INFORMATION TECHNOLOGY USER BEHAVIOR MONITORING RULE GENERATION

• US 20180218628A1
• Filed: 01/31/2017
• Published: 08/02/2018
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: Ent Services Development Corporation LP (DXC Technology Company)
• Original Assignee: Ent Services Development Corporation LP (DXC Technology Company)
• Inventors: KALIBJIAN, JEFF
• Granted Patent: US 11,017,687 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G09B 19/00 Teaching not covered by other main groups of this subclass teaching or practice apparatus for gun-aiming or gun-laying F41G3/26
• CPC Class Codes: G09B 5/02 with visual presentation of the material to be studied, e.g. using film strip
• CPC Class Codes: G09B 5/12 different stations being capable of presenting different information simultaneously G09B5/14 takes precedence
• CPC Class Codes: G09B 7/077 different stations being capable of presenting different questions simultaneously
• CPC Class Codes: G09B 7/10 wherein a set of answers is common to a plurality of questions

Abstract

Textual indicators are extracted from an electronic document. A rule for monitoring information technology user behavior is generated from the extracted textual indicators.

Claims

1. A computer system comprising:

at least one processor;

a memory having stored thereon machine readable instructions which, when executed by the at least one processor, causes the computer system to;

determine a construct of textual indicators of information technology (IT) user behavior for parsing an electronic document;

extract the textual indicators of IT user behavior from the electronic document according to the construct; and

generate a rule associated with monitoring the IT user behavior.

2. The computer system of claim 1, wherein the construct specifies types of the textual indicators and an order for identifying each of the types of the textual indicators when parsing the electronic document.

3. The computer system of claim 2, wherein to extract the textual indicators of IT user behavior from the electronic document comprises:

determine a set of textual indicators for each type of the textual indicators;

parse a sentence in the electronic document to identify the types of textual indicators in the order specified by the construct; and

for each type of textual indicator identified in the sentence, extract, from the sentence, a textual indicator that is in the corresponding set of textual indicators.

4. The computer system of claim 1, wherein the rule includes an IT user behavior and a condition for monitoring the IT user behavior.

5. The computer system of claim 1, wherein a remedial action is triggered in response to detecting the condition of the IT user behavior being monitored.

6. The computer system of claim 1, wherein the machine readable instructions when executed by the at least one processor, cause the computer system to:

create an IT user behavior model including IT user behaviors extracted from the electronic document and monitoring conditions associated with each extracted IT user behavior.

7. The computer system of claim 6, wherein the IT user behavior model is in a format usable by an IT behavior monitoring tool to monitor for the IT user behaviors, and the machine readable instructions when executed by the at least one processor, cause the computer system to:

transmit the IT user behavior model to the IT behavior monitoring tool.

8. The computer system of claim 1, wherein the machine readable instructions when executed by the at least one processor, cause the computer system to:

create an online training course associated with the IT user behavior;

receive an indication that a monitoring condition associated with the IT user behavior for a user is detected; and

provide the online training course to the user.

9. The computer system of claim 8, wherein the machine readable instructions when executed by the at least one processor, cause the computer system to:

revoke an access privilege of the user in response to receiving the indication, wherein the access privilege is for accessing an IT resource associated with the IT user behavior; and

reinstate the access privilege of the user in response to determining the user passes the online training course.

10. The computer system of claim 8 wherein to create an online training course, the machine readable instructions when executed by the at least one processor, cause the computer system to:

create an index associating the IT user behavior with a block of text in the electronic document; and

create questions for the online training course from the block of text.

11. The computer system of claim 8 wherein to create questions for the online training course, the machine readable instructions when executed by the at least one processor, cause the computer system to:

identify a sentence from the block of text; and

replace or remove at least one of a verb, adverb or noun in the sentence.

12. A computer-implemented method executable by at least one processor, the method comprising:

determining a rule for monitoring IT user behavior from textual indicators extracted from an electronic document;

determining a block of text in the electronic document associated with the IT user behavior;

identifying sentences from the block of text; and

creating questions for an online training course associated with the IT user behavior from the sentences.

13. The computer-implemented method of claim 12, wherein creating questions comprises:

replacing or removing at least one of a verb, adverb or noun in the sentences to create true or false or multiple choice questions.

14. The computer-implemented method of claim 12, comprising:

receiving an indication that a monitoring condition associated with the IT user behavior for a user is detected; and

sending a link to the user for the online training course to the user in response to receiving the indication.

15. A computer system comprising:

at least one processor;

a memory having stored thereon machine readable instructions which, when executed by the at least one processor, causes the computer system to;

determine a construct of textual indicators of information technology (IT) user behavior for parsing an electronic document;

extract the textual indicators of IT user behavior from the electronic document according to the construct;

generate a rule for monitoring the IT user behavior;

determine a block of text in the electronic document associated with the IT user behavior;

identify sentences from the block of text; and

create questions for an online training course associated with the IT user behavior from the sentences.