US 10,503,906 B2Granted

Determining a risk indicator based on classifying documents using a classifier

AssigneeQuest Software, Inc.

InventorsJake Seigel, Robert MacIntosh

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and techniques for determining and displaying risk indicators are described. A set of event logs occurring in a time interval and associated with a user account retrieving may be retrieved from an event log database. For individual event logs in the set of event logs, a context may be determined. A resource associated with the individual log may have an associated classification. An activity risk associated with the individual event log may be determined based at least in part on the first context and, if applicable, on the associated classification. For individual event logs in the set of event logs, a risk indicator may be determined based at least in part on the activity risk. In some cases, a cumulative risk indicator may be determined for the particular time interval based on the risk indicators associated with the individual event logs.

Claims20

Dependent claims

A computer-implemented method, comprising:

generating a classifier based on a classifier algorithm;
training, using electronic training data, the classifier to classify data within a predetermined accuracy, wherein training the classifier to classify data within the predetermined accuracy comprises:
training the classifier with training data;
classifying, by the classifier, test data to generate classified test data;
determining that the test data is not within the predetermined accuracy based on a comparison of the classified test data with a pre-classified set of test data;
tuning the classifier;
retraining the classifier with the training data;
reclassifying, by the classifier, the test data to generate reclassified test data;
determining that the reclassified test data is within the predetermined accuracy based on a comparison of the reclassified test data with the pre-classified set of test data;
receiving, via a network, a first event log from an agent that is configured to monitor data activities at a data storage, the first event log including information pertaining to a first access to data stored in the data storage by an electronic device associated with a user account;
causing the first event log to be stored in an event log database;
retrieving, from the event log database, a set of event logs associated with a user account, each event log of the set of event logs occurring in a time interval;
selecting the first event log from the set of event logs, the first event log associated with a resource having a classification assigned to the resource by the classifier based at least in part on a taxonomy;
determining a first context associated with the first event log;
determining a first activity risk associated with the first event log based at least in part on the first context;
determining a first risk indicator associated with the user account based at least in part on the first activity risk;
receiving, via the network, a second event log from the agent during the time interval, the second event log including information pertaining to a second access to data stored in the data storage by the electronic device associated with the user account;
determining a second risk indicator associated with the user account based at least in part on the second event log;
and
determining a cumulative risk indicator for the time interval based on the first risk indicator and the second risk indicator.

17 more elements

One or more non-transitory computer-readable media storing instructions that are executable by one or more processors to perform operations comprising:

generate a classifier based on a classifier algorithm;
train, using electronic training data, the classifier to classify data within a predetermined accuracy, wherein the operation to train the classifier to classify data within the predetermined accuracy further comprises:
train the classifier with training data;
classify, by the classifier, test data to generate classified test data;
determine that the test data is not within the predetermined accuracy based on a comparison of the classified test data with a pre-classified set of test data;
tune the classifier;
retrain the classifier with the training data;
reclassify, by the classifier, the test data to generate reclassified test data;
determine that the reclassified test data is within the predetermined accuracy based on a comparison of the reclassified test data with the pre-classified set of test data;
receive, via a network, a first event log from an agent that is configured to monitor data activities at a data storage, the first event log including information pertaining to a first access to data stored in the data storage by an electronic device associated with a user account;
cause the first event log to be stored in an event log database;
retrieve, from the event log database, a set of event logs associated with a user account, each event log of the set of event logs occurring in a time interval;
select the first event log from the set of event logs, the first event log associated with a resource having a classification assigned to the resource by the classifier based at least in part on a taxonomy;
determine a first context associated with the first event log;
determine a first activity risk associated with the first event log based at least in part on the first context;
determine a first risk indicator associated with the user account based at least in part on the first activity risk;
receive, via the network, a second event log from the agent during the time interval, the second event log including information pertaining to a second access to data stored in the data storage by the electronic device associated with the user account;
determine a second risk indicator associated with the user account based at least in part on the second event log;
and
determine a cumulative risk indicator for the time interval based on the first risk indicator and the second risk indicator.

17 more elements

A server, comprising:

one or more processors;
and
one or more non-transitory computer-readable media storing instructions that are executable by the one or more processors to perform operations comprising:
generate a classifier based on a classifier algorithm;
train, using electronic training data, the classifier to classify data within a predetermined accuracy, wherein the operation to train the classifier to classify data within the predetermined accuracy further comprises:
train the classifier with training data;
classify, by the classifier, test data to generate classified test data;
determine that the test data is not within the predetermined accuracy based on a comparison of the classified test data with a pre-classified set of test data;
tune the classifier;
retrain the classifier with the training data;
reclassify, by the classifier, the test data to generate reclassified test data;
determine that the reclassified test data is within the predetermined accuracy based on a comparison of the reclassified test data with the pre-classified set of test data;
receive, via a network, a first event log from an agent that is configured to monitor data activities at a data storage, the first event log including information pertaining to a first access to data stored in the data storage by an electronic device associated with a user account;
cause the first event log to be stored in an event log database;
retrieve, from the event log database, a set of event logs associated with a user account, each event log of the set of event logs occurring in a time interval;
select the first event log from the set of event logs, the first event log associated with a resource having a classification assigned to the resource by the classifier based at least in part on a taxonomy;
determine a first context associated with the first event log;
determine a first activity risk associated with the first event log based at least in part on the first context;
determine a first risk indicator associated with the user account based at least in part on the first activity risk;
receive, via the network, a second event log from the agent during the time interval, the second event log including information pertaining to a second access to data stored in the data storage by the electronic device associated with the user account;
determine a second risk indicator associated with the user account based at least in part on the second event log;
and
determine a cumulative risk indicator for the time interval based on the first risk indicator and the second risk indicator.

20 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/956,464Filed 2 Dec 2015
Published: US 2017/0161503 A18 Jun 2017
Granted: 10 Dec 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection

Family

US 2017/0161503 A1Pre-grant publication · published 8 Jun 2017
US 10,503,906 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key