US 11,611,574 B2Granted

User behavior analytics for insider threat detection

AssigneeCode42 Software, Inc.

InventorsAjaykumar Rajasekharan, Matthew Mills Parker, Daniel L. Sullivan

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor. The anomaly counts for the signals are then weighted and summed to produce a risk score.

Claims21

Dependent claims

A method for detecting inappropriate access of files by an authori ted user of a client computing device, the method comprising:

receiving a first file system element event indicator from an application executing on the client computing device, the first file system element event described by the first file system element event indicator including a first value and a first type, the first value being a number of bytes corresponding to the first file system element event, the first type being a deletion event, copy event, move event, or modification event;
summing the first value with a second value of a second file system element event of the first type to create a summed value, the first file system element event and the second file system element event both received within a first predetermined period of time;
determining a threshold for the summed value, the threshold determined based upon past observations of values of other file system element events of the first type during a past time period, a class of the user within an organization, and a function classification of files corresponding to the file system element events, the past time period prior to the first predetermined period of time;
determining that the summed value exceeds the threshold, and in response, incrementing a first anomaly counter of a first type, the first type of anomaly selected based upon the first type of event;
calculating a count of a number of generated anomaly indicators of the first type;
calculating a risk score based upon the count and a second count corresponding to a number of generated anomaly indicators corresponding to second anomalies of a second type, the first and second anomalies occurring within a second predetermined period of time, the risk score quantifying a calculated risk that the authorized user of the client computing device has engaged in inappropriate access of files;
and
sending the risk score to a second computing device for display on a graphical user interface (GUI).

5 more elements

A system for detecting inappropriate access of files by an authorized user of a client computing device, the system comprising:

a processor:
a memory communicatively coupled to the processor and comprising instructions, which cause the processor to perform operations comprising:
receiving a first file system element event indicator from an application executing on the client computing device, the first file system element event described by the first file system element event indicator including a first value and a first type, the first value being a number of bytes corresponding to the first file system element event, the first type being a deletion event, copy event, move event, or modification event;
summing the first value with a second value of a second file system element event of the first type to create a summed value, the first file system element event and the second file system element event both received within a first predetermined period of time;
determining a threshold for the summed value, the threshold determined based upon past observations of values of other file system element events of the first type during a past time period, a class of the user within an organization. and a function classification of files corresponding to the file system element events, the past time period prior to the first predetermined period of time;
determining that the summed value exceeds the threshold, and in response, incrementing a first anomaly counter of a first type, the first type of anomaly selected based upon the first type of event;
calculating a count of a number of generated anomaly indicators of the first type;
calculating a risk score based upon the count and a second count corresponding to a number of generated anomaly indicators corresponding to second anomalies of a second type, the first and second anomalies occurring within a second predetermined period of time, the risk score quantifying a calculated risk that the authorized user of the client computing device has engaged in inappropriate access of files;
and
sending the risk score to a second computing device for display on a graphical user interface (GUI).

7 more elements

A non-transitory machine readable medium comprising instructions for detecting inappropriate access of files by an authorized user of a client computing device, the instructions, which when executed by a machine, causes the machine to perform operations comprising:

receiving a first file system element event indicator from an application executing on the client computing device, the first file system element event described by the first file system element event indicator including a first value and a first type, the first value being a number of bytes corresponding to the first file system element event, the first type being a deletion event, copy event, move event, or modification event;
summing the first value with a second value of a second file system element event of the first type to create a summed value, the first file system element event and the second file system element event both received within a first predetermined period of time;
determining a threshold for the summed value, the threshold determined based upon past observations of values of other file system element events of the first type during a past time period, a class of the user within an organization, and a function classification of files corresponding to the file system element events, the past time period prior to the first predetermined period of time;
determining that the summed value exceeds the threshold, and in response, incrementing a first anomaly counter of a first type, the first type of anomaly selected based upon the first type of event;
calculating a count of a number of generated anomaly indicators of the first type;
calculating a risk score based upon the count and a second count corresponding to a number of generated anomaly indicators corresponding to second anomalies of a second type, the first and second anomalies occurring within a second predetermined period of time, the risk score quantifying a calculated risk that the authorized user of the client computing device has engaged in inappropriate access of files;
and
sending the risk score to a second computing device for display on a graphical user interface (GUI).

5 more elements

Dependencies are inferred from the claim text.