# US 11,451,576 B2 · Investigation of threats using queryable records of behavior

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,576 B2
- Document ID: US11451576B2
- Status: Granted
- Kind: B2
- Application number: 17/200,459
- Filed: 2021-03-12
- Published: 2021-09-16
- Granted: 2022-09-20
- Earliest claimed: 2020-03-12
- Assignees: Abnormal Security Corporation
- Applicants: Abnormal Security Corporation
- Inventors: Jeremy Kao; Kai Jing Jiang; Sanjay Jeyakumar; Yea So Jung; Carlos Daniel Gasperi; Justin Anthony Young
- Web page: https://patentgrep.com/patent/US11451576B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 67/125: involving control of end-device applications over a network
- H04L 67/30: Profiles
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Introduced here are computer programs and computer-implemented techniques for producing records of digital activities that are performed with accounts associated with employees of enterprises. Such an approach ensures that records are created for digital activities that are deemed unsafe and for digital activities that are deemed safe by a threat detection platform. At a high level, more comprehensively recording digital activities not only provides insight into the behavior of individual accounts, but also provides insight into the holistic behavior of employees across multiple accounts. These records may be stored in a searchable datastore to enable expedient and efficient review.

## Claims

### Claim 1

A method, comprising:
obtaining, by a threat detection platform, data that is related to a series of digital activities performed with accounts on a channel through which employees of an enterprise are able to communicate;
parsing, by the threat detection platform, the data to discover an attribute of each digital activity;
determining, by the threat detection platform, a threat posed by each digital activity based on the corresponding attribute;
generating, by the threat detection platform, a record of each digital activity by populating a data structure with (i) the corresponding attribute and (ii) an indication of the threat posed to the enterprise, so as to generate a series of records;
programmatically associating, by the threat detection platform, the series of records with the accounts by appending an identifier to each record that is representative of the corresponding account; and
populating, by the threat detection platform, the series of records into digital profiles that are maintained for the accounts, so as to develop, for each account, a historical summary of all conduct on the channel that provides insight into behavior of each account on the channel over time.

### Claim 2 (depends on 1)

The method of claim 1, wherein said determining comprises:
for each digital activity,
providing, as input, the corresponding attribute to a model that is trained to establish whether the digital activity is indicative of a threat based on past digital activities that were performed on the channel with the corresponding account.

### Claim 3 (depends on 1)

The method of claim 1, wherein said determining comprises:
for each digital activity,
producing a metric that is indicative of the threat posed by the digital activity, and
assigning a threat classification to the digital activity based on the metric.

### Claim 4 (depends on 1)

The method of claim 1, wherein the series of digital activities includes receptions of communications, transmissions of communications, creations of mail filters, occurrences of sign-in events, or any combination thereof.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
receiving, by the threat detection platform, input, provided through a computer program, that is indicative of a query that specifies a criterion; and
searching, by the threat detection platform, the digital profiles to identify at least one record that satisfies the query by having a given attribute that matches the criterion.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
causing, by the threat detection platform, display of an interface by the computer program that specifies the at least one record.

### Claim 7 (depends on 6)

The method of claim 6, wherein the interface permits interaction so as to enable an individual to obtain more information regarding the at least one record.

### Claim 8

A non-transitory medium with instructions stored thereon that, when executed by a processor of a computing device, cause the computing device to perform operations comprising:
receiving input that is indicative of a query for records of digital activities that satisfy a criterion;
accessing a datastore that includes digital profiles for accounts associated with employees of an enterprise,
wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and
wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
searching the datastore to identify at least one record that satisfies the query; and
causing display of an interface that includes information related to the at least one record.

### Claim 9 (depends on 8)

The non-transitory medium of claim 8, wherein each record of the at least one record is determined to satisfy the query by having an attribute that matches the criterion.

### Claim 10 (depends on 8)

The non-transitory medium of claim 8, wherein each record includes at least one of:
(i) a unique identifier,
(ii) a channel identifier,
(iii) a reception date,
(iv) a transmission date,
(v) a source Internet Protocol (IP) address,
(vi) a subject,
(vii) a threat classification,
(viii) a threat type, or
(ix) a remediation status.

### Claim 11 (depends on 8)

The non-transitory medium of claim 8,
wherein each record specifies a threat type of which the corresponding digital activity is representative, and
wherein the threat type is determined based on an output produced by a model to which one or more attributes of the corresponding digital activity are provided as input.

