Threat personalization

• US 7,841,008 B1
• Filed: 03/31/2006
• Issued: 11/23/2010
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cole, David Michael, Hwang, Vincent P.
• Primary Examiner(s): Arani; Taghi T
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US11/394,738
• Time in Patent Office: 1,698 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A determination is made as to whether there is a correlation between a user'"'"'s security risk profile and a personalized threat profile of an actual or spreading threat. If there is a correlation, a personalized reactive alert is issued in the case of an actual threat. The personalized reactive alert informs the user of specific suspected data that may have been compromised by the threat and the specific non-computer related action that the user should take. Further, if there is a correlation, a personalized proactive alert is issued and/or personalized proactive protective action taken in the case of a spreading threat. The personalized proactive alert informs the user of the spreading threat that the user and/or the user'"'"'s host computer system is particularly susceptible to. Further, the personalized proactive protective action taken provides automated risk mitigation.

Claims

1. A computer-program product comprising a tangible, non-transitory computer readable medium containing computer program code comprising:

a threat personalization application for creating, on a host computer system of a user, a user'"'"'s security risk profile for a user, wherein said user is a human user of said host computer system;

said user'"'"'s security risk profile is specific to said user; and

said user'"'"'s security risk profile comprises;

building said user'"'"'s security risk profile from a user'"'"'s behavior profile and a user'"'"'s system profile, wherein said user'"'"'s behavior profile is a personalized behavior of said user on said host computer system; and

said user'"'"'s system profile is a profile of a personalized system of said user on said host computer system;

said threat personalization application further for creating a personalized threat profile for a threat with respect to information on said host computer system of a user;

said threat personalization application further for determining whether there is a correlation between said user'"'"'s security risk profile and said personalized threat profile; and

said threat personalization application further for issuing a personalized alert to said user based on an outcome of said determining whether there is correlation,

wherein upon said threat being detected, said personalized alert is a personalized reactive alert;

and upon said threat not being detected, said personalized alert is a personalized proactive alert;

wherein said user'"'"'s behavior profile is characterized by at least one attribute selected from the group comprising of;

(1) accounts and memberships of said user;

(2) online activities of said user;

(3) network behavior of said user;

(4) use of external devices by said user; and

(5) update behavior of said user;

wherein said user'"'"'s system profile is characterized by at least one attribute selected from the group comprising of;

     1) sensitive applications;

(2) high-risk applications;

(3) valuable data/files; and

(4) system and application modification frequency.

2. The computer-program product of claim 1 wherein said personalized threat profile of said threat includes metadata content that details at least one attribute of said threat, said at least one attribute being selected from the group consisting of:

(1) propagation vectors of said threat;

(2) targeted accounts of said threat;

(3) targeted locations/applications of said threat;

(4) targeted data of said threat;

(5) geographic vicinity of said threat;

(6) exploited vulnerabilities of said threat;

(7) update/install activity of said threat; and

(8) denial of service capabilities and targets of said threat.

3. The computer-program product of claim 1 wherein said threat personalization application is further for taking personalized proactive protective action.

4. The computer-program product of claim 1 wherein said creating a personalized threat profile for a threat comprises retrieving said personalized threat profile from an update server.

5. The computer-program product of claim 4 wherein said threat personalization application is further for retrieving a threat protection profile for said threat, said threat protection profile for detecting said threat on said host computer system.

6. The computer-program product of claim 5 wherein said personalized reactive alert informs said user of data said threat may have compromised.

7. The computer-program product of claim 5 wherein said personalized proactive alert informs said user that said host computer system is particularly susceptible to said threat.

8. The computer-program product of claim 5 wherein said personalized proactive alert informs said user of specific action that should be taken to minimize the susceptibility to said threat.

9. The computer-program product of claim 5 wherein said personalized proactive alert informs said user of risky behavior to be avoided to minimize the susceptibility to said threat.

10. The computer-program product of claim 1 wherein said threat personalization application is further for creating personalized threat profiles for threats comprising said creating a personalized threat profile for a threat.

11. The computer-program product of claim 10 wherein said threat personalization application is further for creating threat protection profiles for said threats.

12. A computer system comprising:

a memory having stored therein a threat personalization application; and

a processor coupled to said memory, wherein execution of said threat personalization application generates a method comprising;

creating, on a host computer system of a user, a user'"'"'s security risk profile for a user,

wherein said user is a human user of said host computer system;

said user'"'"'s security risk profile is specific to said user; and

said user'"'"'s security risk profile comprises;

building said user'"'"'s security risk profile from a user'"'"'s behavior profile and a user'"'"'s system profile,

 

wherein said user'"'"'s behavior profile is a personalized behavior of said user on said host computer system of a user; and

 

said user'"'"'s system profile is a profile of a personalized system of said user on said host computer system;

creating a personalized threat profile for a threat with respect to information on said host computer system of a user;

determining whether there is a correlation between said user'"'"'s security risk profile and said personalized threat profile; and

issuing a personalized alert to said user based on an outcome of said determining whether there is correlation,

wherein upon said threat being detected, said personalized alert is a personalized reactive alert; and

upon said threat not being detected, said personalized alert is a personalized proactive alert;

wherein said user'"'"'s behavior profile is characterized by at least one attribute selected from the group comprising of;

(1) accounts and memberships of said user;

(2) online activities of said user;

(3) network behavior of said user;

(4) use of external devices by said user; and

(5) update behavior of said user;

wherein said user'"'"'s system profile is characterized by at least one attribute selected from the group comprising of;

     1) sensitive applications;

(2) high-risk applications;

(3) valuable data/files; and

(4) system and application modification frequency.