Anomalous activity detection

• US 8,595,789 B2
• Filed: 04/27/2010
• Issued: 11/26/2013
• Est. Priority Date: 02/15/2010
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Warn, Carmen Michael, Nuthi, Sireesh Kumar, Bhattaram, Praneeth Chandra
• Primary Examiner(s): Kosowski, Carolyn B
• Assistant Examiner(s): CHIANG, JASON
• Application Number:
  US12/768,481
• Publication Number:
  US 20110202969A1
• Time in Patent Office: 1,309 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The disclosure addresses the detection of anomalous activity. Some embodiments are directed towards a system for receiving an indication relating to a plurality of controls, identification information associated with a responsible account, and instructions from a responsible account associated with the monitoring of thresholds of controls being monitored. The plurality of user account may be organized into groups based upon information relating to the user accounts, and instructions may be applied to the groups to create a dynamic security policy.

Claims

1. A system comprising:

a processor in operative communication with at least one memory storing computer-executable instructions that, when executed, cause the system to perform a method comprising;

receiving a determination relating to a plurality of controls being monitored in relation to activity events of a plurality of user accounts wherein the controls are determined based upon detecting or receiving information regarding capabilities of one or more security applications;

receiving from multiple data feeds, information regarding a plurality of activity events associated with a least one user account from the plurality of user accounts and conducted during a first time period, wherein the first time period is between 45 and 50 hours;

identifying information relating to the plurality of user accounts;

organizing at least a portion of the plurality of user accounts into a group based upon information relating to the user accounts; and

receiving identification information associated with a responsible account that is responsible for a plurality of user accounts;

storing an output of a reports analysis engine;

detecting duplicate activity events that exist without technical or human error from the information to create de-duplicated activity events, creating de-duplicated activity events including removing a detected duplicate activity event, and generating data comprising comma separated values, each value representing a plurality of duplicative activity events organized into an aggregate event;

enriching the de-duplicated activity events with enrichment criteria from an updatable repository to create enriched activity events;

comparing known patterns relating to one or more user accounts stored in a repository to the information of the de-duplicated activity events, excluding at least a portion of de-duplicated activity events and enrich at least a portion of the de-duplicated activity events; and

determining whether to escalate an activity event processed by an enrichment module to a notification.

2. The system of claim 1, further comprising providing rules affecting reporting.

3. The system of claim 1, further comprising receiving input from a knowledge database.

4. The system of claim 3, where the information is used to identify status of at least one user of at least one of the plurality of user accounts from an event.