# US 11,909,752 B1 · Detecting deviations from typical user behavior > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,752 B1 - Document ID: US11909752B1 - Status: Granted - Kind: B1 - Application number: 17/857,896 - Filed: 2022-07-05 - Granted: 2024-02-20 - Earliest claimed: 2017-11-27 - Assignees: Lacework Inc. - Applicants: Lacework, Inc. - Inventors: Vikram Kapoor; Harish Kumar Bharat Singh; Weifei Zeng; Vimalkumar Jeyakumar; Theron Tock; Ying Xie; Yijou Chen - Web page: https://patentgrep.com/patent/US11909752B1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/9038: Presentation of query results - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/06: Generation of reports - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/306: User profiles - H04L 67/52: specially adapted for the location of the user terminal - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 16/2456: {Join operations} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user. ## Claims ### Claim 1 A method of detecting deviations from typical user behavior, the method comprising: identifying a location of a device that is associated with a user; determining device activity associated with the user; detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts. ### Claim 2 (depends on 1) The method of claim 1 further comprising, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. ### Claim 3 (depends on 1) The method of claim 1 further comprising generating the profile associated with the user. ### Claim 4 (depends on 1) The method of claim 1 wherein determining device activity associated with the user further comprises: identifying one or more applications accessed by the device; and identifying application behavior for the one or more applications. ### Claim 5 (depends on 1) The method of claim 1 wherein device activity associated with the user is continuously monitored for deviation from normal activity. ### Claim 6 (depends on 1) The method of claim 1 wherein the device activity associated with the user and the profile associated with the user include temporal information. ### Claim 7 (depends on 1) The method of claim 1 further comprising identifying a location of a device that is associated with a user. ### Claim 8 A system for detecting deviations from typical user behavior, the system comprising at least one processor and memory storing computer program instructions that, when executed, cause the system to carry out the steps of: identifying a location of a device that is associated with a user; determining device activity associated with the user; detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts. ### Claim 9 (depends on 8) The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. ### Claim 10 (depends on 8) The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating the profile associated with the user. ### Claim 11 (depends on 8) The system of claim 8 wherein determining device activity associated with the user further comprises: identifying one or more applications accessed by the device; and identifying application behavior for the one or more applications. ### Claim 12 (depends on 8) The system of claim 8 wherein device activity associated with the user is continuously monitored for deviation from normal activity. ### Claim 13 (depends on 8) The system of claim 8 wherein the device activity associated with the user and the profile associated with the user include temporal information. ### Claim 14 A computer program product for detecting deviations from typical user behavior, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of: identifying a location of a device that is associated with a user; determining device activity associated with the user; detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts. ### Claim 15 (depends on 14) The computer program product of claim 14 further comprising computer program instructions that, when executed, carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert. ### Claim 16 (depends on 14) The computer program product of claim 14 wherein determining device activity associated with the user further comprises: identifying one or more applications accessed by the device; and identifying application behavior for the one or more applications. ### Claim 17 (depends on 14) The computer program product of claim 14 wherein device activity associated with the user is continuously monitored for deviation from normal activity. ### Claim 18 (depends on 14) The computer program product of claim 14 wherein the device activity associated with the user and the profile associated with the user include temporal information.