USER BEHAVIORAL RISK ASSESSMENT

• US 20130097709A1
• Filed: 12/22/2011
• Published: 04/18/2013
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Basavapatna, Prasanna Ganapathi, Moyle, Michael Mason, Schrecker, Sven
• Granted Patent: US 8,881,289 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A predetermined particular behavioral profile is identified associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system. Activities associated with use of the computing system by the particular user are identified and it is determined whether the identified activities correlate with the particular behavioral profile. Identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.

Claims

1. A method comprising:

identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;

identifying, using at least one computer processing device, activities associated with use of the computing system by the particular user; and

determining whether the identified activities correlate with the particular behavioral profile, wherein identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.

2. The method of claim 1, wherein activities that do not deviate beyond a particular threshold are considered satisfactorily consistent with the particular behavioral profile and do not trigger risk events.

3. The method of claim 2, wherein at least one particular identified activity is identified as deviating from the particular behavior risk profile but within the particular threshold, the method further comprising:

revising the particular behavioral profile based at least in part on the at least one particular identified activity.

4. The method of claim 1, wherein the particular behavioral profile is a user-based behavioral profile based on a plurality of inputs describing prior activities of the particular user in the computing system.

5. The method of claim 4, further comprising:

identifying a second user-based behavioral profile associated with a second user of the computing system;

identifying activities associated with use of the computing system by the second user; and

determining whether the identified activities of the second user correlate with the second user-based behavioral profile, wherein identifying an activity that deviates from the second behavioral profile beyond the particular threshold triggers a risk event relating to the second user.

6. The method of claim 4, wherein the first and second users are included in a plurality of users within the computing system and each user in the plurality of users has at least one corresponding user-based behavioral profile.

7. The method of claim 6, further comprising determining an aggregate risk profile for the computing system based at least in part on the user-based behavioral profile of the plurality of users.

8. The method of claim 7, wherein determining the aggregate risk profile for the computing system includes:

identifying an association between a particular computing device in the computing system and the particular user;

determining a device risk profile of the particular computing device; and

determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device.

9. The method of claim 8, wherein determining the composite risk includes identifying, from the particular behavioral profile, a behavioral tendency of the particular user that corresponds to a particular vulnerability of the particular computing device identified from the device risk profile of the particular computing device.

10. The method of claim 1, wherein the particular behavioral profile is a group-based behavioral profile based on a plurality of inputs from a plurality of users in a group of users of the computing system, the plurality of inputs describing prior activities of the group of users in the computing system.

11. The method of claim 10, wherein the group of users is at least one of a business unit, users in a particular geographic location, users with a particular employment status, users in a particular department of an organization, and a set of all identified users of the computing system.

19. The method of claim 1, wherein the particular behavioral profile includes a plurality of categorical risk profiles for the particular user, each categorical risk profile describing determined tendencies of the particular user with regard to a respective category of system use.

12. The method of 1, wherein the particular behavioral profile is based on a plurality of inputs received from a plurality of security tools providing security services within the computing system.

13. The method of claim 12, further comprising initiating deployment of a countermeasure in response to determining that a particular activity of the particular user deviates from the particular behavioral profile beyond the particular threshold, wherein the countermeasure corresponds to a particular risk event triggered by the particular activity.

14. The method of claim 13, wherein the countermeasure is deployed using at least one of the plurality of security tools.

15. The method of claim 14, wherein the plurality of security tools include at least two of a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool.

16. The method of claim 14, wherein the plurality of security tools include a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool.

17. The method of claim 12, wherein at least one of the inputs originates from a host-based security tool operating on at least one end user computing device in the computing system identified as used by the particular user, the host-based security tool adapted to monitor behavior of users of the end user computing device at the end user computing device for use in detecting violations of user behavioral rules for the computing system.

18. The method of claim 17, further comprising corroborating a determined deviation from the particular behavioral profile with a particular violation of a user behavior rule detected from monitoring of the end user computing device by the host-based security tool.

20. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;

identifying activities associated with use of the computing system by the particular user; and

determining whether the identified activities correlate with the particular behavioral profile, wherein identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.

21. A system comprising:

at least one processor device;

at least one memory element; and

a user behavioral risk analysis engine, adapted when executed by the at least one processor device to;

identify a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;

identify a particular activity associated with use of the computing system by the particular user; and

determine whether the particular identified activity deviates from the particular behavioral profile beyond a particular threshold.

22. The system of claim 21, further comprising at least two security tools from a set including a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool, wherein user activities associated with use of the computing system are identified by each of the at least two security tools.

23. The system of claim 21, wherein the user behavioral risk analysis engine is further adapted, when executed, to:

identify a detected violation of a particular system usage rule in a plurality of system usage rules by the particular user through use of a particular computing device by the particular user within the computing system, wherein the detected violation is based on monitoring of the particular computing device by a security tool installed on the particular computing device; and

corroborate the determined deviation from the particular behavioral profile with the detected violation of the particular system usage rule by the particular user.