CONTEXT-AWARE TRAINING SYSTEMS, APPARATUSES, AND METHODS

• US 20120258437A1
• Filed: 04/09/2012
• Published: 10/11/2012
• Est. Priority Date: 04/08/2011
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Wombat Security Technologies, Inc (Proofpoint Incorporated)
• Inventors: Sadeh-Koniecpol, Norman, Wescoe, Kurt, Brubaker, Jason, Hong, Jason
• Granted Patent: US 9,547,998 B2
• Time in Patent Office: Days
• US Class Current: 434/362
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G09B 19/00 Teaching not covered by other main groups of this subclass teaching or practice apparatus for gun-aiming or gun-laying F41G3/26
• CPC Class Codes: G09B 5/00 Electrically-operated educational appliances working with questions and answers G09B7/00; simulators G09B9/00; advertising or displaying in general G09F
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 : Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 : service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Context-aware training systems, apparatuses and systems. The context-aware training systems, apparatuses and systems are computer-implemented and include sensing a user action and, based on a training needs model, estimating a cost or benefit to exposing the user to a training action, selecting a training action from a collection of available training actions and delivering the training action to the user if the user action indicates a need for the user to be trained and the cost or benefit to exposing the user to the training action indicates user exposure to the training action is warranted.

Claims

1. A computer-implemented method for training a user, comprising:

a. sensing, using a computer system that includes at least one processor, at least one action performed by the user;

b. selecting, using the computer system, at least one training action from a collection of available training actions using a training needs model that estimates at least one of a cost and a benefit of exposing the user to a plurality of combinations of available training actions, based on the sensed at least one user action, if the sensed at least one user action indicates a need for the user to be trained and at least one relevant training action from the set of available training actions is identified; and

c. delivering, using the computer system, the selected at least one training action to the user.

2. The method of claim 1, wherein the delivering of the selected at least one training action includes delivering the training action to an output device accessible by the user.

3. The method of claim 1, wherein the delivering of the selected at least one training action comprises recommending, using the computer system, that the user perform the at least one selected training action

4. The method of claim 1, wherein the delivering of the selected at least one training action comprises assigning, using the computer system, the selected at least one training action to the user.

5. The method of claim 4, further comprising providing, using the computer system, a date by which the user should be exposed to the selected at least one training action.

6. The method of claim 4, further comprising determining, using the computer system, a proficiency level that the user is to achieve.

7. The method of claim 1, wherein the available training actions include computer-supported training intervention.

8. The method of claim 1, wherein the available training actions include human-mediated training interventions.

9. The method of claim 1, wherein the available training actions include at least one of presenting a warning to the user, presenting a recommendation to the user, introducing the user to a strategy for carrying out some tasks, presenting a cartoon to the user, presenting a deck of slides to the user, presenting a quiz to the user, presenting video training content to the user, presenting audio training content to the user, presenting a game to the user, having the user take a simulation exercise, having the user receive a human-mediated training intervention, having the user engage in a group training exercise, downloading training content onto a user'"'"'s memory implants, activating a training module that will incrementally present training content to the user over a period of time, and exposing the user to a nudge intended to modify his behavior.

10. The method of claim 1, wherein the sensed at least one user action is used to customize the selected at least one training action delivered to the user.

11. The method of claim 1, wherein the delivery of the selected at least one training action is customized based on the sensed at least one user action.

12. The method of claim 1, wherein the at least one selected training action is delivered to the user in-time to provide the user with relevant training as the user engages in an action for which the computer system has determined the user has an immediate need to be trained.

13. The method of claim 1, wherein the selected at least one training action is delivered to the user before the user engages in an action for which the computer system has determined the user has a need to be trained.

14. The method of claim 1, wherein a determination of the need for the user to be trained includes, using the computer system, accessing and using information about the user other than the sensed at least one user action.

15. The method of claim 14, wherein the accessing and using information about the user includes at least one of accessing and using the role of the user in an organization, accessing and using responsibilities of the user, accessing the age of the user, accessing and using the education level of the user, accessing and using the prior training history of the user, accessing and using demographic data about the user, accessing and using information about the languages understood by a user, accessing and using information about possible impairments of the user, accessing and using information about relevant user preferences, and accessing and using information devices available to a user.

16. The method of claim 1, wherein the at least one training action is further selected by, using the computer system, accessing and using information about the user other than the sensed at least one user action.

