Reduction of data transmissions based on end-user content

A computer system configured to limit data transmissions from a computer to a server, the computer system comprising:

• a computer comprising a processor and memory;
• a server;
• a communications network that enables the server and the computer to communicate with one another;
• and
• an agent on the computer, wherein the agent is configured by virtue of the processor executing computer-readable instructions stored in the memory, to:
• receive an indication that a recent user activity has occurred at the computer, wherein the indication comprises data relevant to user's context when the user activity occurred, wherein the data relevant to the user's context when the user activity occurred comprises an identification of one, and only one, visual element on a display screen of the computer that was in-focus during the recent user activity or that came into focus as a result of the recent user activity, wherein the in-focus visual element was the visual element on the display screen that had been selected at the time of the recent user activity or that became selected as a result of the recent user activity, such that text entered at a keyboard of the computer or pasted from the computer's clipboard would have been sent to the in-focus visual element;
• determine whether the data relevant to the user's context when the user activity occurred indicates that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity was different than an in-focus visual element associated with an immediately prior user activity, indicating a change in user context relative to the user activity at the computer immediately prior to the recent user activity;
• transmit data relevant to the recent user activity from the computer to the server via the communications network or not transmitting the data relevant to the recent user activity depending on an outcome of the determination;
• transmit the data relevant to the recent user activity, from the computer to the remote network destination, in response to the agent determining that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity is different than an in-focus visual element associated with an immediately prior user activity, but not transmitting the data relevant to the recent user activity, from the computer to the remote network destination, if the agent determines that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity is not different than an in-focus visual element associated with an immediately prior user activity;
• store, in cache, the data relevant to user context during the immediately prior user activity;
• replace the data stored in cache with the data relevant to the recent user activity in response to the agent determining that there was not a change in user context;
• and
• transmit the data in cache and the data relevant to the recent user activity, from the computer to the remote network destination, in response to the agent determining that there was a change in user context,
• wherein determining whether there has been a change in user context comprises:
• calculating a first hash value based on data relevant to user context during the user activity immediately prior to the recent user activity;
• and
• calculating a second hash value based on the data relevant to user context during the recent user activity;
• and
• comparing the first hash value to the second hash value,
• concluding, based on the comparison, whether user context has changed, wherein the first hash value and the second hash value are calculated using the same hash function, and wherein available inputs for the first hash function are identical to available inputs for the second hash function.

A non-transitory computer-readable medium storing computer-readable instructions that, when executed by a processor of a computer, cause the processor limit transmissions to a server by:

• receiving an indication that a recent user activity has occurred at the computer, wherein the indication comprises data relevant to user's context when the user activity occurred, wherein the data relevant to the user's context when the user activity occurred comprises an identification of one, and only one, visual element on a display screen of the computer that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity, wherein the in-focus visual element is the visual element on the display screen that had been selected at the time of the recent user activity or that became selected as a result of the recent user activity, such that text entered at a keyboard of the computer or pasted from the computer's clipboard would have been sent to the in-focus visual element;
• determining whether the data relevant to the user's context when the user activity occurred indicates that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity was different than an in-focus visual element associated with an immediately prior user activity, indicating a change in user context relative to the user activity at the computer immediately prior to the recent user activity;
• transmitting data relevant to the recent user activity from the computer to the remote network destination or not transmitting the data relevant to the recent user activity from the computer to the remote network destination depending on an outcome of the determination;
• transmitting the data relevant to the recent user activity, from the computer to the remote network destination, in response to the agent determining that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity is different than an in-focus visual element associated with an immediately prior user activity, but not transmitting the data relevant to the recent user activity, from the computer to the remote network destination, if the agent determines that the visual element that was in-focus during the recent user activity or that became in-focus as a result of the recent user activity is not different than an in-focus visual element associated with an immediately prior user activity;
• storing, in cache, the data relevant to user context during the immediately prior user activity;
• replacing the data stored in cache with the data relevant to the recent user activity in response to the agent determining that there was not a change in user context;
• and
• transmitting the data in cache and the data relevant to the recent user activity, from the computer to the remote network destination, in response to the agent determining that there was a change in user context,
• wherein determining whether there has been a change in user context comprises:
• calculating a first hash value based on data relevant to user context during the user activity immediately prior to the recent user activity;
• and
• calculating a second hash value based on the data relevant to user context during the recent user activity;
• comparing the first hash value to the second hash value, and
• concluding, based on the comparison, whether user context has changed, wherein the first hash value and the second hash value are calculated using the same hash function, and wherein available inputs for the first hash function are identical to available inputs for the second hash function.

