Back to results
US 10,855,692 B2Granted
Adaptive trust profile endpoint
AssigneeForcepoint LLC
InventorRichard A. Ford
Life of this patent
Estimating the term…
Abstract
A system, method, and computer-readable medium are disclosed for generating an adaptive trust profile via an adaptive trust profile operation. In various embodiments the adaptive trust profile operation includes: monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring at least one of the plurality of electronically-observable actions via a protected endpoint; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; and generating an adaptive trust profile based upon the action of the entity.
Claims17
A computer-implementable method for generating an adaptive trust profile, comprising:
- monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring at least one of the plurality of electronically-observable actions via a protected endpoint, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device, the endpoint agent comprising an adaptive trust profile feature pack, the adaptive trust profile feature pack comprising an event data detector module and an entity behavior detector module, the event data detector module detecting event data resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction, the entity behavior detector module detecting an entity behavior resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction;
- converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity;
- providing the event data and the entity behavior from the endpoint agent to an adaptive trust profile system;
- generating an adaptive trust profile via the adaptive trust profile system based upon the event data and the entity behavior, the adaptive trust profile comprising an inference regarding the entity, the inference regarding the entity being based upon the plurality of actions of the entity;
- and,
- determining, via a security analytics system in combination with the endpoint agent, whether the entity behavior is of analytic utility based upon the inference.
3 more elements
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring at least one of the plurality of electronically-observable actions via a protected endpoint, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device, the endpoint agent comprising an adaptive trust profile feature pack, the adaptive trust profile feature pack comprising an event data detector module and an entity behavior detector module, the event data detector module detecting event data resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction, the entity behavior detector module detecting an entity behavior resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction;
- converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity;
- providing the event data and the entity behavior from the endpoint agent to an adaptive trust profile system;
- generating an adaptive trust profile via the adaptive trust profile system based upon the event data and the entity behavior, the adaptive trust profile comprising an inference regarding the entity, the inference regarding the entity being based upon the plurality of actions of the entity;
- and,
- determining, via a security analytics system in combination with the endpoint agent, whether the entity behavior is of analytic utility based upon the inference.
7 more elements
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring at least one of the plurality of electronically-observable actions via a protected endpoint, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device, the endpoint agent comprising an adaptive trust profile feature pack, the adaptive trust profile feature pack comprising an event data detector module and an entity behavior detector module, the event data detector module detecting event data resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction, the entity behavior detector module detecting an entity behavior resulting from at least one of a user/device interaction, a user/network interaction, a user/resource interaction and a user/user interaction;
- converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity;
- providing the event data and the entity behavior from the endpoint agent to an adaptive trust profile system;
- generating an adaptive trust profile via the adaptive trust profile system based upon the event data and the entity behavior, the adaptive trust profile comprising an inference regarding the entity, the inference regarding the entity being based upon the plurality of actions of the entity;
- and,
- determining, via a security analytics system in combination with the endpoint agent, whether the entity behavior is of analytic utility based upon the inference.
3 more elements
Dependencies are inferred from the claim text.