17. The method of claim 16, wherein the accessing and using information about the user includes at least one of accessing and using the role of the user in an organization, accessing and using responsibilities of the user, accessing the age of the user, accessing and using the education level of the user, accessing and using the prior training history of the user, accessing and using demographic data about the user, accessing and using information about the languages understood by a user, accessing and using information about possible impairments of the user, accessing and using information about relevant user preferences, and accessing and using information devices available to a user.

18. The method of claim 1, wherein the selected at least one training action is customized by, using the computer system, accessing and using information about the user other than the sensed at least one user action.

19. The method of claim 18, wherein the accessing and using information about the user includes at least one of accessing and using the role of the user in an organization, accessing and using responsibilities of the user, accessing the age of the user, accessing and using the education level of the user, accessing and using the prior training history of the user, accessing and using demographic data about the user, accessing and using information about the languages understood by a user, accessing and using information about possible impairments of the user, accessing and using information about relevant user preferences, and accessing and using information devices available to a user.

20. The method of claim 1, wherein the delivery of the selected at least one training action is customized by, using the computer system, accessing and using information about the user other than the sensed at least one user action.

21. The method of claim 20, wherein the accessing and using information about the user includes at least one of accessing and using the role of the user in an organization, accessing and using responsibilities of the user, accessing the age of the user, accessing and using the education level of the user, accessing and using the prior training history of the user, accessing and using demographic data about the user, accessing and using information about the languages understood by a user, accessing and using information about possible impairments of the user, accessing and using information about relevant user preferences, and accessing and using information devices available to a user.

22. The method of claim 1, wherein the sensing of at least one action performed by the user includes obtaining information from at least one sensing device.

23. The method of claim 1, wherein the sensing of at least one action performed by the user includes collecting information reported by other users.

24. The method of claim 1, wherein the sensing of at least one action performed by the user includes collecting information reported by people who are not users of the training system.

25. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing information about other users, including at least one of activities and behaviors of the other users.

26. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing information about people who are not users of the training system, including at least one of activities and behaviors of the people.

27. The method of claim 1, wherein the sensing of at least one action performed by the user includes collecting information reported by the user.

28. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing at least one of an activity performed by the user and a behavior displayed by the user.

29. The method of claim 1, wherein the sensing of at least of one action performed by the user includes sensing action of the user during performance of a duty that the user has been hired to perform.

30. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing action of the user during performance of activities that the user has not been hired to perform.

31. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing a user action in response to a mock situation, the mock situation including one of the following:

a performance in one of a simulation and performance on a quiz;

a mock situation involving multiple users;

a mock situation involving non-users; and

a mock situation involving people in charge of training.

32. The method of claim 1, wherein the training needs model includes an objective function that reflects significant costs and benefits associated with exposing a user to different combinations of training actions in a given context and wherein the selection of the at least one training action is performed by attempting to maximize the objective function.

33. The method of claim 32, wherein maximization of the objective function is performed using available mathematical optimization techniques including at least one of linear programming techniques, convex quadratic programming techniques, other convex programming techniques, integer programming techniques, mixed integer programming techniques, non-linear programming techniques, stochastic programming techniques, robust programming techniques, combinatorial optimization techniques, heuristic techniques, search techniques, meta-heuristics, constraint satisfaction techniques, disjunctive programming techniques, iterative improvement techniques, Partially Observable Markov Decision Process (POMDP) techniques and other mathematical programming and optimization techniques.

34. The method of claim 32, wherein maximization of the objective function is conducted using qualitative techniques that include at least one of fuzzy reasoning techniques and qualitative reasoning techniques.

35. The method of claim 1, wherein the training needs model is a risk model including a model of the risks a user in a given context behaves in a manner than is not desirable, a manner in which the user puts the user at risk, a manner in which the user puts others at risk, a manner in which the user puts an organism at risk, a manner in which the user puts an object at risk, a manner in which the user puts an organization at risk, a manner in which the user puts the environment at risk, a manner in which the user breaks a policy, a manner in which the user breaks a law, a manner in which the user puts the user in a bad light, a manner in which the user puts others in a bad light, a manner in which the user puts an organization in a bad light, a manner in which a user fails to capitalize on an opportunity, a manner in which the user omits to perform some actions, a manner in which the user omits to consider possible consequences of the user'"'"'s actions, and a manner in which the user omits to consider some possible courses of action.

36. The method of claim 35, wherein the risk model is quantitative.

37. The method of claim 35, wherein the risk model is qualitative.

38. The method of claim 35, wherein the risk model combines both qualitative and quantitative elements.

39. The method of claim 1, wherein the training needs model takes into account estimates of the reduction in risk resulting from the user taking an available training action.