A computer-based method of regulating data transmissions in a computer-based Insider Threat Monitoring (ITM) system from an agent deployed on an endpoint device of a computer network to a remote server for data processing across the computer network, the computer-based method comprising:

• receiving a first indication, at the agent on the endpoint device, that a first user activity caused by a human user has occurred at the endpoint device, wherein the first indication of the first user activity comprises a first set of user activity data that identifies one, and only one, visual element on a display screen of the endpoint device that was in-focus during the first user activity or that became in-focus in response to the first user activity, wherein the in-focus visual element is the visual element on the display screen that had been selected at the time of the recent user activity or that became selected as a result of the recent user activity, such that text entered at a keyboard of the computer or pasted from the computer's clipboard would have been sent to the in-focus visual element;
• receiving a second indication, at the agent on the endpoint device, that a second user activity has occurred at the endpoint device, wherein the second indication of the second user activity comprises a second set of user activity data that identifies which visual element on the display screen of the endpoint device was in-focus during the second user activity or that became in-focus in response to the second user activity;
• calculating a first hash value at the agent by applying a first hash function to the first set of user activity data associated with the first user activity;
• calculating a second hash value at the agent by applying the first hash function to the second set of user activity data associated with the second user activity;
• comparing at the agent the first hash value to the second hash value;
• determining at the agent whether the visual element on the display screen of the endpoint device that was in-focus during the second user activity or that became in-focus in response to the second user activity matches the visual element on the display screen of the endpoint device that was in-focus during the first user activity or that became in-focus in response to the first user activity, based on the comparison;
• transmitting data in the second set of user activity data from the endpoint device to the remote server in response to the agent determining, based on the comparison, that the visual element on the display screen of the endpoint device that was in-focus at the time of the second user activity or that became in-focus in response to the second user activity did not match the visual element on the display screen of the endpoint device that was in-focus at the time of the first activity or that became in-focus in response to the first user activity, but
• not transmitting the data from the second set of user activity data from the endpoint device to the remote server in response to the agent determining, based on the comparison, that the that the visual element on the graphical user interface of the endpoint device that was selected at the time of or by the second user activity matches the visual element on the graphical user interface of the endpoint device that was selected at the time of or by the first user activity.

A computer-based method of regulating data transmissions in a computer-based Insider Threat Monitoring (ITM) system from an agent deployed on an endpoint device of a computer network to a remote server for data processing across the computer network, the computer-based method comprising:

