Browser-based detection of data exfiltration
AssigneeFortinet, Inc.
InventorsConor Hayes, Ying Xie, Vimalkumar Jeyakumar, Theron Tock, Harish Kumar Bharat Singh, Vikram Kapoor, Weifei Zeng, Yijou Chen
Life of this patent
Estimating the term…
Abstract
Browser-based detection of data exfiltration includes gathering first information describing browser activity of a browser of a device and generated by a browser extension on the device; and determining whether the first information indicates a data exfiltration. The first information may include data input to the browser and the determination of whether the first information indicates a data exfiltration is based on the data input.
Claims20
A method of browser-based detection of data exfiltration, the method comprising:
- gathering, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;
- generating a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;
- computing a risk score based on the deviation between the first information and the behavioral profile;
- and
- determining whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.
A computer program product for browser-based detection of data exfiltration, the computer program product including computer program instructions configurable to:
- gather, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;
- generate a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;
- compute a risk score based on the deviation between the first information and the behavioral profile;
- and
- determine whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.
An apparatus for browser-based detection of data exfiltration, the apparatus comprising:
- a processor;
- and
- memory operatively coupled to the processor, wherein the memory stores computer program instructions that, when executed by the processor, cause the apparatus to:
- gather, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;
- generate a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;
- compute a risk score based on the deviation between the first information and the behavioral profile;
- and
- determine whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.
Dependencies are inferred from the claim text.