User behavioral risk assessment

• US 8,881,289 B2
• Filed: 12/22/2011
• Issued: 11/04/2014
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Basavapatna, Prasanna Ganapathi, Moyle, Michael Mason, Schrecker, Sven
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/334,304
• Publication Number:
  US 20130097709A1
• Time in Patent Office: 1,048 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A predetermined particular behavioral profile is identified associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system. Activities associated with use of the computing system by the particular user are identified and it is determined whether the identified activities correlate with the particular behavioral profile. Identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users within the computing system, wherein the particular behavioral profile is based on previously detected activities of at least one user in the set and the set comprises the particular user;

identify, using at least one computer processing device, activities associated with use of the computing system by the particular user; and

determined, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity.

2. The storage medium of claim 1, wherein activities that do not deviate beyond the particular threshold are considered satisfactorily consistent with the particular behavioral profile and do not trigger risk events.

3. The storage medium of claim 1, wherein the particular behavioral profile is a user-based behavioral profile based on a plurality of inputs describing prior activities of the particular user in the computing system.

4. The storage medium of claim 3, wherein the instructions, when executed, further cause the machine to:

identify a second user-based behavioral profile associated with a second user of the computing system;

identify activities associated with use of the computing system by the second user; and

determine whether the identified activities of the second user correlate with the second user-based behavioral profile, wherein identifying an activity that deviates from the second behavioral profile beyond the particular threshold triggers a risk event relating to the second user.

5. The storage medium of claim 3, wherein the first and second users are included in a plurality of users within the computing system and each user in the plurality of users has at least one corresponding user-based behavioral profile.

6. The storage medium of claim 5, wherein the instructions, when executed, further cause the machine to determine an aggregate risk profile for the computing system based at least in part on the user-based behavioral profile of the plurality of users.

7. The storage medium of claim 6, wherein determining the aggregate risk profile for the computing system includes:

identifying an association between a particular computing device in the computing system and the particular user;

determining a device risk profile of the particular computing device; and

determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device.

8. The storage medium of claim 7, wherein determining the composite risk includes identifying, from the particular behavioral profile, a behavioral tendency of the particular user that corresponds to a particular vulnerability of the particular computing device identified from the device risk profile of the particular computing device.

9. The storage medium of claim 1, wherein the set of users comprises a plurality of users and the particular behavioral profile is a group-based behavioral profile based on a plurality of inputs from the plurality of users, the plurality of inputs describing prior activities of the plurality of users in the computing system.

10. The storage medium of claim 9, wherein the set of users is at least one of a business unit, users in a particular geographic location, users with a particular employment status, users in a particular department of an organization, and a set of all identified users of the computing system.

11. The storage medium of claim 1, wherein the particular behavioral profile is based on a plurality of inputs received from a plurality of security tools providing security services within the computing system.

12. The storage medium of claim 11, wherein the instructions, when executed, further cause the machine to initiate deployment of a countermeasure in response to determining that a particular activity of the particular user deviates from the particular behavioral profile beyond the particular threshold, wherein the countermeasure corresponds to a particular risk event triggered by the particular activity.

13. The storage medium of claim 12, wherein the countermeasure is deployed using at least one of the plurality of security tools.

14. The storage medium of claim 13, wherein the plurality of security tools include at least two of a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool.

15. The storage medium of claim 13, wherein the plurality of security tools include a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool.

16. The storage medium of claim 11, wherein at least one of the inputs originates from a host-based security tool operating on at least one end user computing device in the computing system identified as used by the particular user, the host-based security tool adapted to monitor behavior of users of the end user computing device at the end user computing device for use in detecting violations of user behavioral rules for the computing system.

17. The storage medium of claim 16, wherein the instructions, when executed, further cause the machine to corroborate a determined deviation from the particular behavioral profile with a particular violation of a user behavior rule detected from monitoring of the end user computing device by the host-based security tool.

18. The storage medium of claim 1, wherein the particular behavioral profile includes a plurality of categorical risk profiles for the particular user, each categorical risk profile describing determined tendencies of the particular user with regard to a respective category of system use.

19. A method comprising:

identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users within the computing system, wherein the particular behavioral profile is based on previously detected activities of at least one user in the set and the set comprises the particular user;

identifying activities associated with use of the computing system by the particular user; and

determining, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity.

20. A system comprising:

at least one processor device;

at least one memory element; and

a user behavioral risk analysis engine, adapted when executed by the at least one processor device to;

identify a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users within the computing system, wherein the particular behavioral profile is based on previously detected activities of at least one user in the set and the set comprises the particular user;

identify a particular activity associated with use of the computing system by the particular user; and

determine, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity.

21. The system of claim 20, further comprising at least two security tools from a set including a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool, wherein user activities associated with use of the computing system are identified by each of the at least two security tools.

22. The system of claim 20, wherein the user behavioral risk analysis engine is further adapted, when executed, to:

identify a detected violation of a particular system usage rule in a plurality of system usage rules by the particular user through use of a particular computing device by the particular user within the computing system, wherein the detected violation is based on monitoring of the particular computing device by a security tool installed on the particular computing device; and

corroborate the determined deviation from the particular behavioral profile with the detected violation of the particular system usage rule by the particular user.