• receiving a first indication, at the agent on the endpoint device, that a first user activity caused by a human user has occurred at the endpoint device, wherein the first indication of the first user activity comprises a first set of user activity data that identifies which one, and only one, visual element on a display screen of the endpoint device was in focus during or came into focus in response to the first user activity;
• saving the first set of user activity data in a cache;
• receiving a second indication, at the agent on the endpoint device, that a second user activity has occurred at the endpoint device, wherein the second indication of the second user activity comprises a second set of user activity data that identifies which visual element on the display screen of the endpoint device was in focus during or came into focus in response to the second user activity;
• calculating a first hash value at the agent by applying a first hash function to the first set of user activity data associated with the first user activity;
• calculating a second hash value at the agent by applying the first hash function to the second set of user activity data associated with the second user activity;
• comparing at the agent the first hash value to the second hash value;
• determining at the agent whether the visual element on the display screen of the endpoint device that was in focus during or came into focus in response to the second user activity matches the visual element on the display screen of the endpoint device that was selected during or became selected by the first user activity based on the comparison,
• wherein:
• if the agent determines, based on the comparison, that the visual element on the display screen of the endpoint device that was in focus during or came into focus in response to the second user activity matches the visual element on the display screen of the endpoint device that was selected during or became selected by the first user activity then:
• deleting the first set of user activity data from the cache;
• storing the second set of user activity data in the cache, and
• not transmitting the first set of user activity data or the second set of user activity data to the remote server;
• and
• if the agent determines, based on the comparison, that the visual element on the display screen of the endpoint device that was in focus during or came into focus in response to the second user activity did not match the visual element on the display screen of the endpoint device that was selected during or became selected by the first user activity then:
• transmitting the first set of user activity data from the cache to the remote server;
• and
• transmitting the second set of user activity data to the remote server.

A computer-based method of regulating data transmissions in a computer-based Insider Threat Monitoring (ITM) system from an agent deployed on an endpoint device of a computer network to a remote server for data processing across the computer network, the computer-based method comprising:

• receiving a first indication, at the agent on the endpoint device, that a first user activity caused by a human user has occurred at the endpoint device, wherein the first indication of the first user activity comprises a first set of user activity data that identifies which one, and only one, visual element on a display screen of the endpoint device was in focus during the first user activity or came into focus in response to the first user activity;
• determining at the agent whether any of other user activities occurred during a current monitoring session prior to the first user activity;
• transmitting the first set of user activity data from the endpoint device to the remote server in response to the agent determining that no other user activities have occurred during the current monitoring session prior to the first user activity;
• receiving a second indication, at the agent on the endpoint device, that a second user activity has occurred at the endpoint device, wherein the second indication of the second user activity comprises a second set of user activity data that identifies which visual element on the display screen of the endpoint device was in focus during the second user activity or came into focus in response to the second user activity;
• determining at the agent whether any of other user activities occurred during the current monitoring session prior to the second user activity;
• saving the second set of user activity data in a cache in response to the agent determining that another user activity has occurred during the current monitoring session prior to the second user activity;
• receiving a third indication, at the agent on the endpoint device, that a third user activity has occurred at the endpoint device, wherein the third indication of the third user activity comprises a third set of user activity data that identifies which visual element on the display screen of the endpoint device was in focus during the third user activity or came into focus in response to the third user activity;
• calculating a first hash value at the agent by applying a first hash function to the second set of user activity data associated with the second user activity;
• calculating a second hash value at the agent by applying the first hash function to the third set of user activity data associated with the third user activity;
• comparing at the agent the first hash value to the second hash value;
• determining at the agent, based on the comparison, whether the visual element on the display screen of the endpoint device that was in focus during the third user activity or came into focus in response to the third user activity matches the visual element on the display screen of the endpoint device that was in focus during the second user activity or came into focus in response to the second user activity;
• wherein:
• if the agent determines, based on the comparison, that the visual element on the display screen of the endpoint device that was in focus during the third user activity or came into focus in response to the third user activity matched the visual element on the display screen of the endpoint device that was in focus during the second user activity or came into focus during the second user activity then:
• deleting the second set of user activity data from the cache;
• storing the third set of user activity data in the cache, and
• not transmitting the second set of user activity data or the third set of user activity data to the remote server;
• and
• if the agent determines, based on the comparison, that the visual element on the display screen of the endpoint device that was in focus during the third user activity or came into focus in response to the third user activity did not match the visual element on the display screen of the endpoint device that was in focus during the second user activity or came into focus in response to the second user activity then:
• transmitting the second set of user activity data from the cache to the remote server;
• transmitting the third set of user activity data to the remote server;
• and
• clearing the cache.