User activity modelling, monitoring, and reporting framework

• US 9,600,659 B1
• Filed: 12/16/2015
• Issued: 03/21/2017
• Est. Priority Date: 11/30/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bray, Rory F., Spencer, Dwight E., Bird, William A., Keirstead, Jason D., Wuest, Ben A.
• Primary Examiner(s): Waliullah, Mohammed
• Application Number:
  US14/971,157
• Time in Patent Office: 461 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method, system and computer-usable medium are disclosed for identifying risk within an information technology (IT) environment, comprising: analyzing characteristics of a user accessing a system within an IT environment; associating a risk profile with the user based upon the characteristics of the user; determining when the user accesses a system within the IT environment; maintaining a user risk profile record of all systems within the IT environment accessed by the user, the user risk profile record continuing to be associated with the system after access by the user ceases; and, identifying a risk level for all systems within the IT environment based upon the user risk profile record.

Claims

1. A computer-implemented method for identifying risk within an information technology (IT) environment, comprising:

collecting data regarding user activities from a plurality of user activity data sources, the collecting data being provided to a user activity profiler from a security intelligence system via predefined user activity profile application program interfaces;

storing the data regarding the user activities within a user activity data repository;

analyzing characteristics of a user accessing a system within an IT environment, the characteristics of the user being related to the user activities and information relating to activity behavioral groups based upon the user activities;

associating a risk profile with the user based upon the characteristics of the user;

determining when the user accesses a system within the IT environment;

maintaining a user risk profile record of all systems within the IT environment accessed by the user, the user risk profile record continuing to be associated with the system after access by the user ceases; and

,

identifying a risk level for all systems within the IT environment based upon the user risk profile record; and

wherein

specific suspicious user activity is identified based on external threat feeds and analysis; and

,

information regarding the specific suspicious user activity is presented to an organization and to individual users with regard to risk assessments, observed suspicious activities and general education of what is affecting risk with respect to the organization and individual users.

2. The method of claim 1, wherein:

the analyzing characteristics of the user accessing the system comprise modelling the user activities via a collection of data from the plurality of user activity data sources.

3. The method of claim 1, wherein:

activity behavioral groups are constructed on a global perspective based upon the user activities of a plurality of users.

4. The method of claim 1, wherein:

activity behavioral groups are constructed on an individual perspective based upon user activities of a single user.

5. The method of claim 1, wherein:

user activity is associated with one or more user activity attributes, the user activity comprising browsing habits and system access behavior; and

user activities are dynamically clustered depending on a user activity.