# US 11,308,205 B2 · Security tool for preventing internal data breaches

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,308,205 B2
- Document ID: US11308205B2
- Status: Granted
- Kind: B2
- Application number: 16/685,502
- Filed: 2019-11-15
- Published: 2021-05-20
- Granted: 2022-04-19
- Earliest claimed: 2019-11-15
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Prakash Koshti; Manan Rastogi; Ravi Shankar Penjendra
- Web page: https://patentgrep.com/patent/US11308205B2

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 16/24535: {of sub-queries or views}
- G06F 16/285: {Clustering or classification}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A security tool analyzes database queries of internal users to determine if these users accessed information in a manner that deviates from established and/or expected access patterns. The security tool can also analyze the behavior of a group of internal users to determine whether that behavior deviates from expected access patterns. The security tool then determines security risks corresponding to the users' access. If any of the security risks exceeds a threshold, then the security tool takes remedial action (e.g., preventing one or more users from accessing information). In this manner, internal data breaches can be detected and prevented. Additionally, in certain embodiments, an internal data breach can be prevented before the internal data breach even occurs.

## Claims

### Claim 1

An apparatus comprising:
a memory configured to store a plurality of clusters, each cluster of the plurality of clusters corresponding to an access pattern for a database; and
a hardware processor communicatively coupled to the memory, the hardware processor configured to:
decompose a plurality of queries issued against the database by a plurality of users to determine a first set of queries issued by a first user of the plurality of users and a second set of queries issued by a second user of the plurality of users;
determine, from the first set of queries, a first set of columns in the database accessed by the first user as a result of issuing the first set of queries;
determine, from the second set of queries, a second set of columns in the database accessed by the second user as a result of issuing the second set of queries;
assign, based at least in part on the first set of columns, the first user to a cluster of the plurality of clusters;
assign, based at least in part on the second set of columns, the second user to the cluster of the plurality of clusters;
determine, based at least in part on the assignment of the first and second users to the cluster, that a first security risk corresponding to the first user accessing the first set of columns is below a threshold;
determine, based at least in part on the assignment of the first and second users to the cluster, that a second security risk corresponding to the second user accessing the second set of columns is below the threshold;
determine, based at least in part on the assignment of the first and second users to the cluster, that a third security risk corresponding to the first user accessing the first set of columns and the second user accessing the second set of columns exceeds the threshold; and
in response to determining that the third risk exceeds the threshold, prevent the first user from accessing the first set of columns and the second user from accessing the second set of columns.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to:
determine a first set of times when the first user issued the first set of queries; and
determine a second set of times when the second user issued the second set of queries, the determination that the third security risk exceeds the threshold is further based on the first of times and the second set of times.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to update the plurality of access patterns based at least in part on the third security risk exceeding a second threshold.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to:
assign, to the first user, a first error margin, the determination whether the first security risk exceeds the first threshold is further based on the first error margin; and
update the first error margin based at least in part on the determination that the third security risk exceeds the threshold.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to communicate an alert to an administrator in response to the determination that the third security risk exceeds the threshold.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to determine that the first user accessed a first column of the first set of columns before the first user accessed a second column of the first set of columns, assigning the first user to the cluster is further based on the determination that the first user accessed the first column before the second column.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the hardware processor is further configured to determine that the first user accessed a first column of the first set of columns before the second user accessed a second column of the second set of columns, assigning the first user to the cluster and the second user to the cluster is further based on the determination that the first user accessed the first column before the second user accessed the second column.

### Claim 8

A method comprising:
storing, by a memory, a plurality of clusters, each cluster of the plurality of clusters corresponding to an access pattern for a database;
decomposing, by a hardware processor communicatively coupled to the memory, a plurality of queries issued against the database by a plurality of users to determine a first set of queries issued by a first user of the plurality of users and a second set of queries issued by a second user of the plurality of users;
determining, by the processor, from the first set of queries, a first set of columns in the database accessed by the first user as a result of issuing the first set of queries;
determining, by the processor, from the second set of queries, a second set of columns in the database accessed by the second user as a result of issuing the second set of queries;
assigning, by the processor, based at least in part on the first set of columns, the first user to a cluster of the plurality of clusters;
assigning, by the processor, based at least in part on the second set of columns, the second user to the cluster of the plurality of clusters;
determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a first security risk corresponding to the first user accessing the first set of columns is below a threshold;
determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a second security risk corresponding to the second user accessing the second set of columns is below the threshold;
determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a third security risk corresponding to the first user accessing the first set of columns and the second user accessing the second set of columns exceeds the threshold; and
in response to determining that the third risk exceeds the threshold, preventing, by the processor, the first user from accessing the first set of columns and the second user from accessing the second set of columns.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
determining, by the processor, a first set of times when the first user issued the first set of queries; and
determining, by the processor, a second set of times when the second user issued the second set of queries, the determination that the third security risk exceeds the threshold is further based on the first of times and the second set of times.

