Classification and identification of computer use

• US 8,549,629 B1
• Filed: 03/16/2010
• Issued: 10/01/2013
• Est. Priority Date: 03/16/2009
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: McCreesh, Martin, Schnurr, Christopher Jerome, Maurer, Frank
• Primary Examiner(s): PEARSON, DAVID J
• Application Number:
  US12/725,166
• Time in Patent Office: 1,295 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G09B 19/24 Use of tools
• CPC Class Codes: G16H 40/63 for local operation

Abstract

Methods, programs, and systems for classifying and monitoring user-computer interactions include monitoring keystroke characteristics, mouse characteristics, and application frequency and garnering associated data. Metrics associated with the monitored data are then analyzed and used for a several business and security applications: Security-Impersonation, Security-Profiling, Business-Training, and Business-Application Development. The methods of the present disclosure enable greater insight into user-computer interactions.

Claims

1. A method for monitoring, understanding, or modifying user-computer interactions including the steps of:

monitoring at least one computer application, operating system, or program;

monitoring at least one user'"'"'s application characteristics including a rate of switching between said at least one computer application, operating system, or program, wherein said at least one user'"'"'s application characteristics include a screen frequency comprising a number of times a window associated with said at least one computer application, operating system, or program appears on a screen;

monitoring said at least one user'"'"'s application characteristics including a duration said at least one user uses said at least one computer application, operating system, or program;

monitoring said at least one user'"'"'s keystroke characteristics in at least one said computer application, operating system, or program;

monitoring said at least one user'"'"'s mouse characteristics in said at least one computer application, operating system, or program;

associating said at least one user'"'"'s application characteristics, mouse characteristics, and keystroke characteristics to a profile for said at least one user; and

in a computing system, detecting a change in computer use associated with said at least one user based on a deviation from the profile for said at least one user.

2. The method of claim 1, wherein said step of monitoring said at least one user'"'"'s keystroke characteristics further includes the step of monitoring said at least one user'"'"'s keystroke rate.

3. The method of claim 1, wherein said step of monitoring said at least one user'"'"'s keystroke characteristics further includes the step of monitoring said at least one user'"'"'s keystroke amount.

4. The method of claim 1, wherein said step of monitoring said at least one user'"'"'s mouse characteristics further includes the step of monitoring said at least one user'"'"'s mouse click rate.

5. The method of claim 1, wherein said step of monitoring said at least one user'"'"'s mouse characteristics further includes the step of monitoring said at least one user'"'"'s mouse click amount.

6. The method of claim 1, wherein said step of monitoring said at least one user'"'"'s mouse characteristics further includes the step of monitoring said at least one user'"'"'s mouse movement.

7. The method of claim 1, further comprising analyzing said profile of said at least one user.

8. The method of claim 7, further comprising analyzing said profile against a profile of an organization to which said at least one user belongs.

9. The method of claim 7, further comprising raising alerts based on said analysis, wherein said alerts comprise at least one security alert, business alert, or safety alert.

10. A non-transitory computer readable medium having encoded thereon a program for monitoring, understanding, or modifying user-computer interactions, wherein said program, when executed by a computing system, directs the computing system to:

monitor at least one computer application, operating system, or program;

monitor at least one user'"'"'s application characteristics including a rate of switching between said at least one computer application, operating system, or program, wherein said at least one user'"'"'s application characteristics include a screen frequency comprising a number of times a window associated with said at least one computer application, operating system, or program appears on a screen;

monitor said at least one user'"'"'s application characteristics including a duration said at least one user uses said at least one computer application, operating system, or program;

monitor said at least one user'"'"'s keystroke characteristics in at least one said computer application, operating system, or program;

monitoring said at least one user'"'"'s mouse characteristics in said at least one computer application, operating system, or program;

associate said at least one user'"'"'s application characteristics, mouse characteristics, and keystroke characteristics to a profile for said at least one user; and

detect a change in computer use associated with said at least one user based on a deviation from the profile for said at least one user.

11. The non-transitory computer readable medium of claim 10, wherein said program further directs the computing system to monitor said at least one user'"'"'s keystroke rate.

12. The non-transitory computer readable medium of claim 10, wherein said program directs the computing system to monitor said at least one user'"'"'s keystroke amount.

13. The non-transitory computer readable medium of claim 10, wherein said program directs the computing system to monitor said at least one user'"'"'s mouse click rate.

14. The non-transitory computer readable medium of claim 10, wherein said program directs the computing system to monitor said at least one user'"'"'s mouse click amount.

15. The non-transitory computer readable medium of claim 10, wherein said program directs the computing system to monitor said at least one user'"'"'s mouse movement.

16. The non-transitory computer readable medium of claim 10, wherein said program directs the computing system to analyze said profile of said at least one user.

17. The non-transitory computer readable medium of claim 16, wherein said program directs the computing system to analyze said profile against a profile of an organization to which said at least one user belongs.

18. The non-transitory computer readable medium of claim 16, wherein said program directs the computing system to raise alerts based on said analysis, wherein said alerts comprise at least one security alert, business alert, or safety alert.

19. A monitoring system comprising:

a computer system and a plurality of input devices coupled to the computer system, wherein the input devices comprise a keyboard and a mouse;

the computer system configured to receive a user identifier associated with a user operating the computer system, associate a usage session of the computer system with the user based on the user identifier, monitor an application executing on the computer system during the usage session to determine a duration the application is in focus and a frequency of change in the focus of the application, wherein the frequency of change in the focus of the application includes a screen frequency comprising a number of times a window associated with the application appears on a screen, monitor keystroke characteristics and mouse characteristics of the user associated with the application during the usage session, generate a usage profile based on the duration the application is in focus, the frequency of change in the focus of the application, the keystroke characteristics, and the mouse characteristics monitored during the usage session, wherein the usage profile comprises an indication of usage characteristics of the user for the application, and detect a change in computer use associated with the user based on a deviation from the usage profile.

20. The monitoring system of claim 19, wherein the computer system configured to monitor the keystroke characteristics comprises the computer system configured to monitor a keystroke rate and a keystroke amount performed by the user with the keyboard, and wherein the computer system configured to monitor the mouse characteristics comprises the computer system configured to monitor a mouse click rate, a mouse click amount, and mouse movement performed by the user with the mouse.