# US 12,001,563 B2 · Generating an entity behavior profile based upon sessions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,563 B2 - Document ID: US12001563B2 - Status: Granted - Kind: B2 - Application number: 17/226,722 - Filed: 2021-04-09 - Published: 2021-07-22 - Granted: 2024-06-04 - Earliest claimed: 2017-05-15 - Assignees: Forcepoint LLC - Applicants: Forcepoint, LLC - Inventors: Alan Ross; Raffael Marty; Nicolas Christian Fischbach - Web page: https://patentgrep.com/patent/US12001563B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, method, and computer-readable medium are disclosed for performing an entity behavior cataloging operation. The entity behavior cataloging operation includes: identifying a security related activity, the security related activity being based upon an observable from an electronic data source; analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity; generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity; and, storing the entity behavior catalog data within an entity behavior catalog, the entity behavior catalog providing an inventory of entity behaviors for use when performing a security operation. ## Claims ### Claim 1 A computer-implementable method for performing a security operation, comprising: monitoring an entity, the monitoring observing at least one electronically-observable data source, the monitoring comprising monitoring at least one of a plurality of electronically-observable actions via a protected endpoint; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility; associating the security related activity with a session; processing an entity behavior profile of the entity and contextual information relating to the entity to generate an inference regarding the entity; generating an entity behavior profile element based upon the security related activity and the session; and, performing the security operation via the protected endpoint and a security analytics system, the security operation using the entity behavior entity behavior profile element and the inference regarding the entity, the security analytics system executing on a security analytics system hardware processor. ### Claim 2 (depends on 1) The method of claim 1, wherein: the entity comprises at least one of a user entity and a non-user entity. ### Claim 3 (depends on 1) The method of claim 1, further comprising: associating the entity behavior profile element with the entity behavior profile. ### Claim 4 (depends on 3) The method of claim 3, wherein: the entity behavior profile comprises user profile attributes, user behavior factors, a user entity profile and a user entity mindset profile. ### Claim 5 (depends on 3) The method of claim 3, wherein: the security operation uses the entity behavior profile to determine whether an event is of analytic utility. ### Claim 6 (depends on 5) The method of claim 5, wherein: the security analytics system comprises an analytic utility detection module, the analytic utility detection module determining whether the event is of analytic utility. ### Claim 7 A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: monitoring an entity, the monitoring observing at least one electronically-observable data source, the monitoring comprising monitoring at least one of a plurality of electronically-observable actions via a protected endpoint; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility; associating the security related activity with a session; processing an entity behavior profile of the entity and contextual information relating to the entity to generate an inference regarding the entity; generating an entity behavior profile element based upon the security related activity and the session; and performing the security operation via the protected endpoint and a security analytics system, the security operation using the entity behavior entity behavior profile element and the inference regarding the entity, the security analytics system executing on a security analytics system hardware processor. ### Claim 8 (depends on 7) The system of claim 7, wherein: the entity comprises at least one of a user entity and a non-user entity. ### Claim 9 (depends on 7) The system of claim 7, wherein the instructions executable by the processor are further configured for: associating the entity behavior profile element with the entity behavior profile. ### Claim 10 (depends on 9) The system of claim 9, wherein: the entity behavior profile comprises user profile attributes, user behavior factors, a user entity profile and a user entity mindset profile. ### Claim 11 (depends on 7) The system of claim 7, wherein: the security operation uses the entity behavior profile to determine whether an event is of analytic utility. ### Claim 12 (depends on 11) The system of claim 11, wherein: the security analytics system comprises an analytic utility detection module, the analytic utility detection module determining whether the event is of analytic utility. ### Claim 13 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: monitoring an entity, the monitoring observing at least one electronically-observable data source, the monitoring comprising monitoring at least one of a plurality of electronically-observable actions via a protected endpoint; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility; associating the security related activity with a session; processing an entity behavior profile of the entity and contextual information relating to the entity to generate an inference regarding the entity; generating an entity behavior profile element based upon the security related activity and the session; and, performing the security operation via the protected endpoint and a security analytics system, the security operation using the entity behavior entity behavior profile element and the inference regarding the entity, the security analytics system executing on a security analytics system hardware processor. ### Claim 14 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the entity comprises at least one of a user entity and a non-user entity. ### Claim 15 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for: associating the entity behavior profile element with an entity behavior profile. ### Claim 16 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein: the entity behavior profile comprises user profile attributes, user behavior factors, a user entity profile and a user entity mindset profile. ### Claim 17 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein: the security operation uses the entity behavior profile to determine whether an event is of analytic utility. ### Claim 18 (depends on 17) The non-transitory, computer-readable storage medium of claim 17, wherein: the security system comprises an analytic utility detection module, the analytic utility detection module determining whether the event is of analytic utility. ### Claim 19 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are deployable to a client system from a server system at a remote location. ### Claim 20 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are provided by a service provider to a user on an on-demand basis.