# US 11,443,035 B2 · Behavioral user security policy

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,035 B2
- Document ID: US11443035B2
- Status: Granted
- Kind: B2
- Application number: 16/382,349
- Filed: 2019-04-12
- Published: 2020-10-15
- Granted: 2022-09-13
- Earliest claimed: 2019-04-12
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Nitin Chhabra; Prashanth Palasamudram Ramagopal; Ghanashyam Satpathy; Chakradhar Kotamraju; Rajat Saxena
- Web page: https://patentgrep.com/patent/US11443035B2

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06N 20/00: Machine learning
- H04L 63/0421: {Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/306: User profiles
- G06F 2221/034: Test or assess a computer or a system
- H04L 2463/144: Detection or countermeasures against botnets
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

There is disclosed in one example a computing apparatus, including: a hardware platform including at least a processor and a memory; and a security agent including instructions encoded in the memory to instruct the processor to: monitor a user's operation of the computing apparatus over time, including determining whether a selected behavior is a security risk; provide a risk analysis of the user's operation based at least in part on the monitoring; select a scan sensitivity based at least in part on the risk analysis; and scan, with the selected sensitivity, one or more objects on the computing apparatus to determine if the one or more objects are a threat.

## Claims

### Claim 1

A computing apparatus, comprising:
a hardware platform including at least a processor and a memory; and
a security agent comprising instructions encoded in the memory to instruct the processor to:
monitor a human user's operation of the computing apparatus over time, comprising determining whether a selected interaction with the computing apparatus is a security risk;
provide a risk analysis of the human user's operation based at least in part on the monitoring, comprising computing a quantitative risk score, and comparing the quantitative risk score to a threshold to select a risk level for the human user;
select a scan sensitivity for a fuzzy match malware scan based at least in part on the risk level, wherein the scan sensitivity balances threat detection with false positives; and
scan, with the selected scan sensitivity, one or more objects on the computing apparatus to determine whether the one or more objects are a threat.

### Claim 2 (depends on 1)

The computing apparatus of claim 1, wherein the selected sensitivity is selected from a spectrum having a first terminus with high probability of detecting a threat and corresponding high probability of false positives, and a second terminus with relatively lower probability of detecting a threat and relatively lower probability of false positives.

### Claim 3 (depends on 1)

The computing apparatus of claim 1, wherein selecting a scan sensitivity comprises selecting a sensitivity based at least in part on an enumerated list of sensitivities.

### Claim 4 (depends on 1)

The computing apparatus of claim 1, wherein providing the risk analysis comprises computing an integer or floating-point risk analysis score.

### Claim 5 (depends on 4)

The computing apparatus of claim 4, wherein providing the risk analysis comprises comparing the integer or floating-point risk analysis to one or more risk thresholds.

### Claim 6 (depends on 1)

The computing apparatus of claim 1, wherein providing the risk analysis comprises applying machine learning to observed user behavior.

### Claim 7 (depends on 1)

The computing apparatus of claim 1, wherein providing the risk analysis comprises applying heuristic analysis to observed user behavior.

### Claim 8 (depends on 1)

The computing apparatus of claim 1, further comprising a network interface, wherein the security agent is further configured to provide anonymized risk analysis to a central authority via the network interface.

### Claim 9 (depends on 1)

The computing apparatus of claim 1, wherein the security agent is configured to compute a plurality of profiles for the human user, and to select a first scan sensitivity according to a first profile and a second scan sensitivity according to a second profile.

### Claim 10 (depends on 9)

The computing apparatus of claim 9, wherein the security agent is configured to select, for a real-time scan, a sensitivity associated with an instant user profile.

### Claim 11 (depends on 9)

The computing apparatus of claim 9, wherein the security agent is configured to select, for a scheduled scan, a most sensitive scan sensitivity based at least in part on a plurality of scan sensitivities associated with a plurality of user profiles.

### Claim 12 (depends on 1)

The computing apparatus of claim 1, wherein monitoring the user's operation of the computing apparatus over time comprises monitoring one or more security factors.

### Claim 13 (depends on 12)

The computing apparatus of claim 12, wherein the one or more security factors is/are selected from the group consisting of websites visited, reputation of websites visited, content downloaded, reputation of content downloaded, stored cookies, user security settings, and use of browser incognito mode.

### Claim 14

One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to:
monitor a security factor for a human user, the security factor selected from websites visited, reputation of websites visited, content downloaded, reputation of content downloaded, stored cookies, user security settings, and use of browser incognito mode;
based on the security factor, compute a risk factor of the human user's operation of a computer comprising computing a quantitative risk score, and comparing the quantitative risk score to a threshold to select a risk factor for the human user;
and
adjust a sensitivity of a security scan of a computer according to the risk factor, wherein the security scan comprises a fuzzy hash, and the sensitivity comprises a detection threshold of the fuzzy hash that balances threat detection with false positives.

### Claim 15 (depends on 14)

The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the security scan is a file system scan.

### Claim 16 (depends on 14)

The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the security scan is a scheduled file system scan.

### Claim 17 (depends on 14)

The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the security scan is a real-time security scan.

### Claim 18

A computer-implemented method of providing a behavioral user security policy, comprising:
programmatically observing a human user's network behavior over time;
based on the observing, computing a risk factor of the user's operation of a computer, the risk factor based on an observed user behavior affecting network vulnerability wherein computing the risk factor comprises computing a quantitative risk score, and comparing the quantitative risk score to a threshold to select a risk factor for the human user;
and
adjusting a detection threshold of a security scan according to the risk factor, wherein the security scan comprises a fuzzy hash and the detection threshold comprises a sensitivity of the fuzzy hash, wherein the sensitivity balances threat detection with false positives.

### Claim 19 (depends on 18)

The method of claim 18, wherein the security scan is a file system scan.

### Claim 20 (depends on 18)

The method of claim 18, wherein the detection threshold is selected from a spectrum having a first terminus with high probability of detecting a threat and corresponding high probability of false positives, and a second terminus with relatively lower probability of detecting a threat and relatively lower probability of false positives.