Profiling users based on artificially constructed deceptive content

• US 7,665,134 B1
• Filed: 01/26/2005
• Issued: 02/16/2010
• Est. Priority Date: 01/26/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Harrison, John, Hernacki, Brian
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US11/044,615
• Time in Patent Office: 1,847 Days
• Field of Search: 726/23, 726/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

Profiling a user is disclosed. The user'"'"'s behavior with respect to specially designed content comprised of one or more units of content is monitored. The specially designed content is designed such that one or more characteristics of the user may be inferred based at least in part on the user'"'"'s behavior with respect to the content. One or more characteristics of the user is/are inferred based at least in part on the user'"'"'s behavior with respect to the specially designed content.

Claims

1. A method of profiling a user including:

electronically creating one or more units of decoy content, each unit of decoy content being designed such that one or more characteristics of the user may be inferred based at least in part on the user'"'"'s behavior with respect to the unit of decoy content;

monitoring the user'"'"'s behavior with respect to the one or more units of decoy content;

inferring, using a processor, one or more characteristics of the user based at least in part on the user'"'"'s behavior with respect to the one or more units of decoy content; and

creating one or more numerical values associated with the one or more characteristics, the one or more numerical values representing one or more characteristic scores indicating an extent to which the user exhibits the one or more characteristics when performing or not performing actions with respect to the one or more units of decoy content.

2. The method as described in claim 1, wherein the user is an intruder.

3. The method as described in claim 1, further including deploying one or more of the one or more units of decoy content in a computer.

4. The method as described in claim 1, further including deploying one or more of the one or more units of decoy content in a storage device.

5. The method as described in claim 1, further including deploying one or more of the one or more units of decoy content in a network device.

6. The method as described in claim 1, further including deploying one or more of the one or more units of decoy content in a distributed system.

7. The method as described in claim 1, further including deploying one or more of the one or more units of decoy content in each of one or more hosts comprising a distributed system.

8. The method as described in claim 1, wherein monitoring includes determining when a user stops interaction with the one or more units of decoy content.

9. The method as described in claim 1, wherein the user is one of a plurality of users being profiled simultaneously.

10. The method as described in claim 1, further including processing one or more characteristics of the user.

11. The method as described in claim 1, further including selecting a profile from a set of predefined profiles based at least in part on one or more characteristics of the user.

12. The method as described in claim 1, wherein the one or more characteristics are quantified.

13. The method as described in claim 1, wherein some or all of the profiling is adaptive.

14. The method as described in claim 1, wherein creating one or more units of decoy content includes creating one or more units of decoy content appropriate for a subset of users.

15. The method as described in claim 1, wherein inferring one or more characteristics of the user includes inferring one or more of the one or more characteristics of the user based at least in part on the user'"'"'s behavior with respect to an environment in which the one or more units of decoy content has been deployed.

16. The method as described in claim 1, wherein inferring one or more characteristics of the user includes inferring one or more of the one or more characteristics of the user based at least in part on a location, within an environment in which the one or more units of decoy content has been deployed, of a unit of the one or more units of decoy content with which the user has interacted.

17. The method as described in claim 1, wherein inferring one or more characteristics includes determining a change, if any, to a current value associated with one or more of the one or more characteristics based at least in part on the behavior of the user with respect to one or more of the one or more units of decoy content and applying the change.

18. The method as described in claim 1, further including determining the user'"'"'s intent based at least in part on one or more of the user'"'"'s characteristics.

19. The method as described in claim 1, wherein inferring one or more characteristics of the user comprises:

receiving one or more indicators associated with a behavior by the user with respect to one or more of the one or more units of decoy content; and

mapping the one or more indicators to a change to a current value associated with one or more of the one or more characteristics.

20. The method as described in claim 1, wherein inferring one or more characteristics of the user comprises:

receiving one or more indicators associated with a behavior by the user with respect to one or more of the one or more units of decoy content;

mapping the one or more indicators to a change to a current value associated with one or more of the one or more characteristics; and

applying the change to the current value.

21. A system of profiling a user including:

a processor adapted to electronically create one or more units of decoy content, each unit of decoy content being designed such that one or more characteristics of the user may be inferred based at least in part on the user'"'"'s behavior with respect to the unit of decoy content;

a monitoring agent configured to monitor the user'"'"'s behavior with respect to the one or more units of decoy content;

an analysis engine configured to infer one or more characteristics of the user based at least in part on the user'"'"'s behavior with respect to the one or more units of decoy content, wherein each of the one or more characteristics is represented by a corresponding numerical value indicating an extent to which the user exhibits the one or more characteristics when performing or not performing actions with respect to the one or more units of decoy content.

22. The system as recited in claim 21, wherein the processor is further configured to process one or more characteristics of the user.

23. The system as recited in claim 21, wherein the processor is further configured to select a profile from a set of predefined profiles based at least in part on one or more characteristics of the user.

24. The system as recited in claim 21, wherein inferring one or more characteristics of the user includes inferring one or more of the one or more characteristics of the user based at least in part on a location, within an environment in which the one or more units of decoy content has been deployed, of a unit of the one or more units of decoy content with which the user has interacted.

25. The system as recited in claim 21, wherein the processor is further configured to determine the user'"'"'s intent based at least in part on one or more of the user'"'"'s characteristics.

26. The system as recited in claim 21, wherein inferring one or more characteristics of the user comprises:

receiving one or more indicators associated with a behavior by the user with respect to one or more of the one or more units of decoy content; and

mapping the one or more indicators to a change to a current value associated with one or more of the one or more characteristics.

27. A computer program product for profiling a user, the computer program product being embodied in a computer readable storage medium and comprising computer instructions, when executed by a processor, for:

electronically creating one or more units of decoy content, each unit of decoy content being designed such that one or more characteristics of the user may be inferred based at least in part on the user'"'"'s behavior with respect to the unit of decoy content;

monitoring the user'"'"'s behavior with respect to the one or more units of decoy content;

inferring one or more characteristics of the user based at least in part on the user'"'"'s behavior with respect to the one or more units of decoy content; and

creating one or more numerical values associated with the one or more characteristics, the one or more numerical values representing one or more characteristic scores indicating an extent to which the user exhibits the one or more characteristics when performing or not performing actions with respect to the one or more units of decoy content.

28. The computer program product as recited in claim 27, the computer program product further including computer instructions for processing one or more characteristics of the user.

29. The computer program product as recited in claim 27, the computer program product further including computer instructions for selecting a profile from a set of predefined profiles based at least in part on one or more characteristics of the user.

30. The computer program product as recited in claim 27, wherein inferring one or more characteristics of the user includes inferring one or more of the one or more characteristics of the user based at least in part on a location, within an environment in which the one or more units of decoy content has been deployed, of a unit of the one or more units of decoy content with which the user has interacted.

31. The computer program product as recited in claim 27, the computer program product further including computer instructions for determining the user'"'"'s intent based at least in part on one or more of the user'"'"'s characteristics.

32. The computer program product as recited in claim 27, wherein inferring one or more characteristics of the user comprises:

receiving one or more indicators associated with a behavior by the user with respect to one or more of the one or more units of decoy content; and

mapping the one or more indicators to a change to a current value associated with one or more of the one or more characteristics.