MODEL-BASED SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR DETECTING AT LEAST POTENTIALLY UNWANTED ACTIVITY ASSOCIATED WITH CONFIDENTIAL DATA

• US 20130276127A1
• Filed: 07/23/2008
• Published: 10/17/2013
• Est. Priority Date: 07/23/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Kolingivadi, Deepakeswaran, Seshappa, Balachander
• Granted Patent: US 11,245,708 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A model-based system, method, and computer program product are provided for detecting at least potentially unwanted activity associated with confidential data. In use, behavior information associated with use of confidential data is identified, based on predetermined parameters. Additionally, a model is created utilizing the behavioral information. Furthermore, at least potentially unwanted activity associated with the confidential data is detected utilizing the model.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, comprising instructions stored thereon to cause a processor to:

detect an attempt by a user to access confidential data stored on an electronic device;

identify behavioral information associated with the user'"'"'s interaction with the confidential data according to one or more predetermined parameters, each of the predetermined parameters representing a type of interaction with the confidential data;

create a model utilizing the behavioral information;

compare the model with one or more predefined models representative of known unwanted activity; and

detect at least potentially unwanted activity associated with the confidential data based on the comparison.

3. The computer program product of claim 1, wherein the one or more predetermined parameters include at least one of a scroll of the confidential data, a revisit of the confidential data, and a generation of indicia associated with the confidential data.

4. The computer program product of claim 1, wherein the instructions to cause the processor to identify behavioral information associated with the user'"'"'s interaction with the confidential data comprise instructions to cause the processor to record values reflecting the user'"'"'s interaction with the confidential data according to the one or more predetermined parameters.

5. The computer program product of claim 4, wherein the instructions to cause the processor to create the model comprise instructions to cause the processor to aggregate the parameters and the values.

7. The computer program product of claim 1, wherein the instructions to cause the processor to create the model include instructions to cause the processor to allow the model to be created manually.

8. The computer program product of claim 1, wherein the instructions to cause the processor to create the model include instructions to cause the processor to create the model automatically.

9. The computer program product of claim 1, wherein the instructions to cause the processor to identify behavioral information include instructions to cause the processor to collect behavioral information utilizing an agent.

10. The computer program product of claim 1, wherein the instructions to cause the processor to identify behavioral information comprise instructions to cause the processor to receive the behavioral information over a network.

12. The computer program product of claim 1, further comprising instructions to cause the processor to generate metadata associated with the model.

13. The computer program product of claim 12, wherein the instructions to cause the processor to generate metadata include instructions to cause the processor to generate at least one of an identifier of the user, an identifier of at least one data source associated with the confidential data, and a score.

14. The computer program product of claim 12, wherein the instructions to cause the processor to generate metadata include instructions to cause the processor to calculate a score based on the identified behavioral information.

15. The computer program product of claim 14, wherein the instructions to cause the processor to detect potentially unwanted activity associated with the confidential data include instructions to cause the processor to compare the score and a threshold.

16. The computer program product of claim 1, further comprising instructions to cause the processor to react in response to the detection of the at least potentially unwanted activity associated with the confidential data.

17. The computer program product of claim 16, wherein the instructions to cause the processor to react in response to the detection of the at least potentially unwanted activity associated with the confidential data include instructions to cause the processor to prevent user actions conducted in association with the confidential data.

2. (canceled)

6. (canceled)

11. (canceled)

18. A method, comprising:

detecting, utilizing one or more processors, an attempt by a user to access confidential data stored on an electronic device;

identifying, utilizing the one or more processors, behavioral information associated with the user'"'"'s interaction with the confidential data according to one or more predetermined parameters, each of the one or more predetermined parameters representing a type of interaction with the confidential data;

creating, utilizing the one or more processors, a model utilizing the behavioral information;

comparing, utilizing the one or more processors, the model with one or more predefined models representative of known unwanted activity; and

detecting, utilizing the one or more processors, at least potentially unwanted activity associated with the confidential data based on the comparison.

19. A system, comprising:

a memory; and

a processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory to;

detect an attempt by a user to access confidential data stored on an electronic device;

identify behavioral information associated with the user'"'"'s interaction with the confidential data according to one or more predetermined parameters, each of the one or more predetermined parameters representing a type of interaction with the confidential data;

create a model utilizing the behavioral information;

compare the model with one or more predefined models representative of known unwanted activity; and

detect at least potentially unwanted activity associated with the confidential data based on the comparison.

20. (canceled)