USER BEHAVIORAL RISK ASSESSMENT

• US 20150334129A1
• Filed: 05/27/2015
• Published: 11/19/2015
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Moyle, Michael Mason, Basavapatna, Prasanna Ganapathi, Schrecker, Sven
• Granted Patent: US 9,635,047 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A particular activity performed by a particular user of a computing device is identified, for instance, by an agent installed on the computing device. It is determined that the particular activity qualifies as a particular use violation in a plurality of pre-defined use violations. A behavioral risk score for the particular score for the user is determined based at least in part on the determination that the particular activity of the particular user qualifies as a particular use violation. Determining that the particular activity qualifies as a particular use violation can include determining that the particular activity violates a particular rule or event trigger corresponding to a particular pre-defined use violation.

Claims

1. A method comprising:

identifying detection, at a computing device, of a particular activity performed by a particular user using the computing device;

determining that the particular activity qualifies as a particular use violation in a plurality of pre-defined use violations; and

determining a behavioral risk score for the particular user based at least in part on the determination that the particular activity of the particular user qualifies as a particular use violation.

2. The method of claim 1, wherein determining that the particular activity qualifies as a particular use violation includes determining that the particular activity violates a particular rule corresponding to the particular use violation, wherein the particular rule is included in a plurality of rules corresponding to the plurality of pre-defined use violations.

3. The method of claim 2, wherein the plurality of rules is an extensible set of rules adapted to be supplemented and modified by user inputs and at least one rule in the plurality of rules is a user-defined rule.

4. The method of claim 1, wherein the plurality of pre-defined use violations includes less than all of a set of available pre-defined use violations and the plurality of pre-defined use violations is a first set of pre-defined use violations identified as corresponding to the particular user.

5. The method of claim 4, wherein the particular user is one of a plurality of users including a second user, wherein a second set of pre-defined use violations correspond to the second user and the second set of pre-defined use violations does not include the particular use violations, wherein performance of the particular activity by the second user does not qualify as a use violation.

6. The method of claim 4, wherein the first set of pre-defined use violations is identified as corresponding to the particular user based at least in part on at least one of a tenure of the particular user in an organization, a role of the particular user in an organization, a title of the particular user in an organization, a geographical location of the particular user, and a risk profile of the particular user.

7. The method of claim 4, wherein the first set of pre-defined violations are identified as also corresponding to the computing device, the computing device included in a plurality of computing devices in a computing system.

8. The method of claim 1, wherein the behavioral score includes sub-scores representing reputation of the particular user in each of a plurality of use categories.

9. The method of claim 8, wherein the plurality of use categories includes at least one of user email use reputation, user Internet use reputation, user authentication risk reputation, user external memory device use reputation, and user shared system resource use reputation.

10. The method of claim 1, further comprising triggering at least one countermeasure to counter risk associated with the particular use violation, the countermeasure triggered in response to determining that the particular activity qualifies as the particular use violation.

11. The method of claim 10, wherein triggering the countermeasure includes identifying that the particular use violation exceeds a particular threshold.

12. The method of claim 11, wherein the particular threshold is at least one of a time-based threshold identifying a length of time of the particular use violation, a repetition-based threshold identifying a number of repeated instances of the particular use violation by the particular user, a time-of-day threshold, and a severity-based threshold identifying a determined severity of the particular use violation.

13. The method of claim 1, wherein a software-implemented agent installed on the computing device detects the particular activity and sends information to a remote user behavioral risk analysis engine describing the detected particular activity.

14. The method of claim 13, wherein the agent determines that the particular activity qualifies as the particular use violation and the information sent to the remote user behavioral risk analysis engine identifies the determination of the particular use violation.

15. The method of claim 13, wherein the user behavioral risk analysis engine uses the sent information to determine that the particular activity qualifies as the particular use violation.

16. The method of claim 15, wherein the user behavioral risk analysis engine further uses corroborating data received from a security tool monitoring activities of the computing device remote from the computing device to determine that the particular activity qualifies as the particular use violation.

20. The method of claim 1, wherein a behavioral profile is associated with the particular user describing expected tendencies of the particular user during use of a computing system including the computing device, and determination that the particular activity qualifies as a particular use violation in a plurality of pre-defined use violations corroborates a determination that other activity on the computing system associated with the particular user deviates from the behavioral profile.

21. The method of claim 20, wherein the determination that other activity on the computing system associated with the particular user deviates from the behavioral profile is determined from feedback data received from at least one security tool monitoring components of the computing system remote from the computing device.

17. (canceled)

18. (canceled)

19. (canceled)

22. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying that a particular activity performed by a particular user using a computing device was detected at the computing device;

determining that the particular activity qualifies as a particular use violation in a plurality of pre-defined use violations;

determining a behavioral risk score for the particular user based at least in part on the determination that the particular activity of the particular user qualifies as a particular use violation.

23. A system comprising:

at least one processor device;

at least one memory element; and

a user behavioral risk analysis tool, adapted when executed by the at least one processor device to;

identify detection, at a particular computing device, of a particular activity performed by a particular user using the particular computing device;

determining that the particular activity qualifies as a particular use violation in a plurality of pre-defined use violations;

determining a behavioral risk score for the particular user based at least in part on the determination that the particular activity of the particular user qualifies as a particular use violation.

24. (canceled)

25. (canceled)