### Claim 10 (depends on 8)

The method of claim 8, further comprising updating, by the processor, the plurality of access patterns based at least in part on the third security risk exceeding a second threshold.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
assigning, by the processor, to the first user, a first error margin, the determination whether the first security risk exceeds the first threshold is further based on the first error margin; and
updating, by the processor, the first error margin based at least in part on the determination that the third security risk exceeds the threshold.

### Claim 12 (depends on 8)

The method of claim 8, further comprising communicating, by the processor, an alert to an administrator in response to the determination that the third security risk exceeds the threshold.

### Claim 13 (depends on 8)

The method of claim 8, further comprising determining, by the processor, that the first user accessed a first column of the first set of columns before the first user accessed a second column of the first set of columns, assigning the first user to the cluster is further based on the determination that the first user accessed the first column before the second column.

### Claim 14 (depends on 8)

The method of claim 8, further comprising determining, by the processor, that the first user accessed a first column of the first set of columns before the second user accessed a second column of the second set of columns, assigning the first user to the cluster and the second user to the cluster is further based on the determination that the first user accessed the first column before the second user accessed the second column.

### Claim 15

A system comprising:
a database configured to store a plurality of columns that form a plurality of tables; and
a security tool configured to:
store a plurality of clusters, each cluster of the plurality of clusters corresponding to an access pattern for the database;
decompose a plurality of queries issued against the database by a plurality of users to determine a first set of queries issued by a first user of the plurality of users and a second set of queries issued by a second user of the plurality of users;
determine, from the first set of queries, a first set of columns of the plurality of columns in the database accessed by the first user as a result of issuing the first set of queries;
determine, from the second set of queries, a second set of columns of the plurality of columns in the database accessed by the second user as a result of issuing the second set of queries;
assign, based at least in part on the first set of columns, the first user to a cluster of the plurality of clusters;
assign, based at least in part on the second set of columns, the second user to the cluster of the plurality of clusters;
determine, based at least in part on the assignment of the first and second users to the cluster, that a first security risk corresponding to the first user accessing the first set of columns is below a threshold;
determine, based at least in part on the assignment of the first and second users to the cluster, that a second security risk corresponding to the second user accessing the second set of columns is below the threshold;
determine, based at least in part on the assignment of the first and second users to the cluster, that a third security risk corresponding to the first user accessing the first set of columns and the second user accessing the second set of columns exceeds the threshold; and
in response to determining that the third risk exceeds the threshold, prevent the first user from accessing the first set of columns and the second user from accessing the second set of columns.

### Claim 16 (depends on 15)

The system of claim 15, wherein the security tool is further configured to:
determine a first set of times when the first user issued the first set of queries; and
determine a second set of times when the second user issued the second set of queries, the determination that the third security risk exceeds the threshold is further based on the first of times and the second set of times.

### Claim 17 (depends on 15)

The system of claim 15, wherein the security tool is further configured to update the plurality of access patterns based at least in part on the third security risk exceeding a second threshold.

### Claim 18 (depends on 15)

The system of claim 15, wherein the security tool is further configured to:
assign, to the first user, a first error margin, the determination whether the first security risk exceeds the first threshold is further based on the first error margin; and
update the first error margin based at least in part on the determination that the third security risk exceeds the threshold.

### Claim 19 (depends on 15)

The system of claim 15, wherein the security tool is further configured to determine that the first user accessed a first column of the first set of columns before the first user accessed a second column of the first set of columns, assigning the first user to the cluster is further based on the determination that the first user accessed the first column before the second column.

### Claim 20 (depends on 15)

The system of claim 15, wherein the security tool is further configured to determine that the first user accessed a first column of the first set of columns before the second user accessed a second column of the second set of columns, assigning the first user to the cluster and the second user to the cluster is further based on the determination that the first user accessed the first column before the second user accessed the second column.