# US 12,120,140 B2 · Detecting threats against computing resources based on user behavior changes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,140 B2 - Document ID: US12120140B2 - Status: Granted - Kind: B2 - Application number: 18/196,149 - Filed: 2023-05-11 - Published: 2024-01-25 - Granted: 2024-10-15 - Earliest claimed: 2017-11-27 - Assignees: Fortinet, Inc. - Applicants: Lacework, Inc. - Inventors: Harish Kumar Bharat Singh; Vikram Kapoor; Murat Bog; Yijou Chen - Web page: https://patentgrep.com/patent/US12120140B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/9038: Presentation of query results - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/06: Generation of reports - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 16/2456: {Join operations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An illustrative method includes generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert. ## Claims ### Claim 1 A method comprising: generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert. ### Claim 2 (depends on 1) The method of claim 1, wherein the logical graph comprises an insider behavior graph, wherein the insider behavior graph models interactions of the user with the network environment. ### Claim 3 (depends on 1) The method of claim 1, wherein the log data comprises information associated with the user provided by a plurality of machines. ### Claim 4 (depends on 1) The method of claim 1, wherein the logical graph comprises a privilege change graph, wherein the privilege change graph models privilege changes between processes. ### Claim 5 (depends on 4) The method of claim 4, wherein the privilege changes are represented as edges in the privilege change graph. ### Claim 6 (depends on 4) The method of claim 4, wherein the privilege change graph includes process hierarchy information. ### Claim 7 (depends on 1) The method of claim 1, wherein the logical graph comprises a machine-server graph, wherein the machine-server graph clusters machines into nodes based on resources executing on the machine. ### Claim 8 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has logged in from an anomalous location. ### Claim 9 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has logged into an anomalous machine. ### Claim 10 (depends on 9) The method of claim 9, wherein the anomalous machine has an associated machine class and wherein determining that the user has logged into the anomalous machine includes determining that the user has accessed an anomalous machine class. ### Claim 11 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has accessed an anomalous application. ### Claim 12 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has transmitted data to an anomalous destination. ### Claim 13 (depends on 12) The method of claim 12, further comprising determining that the anomalous destination is an anomalous destination based at least in part on geolocation information associated with the destination. ### Claim 14 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has transmitted an anomalous amount of data. ### Claim 15 (depends on 1) The method of claim 1, wherein detecting the anomaly includes determining that the user has made an anomalous privilege change. ### Claim 16 A system comprising: a memory storing instructions; and a processor and configured to execute the instructions to perform a process comprising: generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert. ### Claim 17 (depends on 16) The system of claim 16, wherein the logical graph comprises an insider behavior graph, wherein the insider behavior graph models interactions of the user with the network environment. ### Claim 18 (depends on 16) The system of claim 16, wherein the log data comprises information associated with the user provided by a plurality of machines. ### Claim 19 (depends on 16) The system of claim 16, wherein the logical graph comprises a privilege change graph, wherein the privilege change graph models privilege changes between processes. ### Claim 20 A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert.