Maintaining user privacy via a distributed framework for security analytics
AssigneeForcepoint LLC
InventorsLawrence Bruce Huston, III, David Coffey
Life of this patent
Estimating the term…
Abstract
A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity; maintaining information relating to the monitoring within a user edge component; identifying an event of analytic utility; analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment; and, providing the security risk assessment to a network edge component.
Claims14
A computer-implementable method for performing a security operation, comprising:
- monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity;
- maintaining information relating to the monitoring within a user edge component;
- identifying an event of analytic utility;
- analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment, the analyzing being performed by a hardware processor of the user edge component;
- providing the security risk assessment to a network edge component;
- anonymizing the information relating to the monitoring to provide anonymized information;
- and,
- providing the anonymized information to the network edge component;
- and wherein
- the network edge component performs a security operation using the anonymized information relating to the monitoring;
- and,
- the network edge component requests de-anonymized information from the user edge component when the security operation generates an indication of a security risk of the entity.
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity;
- maintaining information relating to the monitoring within a user edge component;
- identifying an event of analytic utility;
- analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment, the analyzing being performed by a hardware processor of the user edge component;
- providing the security risk assessment to a network edge component;
- anonymizing the information relating to the monitoring to provide anonymized information;
- and,
- providing the anonymized information to the network edge component;
- and wherein
- the network edge component performs a security operation using the anonymized information relating to the monitoring;
- and,
- the network edge component requests de-anonymized information from the user edge component when the security operation generates an indication of a security risk of the entity.
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity;
- maintaining information relating to the monitoring within a user edge component;
- identifying an event of analytic utility;
- analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment, the analyzing being performed by a hardware processor of the user edge component;
- providing the security risk assessment to a network edge component;
- anonymizing the information relating to the monitoring to provide anonymized information;
- and
- providing the anonymized information to the network edge component;
- and wherein
- the network edge component performs a security operation using the anonymized information relating to the monitoring;
- and,
- the network edge component requests de-anonymized information from the user edge component when the security operation generates an indication of a security risk of the entity.
Dependencies are inferred from the claim text.