User behavior profile environment

• US 10,645,096 B2
• Filed: 12/06/2018
• Issued: 05/05/2020
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Ford, Richard Anthony
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/211,674
• Publication Number:
  US 20190116190A1
• Time in Patent Office: 516 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system, method, and computer-readable medium are disclosed for monitoring user behavior elements, comprising: monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource; converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior; generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior; providing the user behavior profile to a user behavior monitoring system; and, generating a notification based upon the user behavior profile via the user behavior monitoring system.

Claims

1. A computer-implementable method for monitoring user behavior elements, comprising:

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

2. The method of claim 1, wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

3. The method of claim 1, wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and

,

the user profile comprises a multi-layered user behavior profile.

4. The method of claim 3, wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and

,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

5. The method of claim 1, wherein:

each electronically-observable user behavior has a corresponding behavior element.

6. The method of claim 5, wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and

,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

8. The system of claim 7, wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

9. The system of claim 7, wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and

,

the user profile comprises a multi-layered user behavior profile.

10. The system of claim 9, wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and

,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

11. The system of claim 7, wherein:

each electronically-observable user behavior has a corresponding behavior element.

12. The system of claim 11, wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and

,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

14. The non-transitory, computer-readable storage medium of claim 13, wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

15. The non-transitory, computer-readable storage medium of claim 13, wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and

,

the user profile comprises a multi-layered user behavior profile.

16. The non-transitory, computer-readable storage medium of claim 15, wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and

,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

17. The non-transitory, computer-readable storage medium of claim 13, wherein:

each electronically-observable user behavior has a corresponding behavior element.

18. The non-transitory, computer-readable storage medium of claim 17, wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and

,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

19. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.