# US 11,122,143 B2 · Comparison of behavioral populations for security and compliance monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,143 B2 - Document ID: US11122143B2 - Status: Granted - Kind: B2 - Application number: 16/579,216 - Filed: 2019-09-23 - Published: 2020-02-13 - Granted: 2021-09-14 - Earliest claimed: 2016-02-10 - Assignees: Curtail, Inc. - Applicants: Curtail, Inc. - Inventors: Robert F. Ross - Web page: https://patentgrep.com/patent/US11122143B2 ## CPC - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 67/306: User profiles - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0886: {Fully automatic configuration} - H04L 41/142: using statistical or mathematical methods - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques to compare behavioral populations for security and compliance monitoring are disclosed. In various embodiments, for each of a plurality of implementations of a computing resource a corresponding behavioral profile data is store, which includes for each of a plurality of observed behavioral patterns observed to have been exhibited by the implementation a corresponding summary representation of one or more characteristic traits of the behavioral pattern. At least portions of said behavioral profile data associated with one or more implementations included in a cohort comprising a sub-population of said plurality of implementations identified by configuration data as being associated with said cohort is used to determine that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort. ## Claims ### Claim 1 A system, comprising: a memory or other storage device configured to store: for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; and for each of the plurality of implementations of the computing resource a configuration data that includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; and a processor coupled to the memory or other storage device and configured to: receive for each of the plurality of implementations the configuration data; store for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; read and use at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort, based at least in part on comparing observed behavior of other implementations in the specified behavioral cohort to determine the probability the observed behavior would be exhibited by any member of the specified behavioral cohort; and to take responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is further configured to receive observation data associated with observed behavior of implementations included in said plurality of implementations; generate said behavioral profile data based at least in part on said observation data; and store said behavioral profile data in said memory or other storage device. ### Claim 3 (depends on 2) The system of claim 2, wherein the processor is further configured to update said behavioral profiles based at least in part on observation data received subsequently to one or both of creation and last update of said behavioral profiles. ### Claim 4 (depends on 3) The system of claim 3, wherein the processor is configured to accumulate observation data and to perform said update based at least in part on a determination that an update criteria has been met. ### Claim 5 (depends on 1) The system of claim 1, wherein each of said computing resources comprises one or more of a device, a hardware platform, a virtual machine, a container, an application or other software, a configuration, a protocol, a standards-based resource, a physical or logical storage device, a database, and a service. ### Claim 6 (depends on 1) The system of claim 1, wherein said processor is configured to determine that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort at least in part by comparing a behavioral profile of the member implementation, or a portion thereof, to corresponding portions of the respective behavioral profiles of other implementations in the cohort. ### Claim 7 (depends on 1) The system of claim 1, wherein said processor is configured to determine that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort at least in part by computing based on behavioral profile data of the cohort a statistical probability associated with the observed behavior. ### Claim 8 A method, comprising: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort, based at least in part on comparing observed behavior of other implementations in the specified behavioral cohort to determine the probability the observed behavior would be exhibited by any member of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 9 (depends on 8) The method of claim 8, further comprising receiving observation data associated with observed behavior of implementations included in said plurality of implementations; generate said behavioral profile data based at least in part on said observation data; and store said behavioral profile data in said memory or other storage device. ### Claim 10 (depends on 9) The method of claim 9, further comprising updating said behavioral profiles based at least in part on observation data received subsequently to one or both of creation and last update of said behavioral profiles. ### Claim 11 (depends on 10) The method of claim 10, further comprising accumulating observation data and to perform said update based at least in part on a determination that an update criteria has been met. ### Claim 12 (depends on 8) The method of claim 8, wherein each of said computing resources comprises one or more of a device, a hardware platform, a virtual machine, a container, an application or other software, a configuration, a protocol, a standards-based resource, a physical or logical storage device, a database, and a service. ### Claim 13 (depends on 8) The method of claim 8, wherein determining that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort includes comparing a behavioral profile of the member implementation, or a portion thereof, to corresponding portions of the respective behavioral profiles of other implementations in the cohort. ### Claim 14 (depends on 8) The method of claim 8, wherein determining that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort includes computing based on behavioral profile data of the cohort a statistical probability associated with the observed behavior. ### Claim 15 A computer program product embodied in a non-transient computer readable medium and comprising computer instructions for: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort, based at least in part on comparing observed behavior of other implementations in the specified behavioral cohort to determine the probability the observed behavior would be exhibited by any member of the specified behavioral cohort. ### Claim 16 (depends on 15) The computer program product of claim 15, further comprising computer instructions for receiving observation data associated with observed behavior of implementations included in said plurality of implementations; generate said behavioral profile data based at least in part on said observation data; and store said behavioral profile data in said memory or other storage device. ### Claim 17 A system, comprising: a memory or other storage device configured to store: for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; and for each of the plurality of implementations of the computing resource a configuration data that includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations, wherein the behavioral cohort comprises a set of implementations expected to exhibit a same behavioral profile based at least in part on a shared configuration; and a processor coupled to the memory or other storage device and configured to: receive for each of the plurality of implementations the configuration data; store for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; read and use at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and to take responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 18 A method, comprising: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations, wherein the behavioral cohort comprises a set of implementations expected to exhibit a same behavioral profile based at least in part on a shared configuration; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 19 A computer program product embodied in a non-transient computer readable medium and comprising computer instructions for: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations, wherein the behavioral cohort comprises a set of implementations expected to exhibit a same behavioral profile based at least in part on a shared configuration; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 20 A system, comprising: a memory or other storage device configured to store: for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation, wherein each behavioral profile data comprises a summary representation that includes a set of coefficients or other values for each of a plurality of variables, and wherein said summary representation comprises a vector in a multidimensional space; and for each of the plurality of implementations of the computing resource a configuration data that includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; and a processor coupled to the memory or other storage device and configured to: receive for each of the plurality of implementations the configuration data; store for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; read and use at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and to take responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 21 A method, comprising: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation, wherein each behavioral profile data comprises a summary representation that includes a set of coefficients or other values for each of a plurality of variables, and wherein said summary representation comprises a vector in a multidimensional space; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort. ### Claim 22 A computer program product embodied in a non-transient computer readable medium and comprising computer instructions for: receiving for each of a plurality of implementations a configuration data, wherein the configuration data includes an identification of a behavioral cohort comprising a sub-population of said plurality of implementations; storing for each implementation a configuration profile that identifies a behavioral cohort of which that implementation is a member; storing for each of a plurality of implementations of a computing resource a corresponding behavioral profile data that reflects observed behavior of that implementation, wherein each behavioral profile data comprises a summary representation that includes a set of coefficients or other values for each of a plurality of variables, and wherein said summary representation comprises a vector in a multidimensional space; using at least portions of said behavioral profile data associated with one or more implementations included in a specified behavioral cohort to determine that an observed behavior of a member implementation of the specified behavioral cohort deviates from an expected behavior of members of the specified behavioral cohort; and taking responsive action based on the determination that the observed behavior of the member implementation of the specified behavioral cohort deviates from the expected behavior of members of the specified behavioral cohort.