# US 12,603,815 B2 · State-based entity behavior analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,815 B2 - Document ID: US12603815B2 - Status: Granted - Kind: B2 - Application number: 18/464,045 - Filed: 2023-09-08 - Published: 2023-12-28 - Granted: 2026-04-14 - Earliest claimed: 2017-09-22 - Assignees: Open Text Corporation - Applicants: Open Text Inc. - Inventors: William Wright; Bin Qiu; Thomas Caldwell - Web page: https://patentgrep.com/patent/US12603815B2 ## CPC - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 41/0843: {based on generic templates} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Examples of the present disclosure describe systems and methods for state-based entity behavior analysis. In an example, entities of a computing environment may be represented using a hierarchical entity web. In some examples, an entity may have a state associated with it, which may be modeled using a place/transition (PT) network. Events within the computing environment may be evaluated by transitions of a PT network to determine whether an entity should change state. If an entity transitions from one state to another, one or more actions may be performed, including, but not limited to, taking a remedial action, generating a recommendation, and updating the state of one or more associated entities. Thus, aspects disclosed herein may provide a high-level overview of the state of entities of a computing environment, but may also be used to view in-depth information of entities at lower levels of the hierarchical entity web. ## Claims ### Claim 1 A computer program product comprising a non-transitory computer readable medium storing instructions executable by a processor to perform a set of operations, the set of operations comprising: receiving an event associated with an entity of a computing environment, wherein the entity is one of a set of sub-entities organized into a hierarchy such that a change in a state of any of the set of sub-entities changes a state of an entity at a higher level of the hierarchy; determining that the received event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity; evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network based on a security index score, wherein the security index score is based on a plurality of states associated with the set of sub-entities; when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network; and performing an action for the entity based on the entity being associated with the second place of the PT network. ### Claim 2 (depends on 1) The computer program product of claim 1, wherein the PT network is determined based on evaluating at least one of the event and the entity to identify the PT network. ### Claim 3 (depends on 1) The computer program product of claim 1, wherein the one of the plurality of predefined state change transitions comprises computer-executable code, and wherein evaluating the event comprises executing the computer-executable code. ### Claim 4 (depends on 1) The computer program product of claim 1, wherein evaluating the event further comprises evaluating additional information associated with the entity. ### Claim 5 (depends on 1) The computer program product of claim 1, wherein evaluating the event further comprises evaluating the event using machine learning. ### Claim 6 (depends on 1) The computer program product of claim 1, wherein the second place is associated with a good state for the entity; the first place is associated with a bad state for the entity; and a third place of the PT network is associated with an unknown state for the entity. ### Claim 7 (depends on 1) The computer program product of claim 1, wherein performing the action for the entity comprises at least one of: generating a recommendation for the entity, wherein the recommendation is based on the event; performing a remedial action; and modifying a relationship between the entity and another entity within the computing environment. ### Claim 8 A method of processing an event associated with an entity comprising: receiving an indication of an event associated with the entity in a computing environment, wherein the entity is one of a set of sub-entities organized into a hierarchy such that a change in a state of any of the set of sub-entities changes a state of an entity at a higher level of the hierarchy; determining that the event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity; evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network based on a security index score, wherein the security index score is based on a plurality of states associated with the set of sub-entities; when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network; and performing an action for the entity based on the entity being associated with the second place of the PT network. ### Claim 9 (depends on 8) The method of claim 8, wherein the indication of the event is received via an application programming interface. ### Claim 10 (depends on 8) The method of claim 8, wherein determining the action to perform comprises evaluating at least one of the event and the entity. ### Claim 11 (depends on 8) The method of claim 8, wherein the set of operations further comprise: receiving an indication of a second event associated with the entity; and determining that the second event represents another one of a plurality of predefined state change transitions of the entity. ### Claim 12 (depends on 8) The method of claim 8, wherein determining whether the entity should transition from the first place to the second place further comprises evaluating additional information associated with the entity. ### Claim 13 (depends on 8) The method of claim 8, wherein performing the determined action comprises at least one of: generating a recommendation for the entity, wherein the recommendation is based on the event; performing a remedial action; and modifying a relationship between the entity and another entity within the computing environment. ### Claim 14 A system for processing an event associated with an entity: a processor; and a non-transitory computer readable medium storing instructions translatable by the processor, the instructions when translated by the processor perform: receiving an event associated with an entity of a computing environment, wherein the entity is one of a set of sub-entities organized into a hierarchy such that a change in a state of any of the set of sub-entities changes a state of an entity at a higher level of the hierarchy; determining that the received event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity; evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network based on a security index score, wherein the security index score is based on a plurality of states associated with the set of sub-entities; when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network; and performing an action for the entity based on the entity being associated with the second place of the PT network. ### Claim 15 (depends on 14) The system of claim 14, wherein the PT network is determined based on evaluating at least one of the event and the entity to identify the PT network. ### Claim 16 (depends on 14) The system of claim 14, wherein evaluating the event further comprises evaluating additional information associated with the entity. ### Claim 17 (depends on 14) The system of claim 14, wherein evaluating the event further comprises evaluating the event using machine learning. ### Claim 18 (depends on 14) The system of claim 14, wherein the second place is associated with a good state for the entity; the first place is associated with a bad state for the entity; and a third place of the PT network is associated with an unknown state for the entity. ### Claim 19 (depends on 14) The system of claim 14, wherein performing the action for the entity comprises at least one of: generating a recommendation for the entity, wherein the recommendation is based on the event; performing a remedial action; and modifying a relationship between the entity and another entity within the computing environment. ### Claim 20 (depends on 8) The method of claim 8, wherein the security index score is determined based on at least one of: a historical entity state, a current entity state, a likelihood of entity state change, an operational value of entities, and a likelihood that the current state of an entity is incorrect.