# US 12,216,744 B2 · Intrusion detection on computing devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,744 B2 - Document ID: US12216744B2 - Status: Granted - Kind: B2 - Application number: 17/001,325 - Filed: 2020-08-24 - Published: 2020-12-10 - Granted: 2025-02-04 - Earliest claimed: 2014-07-14 - Assignees: Akamai Technologies, Inc. - Applicants: Akamai Technologies, Inc. - Inventors: Sreenath Kurupati - Web page: https://patentgrep.com/patent/US12216744B2 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 2221/2139: Recurrent verification - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A non-transitory computer readable storage medium including instructions that, when executed by a computing system, cause the computing system to perform operations. The operations include collecting, by a processing device, raw data regarding a user action. The operations also include converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents behavior characteristics of a current user. The operations also include identifying, by the processing device, a characteristic model corresponding to the behavior characteristics represented by the CTD. The operations also include generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action came from an authenticated user. ## Claims ### Claim 1 A method comprising: performing behavioral analysis continuously by: collecting, by a processing device, raw data regarding a user action; converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents one or more behavior characteristics of a current user; identifying, by the processing device, a characteristic model corresponding to the one or more behavior characteristics represented by the CTD; and generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action is permitted; at a given time, and based on a factor, automatically adjusting a threshold for determining whether the score indicates a probability that the user action is permitted, wherein the factor is one of: the user action occurring in an area of a system that has a particular security requirement, the user action occurring at a given time, the user action associated with a given information request, an extent to which the user action is continuous, and a quality of an available characteristic model; at the given time and based on the adjusted threshold, applying the corresponding characteristic model for the given CTD to generate the score; and taking an access control action based on the score. ### Claim 2 (depends on 1) The method of claim 1, further comprising training, by the processing device, the characteristic model from the collected raw data. ### Claim 3 (depends on 1) The method of claim 1, wherein the raw data is continuously collected to maintain an authentication of a user. ### Claim 4 (depends on 1) The method of claim 1, wherein the user action comprises at least one of keyboard event data, mouse event data, touch event data, gyroscope event data, accelerometer event data, camera event data, proximity sensor event data, or other sensor event data. ### Claim 5 (depends on 1) The method of claim 1, wherein the user action comprises data describing an access pathway followed by the current user. ### Claim 6 (depends on 1) The method of claim 1, wherein the CTD comprises data relating to a current user action and a past user action. ### Claim 7 (depends on 6) The method of claim 6, wherein the predictor comprises a composite score corresponding to a plurality of CTDs associated with raw data from an application over a time period. ### Claim 8 (depends on 1) The method of claim 1, wherein the predictor comprises a composite score corresponding to a plurality of CTDs associated with user actions at a plurality of applications. ### Claim 9 A non-transitory computer readable storage medium including instructions that, when executed by a computing system, cause the computing system to perform operations comprising: performing behavioral analysis continuously by: collecting, by a processing device, raw data regarding a user action; converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents one or more behavior characteristics of a current user; identifying, by the processing device, a characteristic model corresponding to the one or more behavior characteristics represented by the CTD; and generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action is permitted; at a given time, and based on a factor, automatically adjusting a threshold for determining whether the score indicates a probability that the user action is permitted, wherein the factor is one of: the user action occurring in an area of a system that has a particular security requirement, the user action occurring at a given time, the user action associated with a given information request, an extent to which the user action is continuous, and a quality of an available characteristic model; at the given time and based on the adjusted threshold, applying the corresponding characteristic model for the given CTD to generate the score; and taking an access control action based on the score. ### Claim 10 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the operations further comprise training, by the processing device, the characteristic model from the collected raw data. ### Claim 11 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the raw data is continuously collected to maintain an authentication of a user. ### Claim 12 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the user action comprises at least one of keyboard event data, mouse event data, touch event data, gyroscope event data, accelerometer event data, camera event data, proximity sensor event data, or other sensor event data. ### Claim 13 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the user action comprises data describing an access pathway followed by the current user. ### Claim 14 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the CTD comprises data relating to a current user action and a past user action. ### Claim 15 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein the predictor comprises a composite score corresponding to a plurality of CTDs associated with raw data collected from an application over a time period. ### Claim 16 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the predictor comprises a composite score corresponding to a plurality of CTDs associated with user actions at a plurality of applications. ### Claim 17 A computing system, comprising: a data storage device; and a processing device, coupled to the data storage device, to: collect raw data regarding a user action; convert the raw data to characteristic test data (CTD), wherein the CTD represents one or more behavior characteristics of a current user; identify a characteristic model corresponding to the one or more behavior characteristics represented by the CTD; and generate a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action is permitted, the collecting, converting, identifying and generating operations carried out continuously as a behavioral analysis; at a given time, and based on a factor, automatically adjust a threshold for determining whether the score indicates a probability that the user action is permitted, wherein the factor is one of: the user action occurring in an area of a system that has a particular security requirement, the user action occurring at a given time, the user action associated with a given information request, an extent to which the user action is continuous, and a quality of an available characteristic model; at the given time and based on the adjusted threshold, apply the corresponding characteristic model for the given CTD to generate the score; and take an access control action based on the score. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the raw data is continuously collected to maintain an authentication of a user. ### Claim 19 (depends on 17) The computer system of claim 17, wherein the CTD comprises data relating to a current user action and a past user action. ### Claim 20 (depends on 17) The computer system of claim 17, wherein the predictor comprises a composite score corresponding to a plurality of CTDs associated with user actions at a plurality of applications.