### Claim 12 (depends on 8)

The non-transitory medium of claim 8, wherein the operations further comprise:
enabling an individual to obtain more information regarding threats to the enterprise by interacting with the at least one record through the interface.

### Claim 13 (depends on 8)

The non-transitory medium of claim 8, wherein the operations further comprise:
enabling an individual to filter the at least one record by specifying a second criterion through the interface.

### Claim 14 (depends on 8)

The non-transitory medium of claim 8, wherein the digital profiles are continually updated as digital activities are performed with the accounts, so as to reflect any changes in behavior of the accounts as evidenced through the digital activities that are performed on the channel.

### Claim 15 (depends on 8)

The non-transitory medium of claim 8, wherein records are deleted from the digital profiles upon exceeding a certain age, such that each digital profile only includes records of digital activities occurring over a predetermined interval of time.

### Claim 16

A method for managing a datastore in which digital profiles that are representative of historical models of behavior of accounts are stored, the method comprising:
establishing, via an application programming interface, a connection with a datastore that is associated with a given channel through which employees of an enterprise are able to communicate;
obtaining, in real time via the application programming interface, data associated with a communication transmitted on the given channel to an account that is associated with an employee;
generating a record of the communication by populating a data structure with multiple attributes of the communication; and
populating the record into a digital profile associated with the account,
wherein the digital profile is representative of a historical summary of all conduct on the given channel by the account over an interval of time.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
determining whether the communication is representative of a threat by providing, as input, the multiple attributes to a model that is trained to produce an output that is representative of a threat classification.

### Claim 18 (depends on 16)

The method of claim 16, wherein the multiple attributes include (i) a reception date, (ii) a transmission date, (iii) a subject of the communication, and (iv) another account from which the communication originates.

### Claim 19 (depends on 16)

The method of claim 16, further comprising:
producing, based on the digital profile, a threat feed that includes information related to the record for export to a security product.

### Claim 20

A system comprising:
a processor configured to:
obtain data that is related to a series of digital activities performed with accounts on a channel through which employees of an enterprise are able to communicate;
parse the data to discover an attribute of each digital activity;
determine a threat posed by each digital activity based on the corresponding attribute;
generate a record of each digital activity by populating a data structure with (i) the corresponding attribute and (ii) an indication of the threat posed to the enterprise, so as to generate a series of records;
associate the series of records with the accounts by appending an identifier to each record that is representative of the corresponding account; and
populate the series of records into digital profiles that are maintained for the accounts, so as to develop, for each account, a historical summary of all conduct on the channel that provides insight into behavior of each account on the channel over time; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 21 (depends on 20)

The system of claim 20, wherein said determining comprises: for each digital activity, providing, as input, the corresponding attribute to a model that is trained to establish whether the digital activity is indicative of a threat based on past digital activities that were performed on the channel with the corresponding account.

### Claim 22 (depends on 20)

The system of claim 20, wherein said determining comprises: for each digital activity, producing a metric that is indicative of the threat posed by the digital activity, and assigning a threat classification to the digital activity based on the metric.

### Claim 23 (depends on 20)

The system of claim 20, wherein the series of digital activities includes receptions of communications, transmissions of communications, creations of mail filters, occurrences of sign-in events, or any combination thereof.

### Claim 24 (depends on 20)

The system of claim 20, wherein the processor is further configured to:
receive input, provided through a computer program, that is indicative of a query that specifies a criterion; and
search the digital profiles to identify at least one record that satisfies the query by having a given attribute that matches the criterion.

### Claim 25 (depends on 24)

The system of claim 24, wherein the processor is further configured to cause display of an interface by the computer program that specifies the at least one record.

### Claim 26 (depends on 25)

The system of claim 25, wherein the interface permits interaction so as to enable an individual to obtain more information regarding the at least one record.

### Claim 27

A system, comprising:
a processor configured to:
receive input that is indicative of a query for records of digital activities that satisfy a criterion;
access a datastore that includes digital profiles for accounts associated with employees of an enterprise, wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
search the datastore to identify at least one record that satisfies the query; and
cause display of an interface that includes information related to the at least one record; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 28 (depends on 27)

The system of claim 27, wherein each record of the at least one record is determined to satisfy the query by having an attribute that matches the criterion.

### Claim 29 (depends on 27)

The system of claim 27, wherein each record includes at least one of:
(i) a unique identifier,
(ii) a channel identifier,
(iii) a reception date,
(iv) a transmission date,
(v) a source Internet Protocol (IP) address,
(vi) a subject,
(vii) a threat classification,
(viii) a threat type, or
(ix) a remediation status.

### Claim 30 (depends on 27)

The system of claim 27, wherein each record specifies a threat type of which the corresponding digital activity is representative, and wherein the threat type is determined based on an output produced by a model to which one or more attributes of the corresponding digital activity are provided as input.

### Claim 31 (depends on 27)

The system of claim 27, wherein the processor is further configured to enable an individual to obtain more information regarding threats to the enterprise by interacting with the at least one record through the interface.

### Claim 32 (depends on 27)

The system of claim 27, wherein the processor is further configured to enable an individual to filter the at least one record by specifying a second criterion through the interface.

### Claim 33 (depends on 27)

The system of claim 27, wherein the digital profiles are continually updated as digital activities are performed with the accounts, so as to reflect any changes in behavior of the accounts as evidenced through the digital activities that are performed on the channel.

### Claim 34 (depends on 27)

The system of claim 27, wherein records are deleted from the digital profiles upon exceeding a certain age, such that each digital profile only includes records of digital activities occurring over a predetermined interval of time.

### Claim 35

A method, comprising:
receiving input that is indicative of a query for records of digital activities that satisfy a criterion;
accessing a datastore that includes digital profiles for accounts associated with employees of an enterprise, wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
searching the datastore to identify at least one record that satisfies the query; and
causing display of an interface that includes information related to the at least one record.

### Claim 36 (depends on 35)

The method of claim 35, wherein each record of the at least one record is determined to satisfy the query by having an attribute that matches the criterion.

### Claim 37 (depends on 35)

The method of claim 35, wherein each record includes at least one of:
(i) a unique identifier,
(ii) a channel identifier,
(iii) a reception date,
(iv) a transmission date,
(v) a source Internet Protocol (IP) address,
(vi) a subject,
(vii) a threat classification,
(viii) a threat type, or
(ix) a remediation status.

### Claim 38 (depends on 35)

The method of claim 35, wherein each record specifies a threat type of which the corresponding digital activity is representative, and wherein the threat type is determined based on an output produced by a model to which one or more attributes of the corresponding digital activity are provided as input.

### Claim 39 (depends on 35)

The method of claim 35, further comprising enabling an individual to obtain more information regarding threats to the enterprise by interacting with the at least one record through the interface.

### Claim 40 (depends on 35)

The method of claim 35, further comprising enabling an individual to filter the at least one record by specifying a second criterion through the interface.

### Claim 41 (depends on 35)

The method of claim 35, wherein the digital profiles are continually updated as digital activities are performed with the accounts, so as to reflect any changes in behavior of the accounts as evidenced through the digital activities that are performed on the channel.

### Claim 42 (depends on 35)

The method of claim 35, wherein records are deleted from the digital profiles upon exceeding a certain age, such that each digital profile only includes records of digital activities occurring over a predetermined interval of time.

### Claim 43

A system, comprising:
a processor configured to:
establish, via an application programming interface, a connection with a datastore that is associated with a given channel through which employees of an enterprise are able to communicate;
obtain, in real time via the application programming interface, data associated with a communication transmitted on the given channel to an account that is associated with an employee;
generate a record of the communication by populating a data structure with multiple attributes of the communication; and
populate the record into a digital profile associated with the account, wherein the digital profile is representative of a historical summary of all conduct on the given channel by the account over an interval of time; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 44 (depends on 43)

The system of claim 43, wherein the processor is further configured to determine whether the communication is representative of a threat by providing, as input, the multiple attributes to a model that is trained to produce an output that is representative of a threat classification.

### Claim 45 (depends on 43)

The system of claim 43, wherein the multiple attributes include (i) a reception date, (ii) a transmission date, (iii) a subject of the communication, and (iv) another account from which the communication originates.

### Claim 46 (depends on 43)

The system of claim 43, wherein the processor is further configured to produce, based on the digital profile, a threat feed that includes information related to the record for export to a security product.