BEHAVIORAL ENGINE FOR IDENTIFYING PATTERNS OF CONFIDENTIAL DATA USE

• US 20100306850A1
• Filed: 05/26/2009
• Published: 12/02/2010
• Est. Priority Date: 05/26/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Espinoza, Mario, Barile, Ian
• Granted Patent: US 8,752,180 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A client device hosts a behavioral engine. Using the behavioral engine, the client device analyzes behavior of a client application with respect to confidential information. The client device assigns a rating indicative of risk to the client application based on the behavior of the client application. The client device performs an action to mitigate risk of data loss if the rating exceeds a threshold.

Claims

1. A computer-implemented method comprising:

analyzing, by a client device, behavior of a client application with respect to confidential information;

assigning a rating indicative of risk to the client application based on the behavior of the client application; and

performing an action to mitigate risk of data loss if the rating exceeds a threshold.

2. The computer-implemented method of claim 1, further comprising:

detecting, by the client device, an operation of the client application on data that includes the confidential information; and

assigning the risk rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes confidential information.

3. The computer-implemented method of claim 2, wherein a rating that exceeds the threshold is assigned to the client application upon detecting an operation on data that includes the confidential information, the method further comprising:

modifying the risk rating assigned to the client application if no additional operations of the client application on data that includes confidential information are detected within a specified time frame.

4. The method of claim 2, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the client computing device operates.

5. The computer-implemented method of claim 1, further comprising:

identifying a pattern of how the client application uses confidential information, wherein the rating is assigned based on the identified pattern.

6. The computer-implemented method of claim 1, further comprising:

assigning the rating only if the client application is not a trusted client application.

7. The computer-implemented method of claim 1, wherein performing the action comprises:

at least one of quarantining the client application, blocking access to the client application or terminating the client application if a first rating is assigned to the client application; and

at least one of notifying a system administrator of the client application or requesting a detailed scan of the client application if a second rating is assigned to the client application.

8. A computer-readable storage medium including instructions that, when executed by a processing system, cause the processing system to perform a method comprising:

analyzing, by a client device, behavior of a client application with respect to confidential information;

assigning a rating indicative of risk to the client application based on the behavior of the client application; and

performing an action to mitigate risk of data loss if the rating exceeds a threshold.

9. The computer-readable storage medium of claim 8, the method further comprising:

detecting, by the client device, an operation of the client application on data that includes the confidential information; and

assigning the rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes confidential information.

10. The computer-readable storage medium of claim 9, wherein a rating that exceeds the threshold is assigned to the client application upon detecting an operation on data that includes the confidential information, the method further comprising:

reducing the rating assigned to the client application if no additional operations of the client application on data that includes confidential information are detected within a specified time frame.

11. The computer-readable storage medium of claim 9, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the client computing device operates.

12. The computer-readable storage medium of claim 8, the method further comprising:

identifying a pattern of how the client application uses confidential information, wherein the rating is assigned based on the identified pattern.

13. The computer-readable storage medium of claim 8, the method further comprising:

assigning the rating only if the client application is not a trusted client application.

14. The computer-readable storage medium of claim 8, wherein performing the action comprises:

at least one of quarantining the client application, blocking access to the client application or terminating the client application if a first rating is assigned to the client application; and

at least one of notifying a system administrator of the client application or requesting a detailed scan of the client application if a second rating is assigned to the client application.

15. A computing apparatus comprising:

a memory to store instructions for a behavioral engine; and

a processor, connected with the memory, to execute the instructions, wherein the instructions cause the processor to;

analyze behavior of a client application with respect to confidential information;

assign a rating indicative of risk to the client application based on the behavior of the client application; and

perform an action to mitigate risk of data loss if the rating exceeds a threshold.

16. The computing apparatus of claim 15, wherein the instructions further cause the processor to:

detect an operation of the client application on data that includes the confidential information; and

assign the rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes confidential information.

17. The computing apparatus of claim 16, wherein a rating that exceeds the threshold is assigned to the client application upon detecting an operation on data that includes confidential information, the instructions further to cause the processor to:

reduce the rating assigned to the client application if no additional operations of the client application on data that includes confidential information are detected within a specified time frame.

18. The computing apparatus of claim 16, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the client computing device operates.

19. The computing apparatus of claim 15, wherein the instructions further cause the processor to:

identify a pattern of how the client application uses confidential information, wherein the rating is assigned based on the identified pattern.

20. The computing apparatus of claim 15, wherein the instructions further cause the processor to:

assign the rating only if the client application is not a trusted client application.