# US 12,192,225 B2 · Security analytics system for performing a non-sanctioned entity interaction analysis operation when determining entity risk > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,225 B2 - Document ID: US12192225B2 - Status: Granted - Kind: B2 - Application number: 17/991,025 - Filed: 2022-11-21 - Published: 2023-07-06 - Granted: 2025-01-07 - Earliest claimed: 2021-12-30 - Assignees: Forcepoint Federal Holdings LLC - Applicants: Forcepoint LLC - Inventors: Margaret Cunningham; Peter Lochlan Stewart - Web page: https://patentgrep.com/patent/US12192225B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 40/295: Named entity recognition - G06F 40/30: Semantic analysis - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, method, and computer-readable medium are disclosed for performing entity interaction risk analysis operation. The entity interaction risk analysis operation includes: monitoring an entity, the monitoring observing an electronically-observable data source; identifying an interaction between the entity and another entity based upon the monitoring; analyzing the interaction between the entity and the another entity; determining whether the interaction between the entity and the another entity is non-sanctioned; and, performing a security operation in response to the analyzing the interaction and the determining whether the interaction is non-sanctioned. ## Claims ### Claim 1 A computer-implementable method for performing an entity interaction risk analysis operation, comprising: monitoring an entity, the monitoring observing an electronically-observable data source; identifying an interaction between the entity and another entity based upon the monitoring, the entity being included within a first entity group; analyzing the interaction between the entity and the another entity; determining whether the interaction between the entity and the another entity is a non-sanctioned entity interaction, the non-sanctioned entity interaction comprising an interaction between the entity and the another entity whose enactment does not comply with a policy instituted by the first entity group; and, performing a security operation via a security analytics system in response to the analyzing the interaction when the interaction is non-sanctioned, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system. ### Claim 2 (depends on 1) The method of claim 1, wherein: the another entity comprises an information source. ### Claim 3 (depends on 2) The method of claim 2, wherein: the analyzing includes identifying a trending topic and determining whether the information source includes the trending topic. ### Claim 4 (depends on 3) The method of claim 3, wherein: the analyzing includes generating an amplification factor based upon whether the information source includes the trending topic. ### Claim 5 (depends on 1) The method of claim 1, wherein: the analyzing includes determining an affect associated with the interaction between the entity and the another entity. ### Claim 6 (depends on 5) The method of claim 5, wherein: the affect is determined using at least one of a sentiment analysis operation and a pattern analysis operation. ### Claim 7 A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: monitoring an entity, the monitoring observing an electronically-observable data source, the entity being included within a first entity group; identifying an interaction between the entity and another entity based upon the monitoring; analyzing the interaction between the entity and the another entity; determining whether the interaction between the entity and the another entity is a non-sanctioned entity interaction, the non-sanctioned entity interaction comprising an interaction between the entity and the another entity whose enactment does not comply with a policy instituted by the first entity group; and, performing a security operation via a security analytics system in response to the analyzing the interaction when the interaction is non-sanctioned, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system. ### Claim 8 (depends on 7) The system of claim 7, wherein: the another entity comprises an information source. ### Claim 9 (depends on 8) The system of claim 8, wherein: the analyzing includes identifying a trending topic and determining whether the information source includes the trending topic. ### Claim 10 (depends on 9) The system of claim 9, wherein: the analyzing includes generating an amplification factor based upon whether the information source includes the trending topic. ### Claim 11 (depends on 7) The system of claim 7, wherein: the analyzing includes determining an affect associated with the interaction between the entity and the another entity. ### Claim 12 (depends on 11) The system of claim 11, wherein: the affect is determined using at least one of a sentiment analysis operation and a pattern analysis operation. ### Claim 13 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: monitoring an entity, the monitoring observing an electronically-observable data source; identifying an interaction between the entity and another entity based upon the monitoring, the entity being included within a first entity group; analyzing the interaction between the entity and the another entity; determining whether the interaction between the entity and the another entity is a non-sanctioned entity interaction, the non-sanctioned entity interaction comprising an interaction between the entity and the another entity whose enactment does not comply with a policy instituted by the first entity group; and, performing a security operation via a security analytics system in response to the analyzing the interaction when the interaction is non-sanctioned, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system. ### Claim 14 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the another entity comprises an information source. ### Claim 15 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein: the analyzing includes identifying a trending topic and determining whether the information source includes the trending topic. ### Claim 16 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein: the analyzing includes generating an amplification factor based upon whether the information source includes the trending topic. ### Claim 17 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the analyzing includes determining an affect associated with the interaction between the entity and the another entity. ### Claim 18 (depends on 17) The non-transitory, computer-readable storage medium of claim 17, wherein: the affect is determined using at least one of a sentiment analysis operation and a pattern analysis operation. ### Claim 19 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are deployable to a client system from a server system at a remote location. ### Claim 20 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the computer executable instructions are provided by a service provider to a user on an on-demand basis.