40. The method of claim 39, wherein the risk model is quantitative.

41. The method of claim 39, wherein the risk model is qualitative.

42. The method of claim 39, wherein the risk model combines both qualitative and quantitative elements.

43. The method of claim 1, wherein the training needs model takes into account the reduction in risk resulting from the user taking combinations of available training actions.

44. The method of claim 43, wherein the risk model is quantitative.

45. The method of claim 43, wherein the risk model is qualitative.

46. The method of claim 43, wherein the risk model combines both qualitative and quantitative elements.

47. The method of claim 1, wherein the selected at least one training action includes a combination of at least one mandatory training action and at least one recommended training action.

48. The method of claim 1, wherein the training needs model identifies and prioritizes a plurality of training actions.

49. The method of claim 1, wherein the training needs model estimate takes into account at least one resource constraint.

50. The method of claim 49, wherein the at least one resource constraint includes at least one of time available to the user, cognitive load on the user prior to being exposed to any training action, anticipated increase in cognitive load on the user resulting from exposure to combinations of available training actions, computer system capacity, and availability of a device to deliver the at least one training action, capability of available devices, capacity of available devices, and performance of the available devices.

51. The method of claim 1, wherein the training needs model estimate takes into account, at least in part, the effectiveness of the at least one training action in the collection of available training actions in identifying the need for training.

52. The method of claim 51, wherein the effectiveness of the at least one training action in the collection of available training actions takes into account information about expected user retention of the at least one training action.

53. The method of claim 52, wherein the information about the expected user retention associated with the at least one training action is based, at least in part, on historical data for a plurality of people who have previously been exposed to the at least one training action.

54. The method of claim 53, wherein the effectiveness of the at least one training action in identifying the need for training takes into account historical training data for the user

55. The method of claim 1, wherein the selecting of at least one training action from a collection of available training actions using a training needs model takes into account meta-data about available training actions.

56. The method of claim 1 wherein the training needs model estimate is derived, at least in part, using at least one of data mining and other statistical data analysis techniques, the other statistical data analysis techniques including one or more of regression techniques, nearest neighbor techniques, clustering techniques, decision trees, neural networks, and rule induction techniques, the data mining and other statistical data analysis techniques used to derive models that predict one or more parameters.

57. The method of claim 56, the one or more parameters including the effectiveness of available training actions in addressing different training needs in different contexts, the effectiveness of combinations of training actions in addressing different training needs in the different context, the probability of the user exhibiting different behaviors in different contexts without being trained, the probability of the user exhibiting different behaviors in different contexts after being exposed to a given training action, the probability of the user exhibiting different behaviors in different contexts after being exposed to different combinations of training actions, the costs associated with exposing the user to a training action, the cost associated with exposing the user to a combination of training actions, the expected benefits of exposing the user to a given training action in a given context, and the expected benefits of exposing the user to combinations of training actions in a given context.

58. The method of claim 1, wherein the sensed data is at least in part recorded on a data storage device.

59. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one cybersecurity training action in the collection of available training actions.

60. The method of claim 1, wherein the need to be trained is a need to adopt safe cybersecurity practices, the safe cybersecurity practices including at least one of learning to regularly download software patches, learning safe browsing practices, safely using a computing device outside the office, safely using a USB-enabled device, learning safe password management practices, learning safe smart phone security practices, learning safe social networking practices, learning to defend against social engineering threats, learning safe practices relating to protecting sensitive information, learning safe practices for carrying sensitive data out of a workplace, learning safe practices when traveling to a foreign country, learning safe email reading practices, learning safe web browsing practices, learning safe practices relating to the disposal of electronic media and devices, and learning safe practices relating to access to social networking sites.

61. The method of claim 1, wherein the training needs model estimates at least one of a cost and a benefit of exposing the user to a compliance-related training action, the compliance-related training action including at least one of email etiquette, cyber bullying, sexual harassment, health care privacy, financial privacy, child privacy, educational privacy, health compliance, safety compliance, financial regulation compliance, health care confidentiality compliance, insurance compliance, educational compliance, compliance related to regulations governing activities in private sector organizations, and compliance related to regulations governing activities in government organizations.

62. The method of claim 1, wherein the training needs model is based at least in part on at least one of matching sensed user data to a pattern indicative of susceptibility to a threat and estimating a risk associated with the threat.

63. The method of claim 1, wherein the computer system includes a plurality of components, the plurality of components residing in a plurality of locations.

64. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one health-oriented training action.

65. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one safe driving training action.

66. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action to improve social interactions with others.

67. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action related to protecting the environment.

68. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action related to not breaking the law.

69. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action related to controlling a piece of equipment or machinery.

70. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action related to learning work-related skills.

71. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing the user to at least one training action related to managing finances.

72. The method of claim 1, wherein the training needs model further estimates at least one of a cost and a benefit of exposing a child to at least one training action intended to supplement education provided by a parent to the child.

73. The method of claim 1, wherein the sensing of at least one action performed by the user includes sensing failure of a user to perform at least one action.

74. A computer-implemented training system, comprising:

a. a sensor monitoring at least one action performed by the user;

b. an output device proximate to the user; and

c. a computer system that includes at least one processor, the computer system coupled to the sensor and the output device, the computer system containing instructions which, when executed by the at least one processor, causes the computer system to;

i. receive data from the sensor, the data pertaining to the performance by the user of an action;

ii. analyze the data using a training needs model that estimates at least one of a cost and a benefit of exposing the user to at least one training action, based on the received data, if the data indicates a need for the user to be trained;

iii. select one or more training actions from a collection of training actions for use by the user; and

iv. provide the selected one or more training actions to the user through the output device.

75. The system of claim 74 wherein the monitoring of at least one action performed by the user includes monitoring the non-performance of the at least one action by the user.

76. The system of claim 74, wherein the monitoring of at least one action performed by the user includes collecting information from a plurality of other sensors.

77. The system of claim 74, wherein the computer system is coupled to at least one other source of information and receives other data from the least one other source of information, the analysis using the training needs model further including analysis of the other data.

78. The system of claim 74, wherein other data historically received from the sensor is stored in at least one data storage system, the analysis using the training needs model further including analysis of the other data.

79. The system of claim 74, wherein at least part of the training needs model is stored in at least one data storage system from which the training needs model is accessed by the computer system to analyze the data.

80. The system of claim 74, further including at least one administrative console coupled to the computer system to enable at least one system administrator to access and customize elements of the training needs model.

81. The system of claim 74, further including at least one administrative console o at least one administrator to perform at least one of accessing, reviewing and manipulating the results of the analysis performed using the training needs model.

82. The system of claim 74, further including at least one administrative o at least one administrator to perform at least one of reviewing the results of analysis conducted using the training needs model, modifying the results of the analysis conducted using the training needs model, reviewing the selected one or more training actions, modifying the selected one or more training actions, and modifying parameters associated with the providing of the selected one or more training actions to the user.

83. The system of claim 74, further comprising an external computer system coupled to the computer system to provide remote updates to the training needs model.

84. The system of claim 74, further comprising a data storage system to collect historical training data, the data storage system coupled to the computer system, enabling the computer system to access the historical training data to support the analysis of the data using the training needs model.

85. The system of claim 74, further comprising a data storage system to store at least part of the collection of training actions, the data storage system coupled to the computer system to enable the providing of the selected one or more training actions to the output device.

86. The system of claim 74, further comprising a data storage system to store meta-data about the available training actions, the data storage system coupled to the computer system, enabling the computer system to access the meta-data to support its analysis of the data using the training needs model.

87. The system of claim 74, further comprising a plurality of output devices, and wherein meta-data about the output devices available to provide the selected one or more training actions to the user is used by the computer system to select at least one of the plurality of output devices to provide the selected one or more training actions to the user.

88. The system of claim 87, further comprising a computer console coupled to the computer system, enabling at least one administrator to perform at least one of reviewing the at least one selected output device, and modify the at least one selected output device to provide the selected one or more training actions.

89. The system of claim 87, wherein the meta-data about the available output devices to provide the selected one or more training actions is maintained in at least one storage device coupled to the computer system to support the selection of at least one appropriate output device to provide the selected one or more training actions.

90. The system of claim 87, wherein the sensor monitoring at least one action performed by the user is used to capture elements of the user'"'"'s response to a mock situation.

91. The system of claim 74, wherein the monitoring of at least one action performed by the user includes monitoring an effect of the at least one action on at least one of the following:

other people, the user'"'"'s environment, an organization, an object, and an organism.

92. The system of claim 74, wherein the monitoring of at least one action performed by the user includes monitoring the effect of the non-performance by the user of the at least one action on at least one of the following:

other people, the user'"'"'s environment, an organization, an object, and an organism.