile;

collecting information usage data from the plurality of devices and storing in the activity database;

analyzing the information usage data in the activity database to generate a second activity profile;

comparing the second activity profile with first activity profile to determine a set of differences;

using the set of differences, detecting whether a condition has occurred; and

when the condition has occurred, generating a notification of the condition.

2. The method in claim 1 wherein the information usage data includes data collected during evaluation of a rule at a device.

3. The method in claim 2 wherein the data collected during the rule evaluation comprises at least one of the time at which rule evaluation occurs, the outcome of evaluating at least one rule, the event that triggers a rule evaluation operation, a rule identifier indicating a particular rule being evaluated, information about a resource associated with an evaluated rule, information about a user related to a rule evaluation operation, information about an application program associated with a rule evaluation operation, or information about a device associated with a rule evaluation operation.

4. The method of claim 1 wherein the information usage data comprises at least one of time, duration, a resource identifier, type of resource, resource attributes, file name, file path, file attribute, e-mail sender, e-mail recipient, e-mail attachment, user, user attribute, name of application program, application program version information, type of application program host name, IP address, type of computer, computer configuration, application program command, application program function, application program event, file operation, database operation, any other application program or operating system event, or type of connectivity a user used to connect to a device.

5. The method of claim 1 wherein the information usage data comprises data associated with at least one of application program operation or document access.

6. The method of claim 5 wherein the application program operation includes sending an e-mail message, forwarding an e-mail message, attaching a file to an e-mail message, opening a file, saving a file, deleting a file, moving a file, changing file attributes, cutting application data to a clipboard, pasting application data from a clipboard, editing a cell in a spreadsheet, changing a formula associated with a cell in a spreadsheet, creating a macro, or editing a script.

7. The method of claim 1 wherein when the set of difference is zero, the condition will not have occurred.

8. The method of claim 1 wherein the condition occurs when (X-Y) is greater than a threshold value Z, where X is a value in the first activity profile and Y is a value in the second activity profile.

9. The method of claim 1 wherein the condition occurs when (X-Y) is greater than a threshold value Z, where X is a value derived from the first activity profile and Y is a value derived from the second activity profile.

10. The method of claim 1 wherein the first activity profile comprises a threshold value X and the condition occurs when a value Y derived from the second activity profile is greater than X.

11. The method of claim 9 wherein the X and Y times represent times spent in an application program.

12. The method of claim 1 wherein the condition which is satisfied when the second activity profile indicates a user using instant messenger more than an amount of time specified in the first activity profile.

13. The method of claim 1 wherein the first activity profile is generated from information usage data in the activity database.

14. The method of claim 13 wherein first activity profile comprises data collected based on two or more users and the second activity profile comprises data collected based on one user.

15. The method of claim 13 wherein first activity profile comprises information derived from data collected based on two or more users and the second activity profile comprises information derived from data collected based on one user.

16. The method of claim 15 where the first activity profile includes an average productivity index of a group of users and the second activity profile includes a productivity index of a user in the group of users.

17. The method of claim 15 where the first activity profile includes an average productivity index of a group of users and the second activity profile includes a productivity of a user not in the group of users.

18. The method of claim 1 wherein the generating a notification of the condition includes sending an e-mail, sending a SNMP message, adding an entry to a log, or popping up a message on a computer screen.

19. The method of claim 1 further comprising:

when the condition is detected, sending the notification to an application program.

20. The method of claim 1 further comprising:

when the condition is detected, sending the notification to another device.

21. The method of claim 1 wherein the analyzing the information usage data in the activity database to detect a condition is replaced by

gathering external event data collected outside the system;

and

analyzing the information usage data and the external event data to detect a condition.

22. The method of claim 1 wherein the devices comprise at least one of a file server, network attached storage (NAS) device, virtual file server, file gateway, e-mail server, messaging server, collaboration server, document management system (DMS), content management system, digital rights management server, Web server, portal server, application server, database server, integration server, customer relation management (CRM) system, enterprise resource (ERP) planning system, supply chain management system, any file-based or nonfile document repositories, desktop computer, laptop computer, personal digital assistant (PDA), smart phone, thin clients, an instance of client operating environment running on a terminal server, a guest operating system running on a virtual machine, a server making information resource operation request (acting as a client in the context of the request), information kiosk, or any computing device and computing environment from which an information resource operation request originates.

23. The method of claim 1 wherein the collecting information usage data comprises:

associating an interceptor program with an application program; and

using the interceptor program, while the application program is executing, gathering information about operations of the application program.

24. The method of claim 1 wherein the analyzing the information usage data in the activity database further comprises generating a report.

25. The method of claim 1 wherein the condition includes at least one of information fraud, information misuse, operational inefficiency, potential improvement in workforce productivity, potential improvement in resource utilization, a change in user behavior, a change in group behavior, a change in application program behavior, change in resource utilization, or abnormal or suspicious activity pattern.