# US 11,444,951 B1 · Reducing false detection of anomalous user behavior on a computer network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,951 B1
- Document ID: US11444951B1
- Status: Granted
- Kind: B1
- Application number: 17/326,253
- Filed: 2021-05-20
- Granted: 2022-09-13
- Earliest claimed: 2021-05-20
- Assignees: Netskope, Inc.
- Applicants: Netskope, Inc.
- Inventors: Dipak Patil; Yi Zhang; Yihua Liao; Prathamesh Deshpande; Yongxin Wang; Siying Yang
- Web page: https://patentgrep.com/patent/US11444951B1

## CPC

- H04L 63/104: {Grouping of entities}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/105: {Multiple levels of security}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The disclosed technology teaches a method of reducing false detection of anomalous user behavior on a computer network, including forming groups from identity and access management (IAM) properties and assigning the users into initially assigned groups based on respective IAM properties, and recording individual user behavior in a statistical profile, including application usage frequency. The method also includes dynamically assigning a user with a realigned group, different from the initial assigned group, based on comparing the recorded user behavior, with user behavior in statistical profiles of the users in the groups, evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group. The method utilizes common app usage for forming the groups, in some cases. Further, evaluating anomalous events includes evaluating deviations of the events among ongoing behavior of the individual user based from the individual's statistical profile.

## Claims

### Claim 1

A method of reducing false detection of anomalous user behavior on a computer network, including:
actions of,
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initially assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group; and
wherein said actions are enabled via a cloud-based security system, said cloud-based security system being implemented as computer readable instructions being stored within a non-transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU).

### Claim 2 (depends on 1)

The method of claim 1, wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.

### Claim 3 (depends on 2)

The method of claim 2, wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.

### Claim 4 (depends on 1)

The method of claim 1, wherein three-quarters of the groups formed have 30 to 500 users per group.

### Claim 5 (depends on 1)

The method of claim 1, wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.

### Claim 6 (depends on 1)

The method of claim 1, wherein the IAM is active directory (abbreviated AD).

### Claim 7 (depends on 1)

The method of claim 1, wherein the IAM is open lightweight directory access protocol (abbreviated LDAP).

### Claim 8

A tangible non-transitory computer readable storage medium, including program instructions loaded into memory that, when executed on processors, cause the processors to implement a method of reducing false detection of anomalous user behavior on a computer network, including:
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.

### Claim 9 (depends on 8)

The tangible non-transitory computer readable storage medium of claim 8, wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.

### Claim 10 (depends on 9)

The tangible non-transitory computer readable storage medium of claim 9, wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.

### Claim 11 (depends on 8)

The tangible non-transitory computer readable storage medium of claim 8, wherein three-quarters of the groups formed have 30 to 500 users per group.

### Claim 12 (depends on 8)

The tangible non-transitory computer readable storage medium of claim 8, wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.

### Claim 13 (depends on 8)

The tangible non-transitory computer readable storage medium of claim 8, wherein the IAM is active directory (abbreviated AD).

### Claim 14 (depends on 8)

The tangible non-transitory computer readable storage medium of claim 8, wherein the IAM is open lightweight directory access protocol (abbreviated LDAP).

### Claim 15

A device for reducing false detection of anomalous user behavior on a computer network, the device including a processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to implement a process that includes:
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.

### Claim 16 (depends on 15)

The device of claim 15, wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.

### Claim 17 (depends on 16)

The device of claim 16, wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.

### Claim 18 (depends on 15)

The device of claim 15, wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.

### Claim 19 (depends on 15)

The device of claim 15, wherein the IAM is active directory (abbreviated AD).

### Claim 20 (depends on 15)

The device of claim 15, wherein the IAM is lightweight directory access protocol (abbreviated LDAP).