Back to results
US 12,701,118 B2Granted
User activity auditing of resource traversal across connected company nodes
AssigneePalo Alto Networks, Inc.
InventorsOfer Ben-Noon, Ohad Bobrov, Guy Harpak, Eran Rom, Ido Salomon
Life of this patent
Estimating the term…
Abstract
Based on occurrence of audit trigger events that include uploading, downloading, modifying, copying, and pasting of resources across browsers at nodes of a company, audit records are generated that indicate user identifiers, time stamps, metadata, and content associated with the resources. The audit records specify trajectories/traversals of resources across the company that are used to determine associated users and data breaches. Pairs of audit records in the traversals have same hashes of content/metadata of a corresponding resource.
Claims23
A method comprising:
- monitoring activity across a plurality of users at a plurality of browser instances running on respective ones of a plurality of nodes in a network corresponding to a company, wherein monitoring activity of the plurality of users comprises,
- detecting events at the plurality of browser instances that trigger auditing of activity of the plurality of users;
- and
- generating records corresponding to the events, wherein each record indicates a time stamp of the corresponding one of the events, an identifier of a resource corresponding to the event, and a hash of at least a portion of content of the resource corresponding to the event;
- and
- determining a traversal of a resource through the plurality of nodes corresponding to a potential security breach based on the records, wherein identifying the traversal of the resource comprises identifying a sequence of the records based on the time of day indicated in the records and based on each consecutive pair of records in the sequence indicating at least one of a same hash of at least a portion of content and a same identifier of the resource of the determined traversal.
3 more elements
A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:
- monitor activity across a plurality of users at a plurality of browser instances running on respective ones of a plurality of nodes in a network corresponding to a company, wherein the instructions to monitor activity of the plurality of users comprise instructions to,
- detect events at the plurality of browser instances that trigger auditing of activity of the plurality of users;
- and
- generate records corresponding to the events, wherein each record indicates a time stamp of the corresponding one of the events, an identifier of a resource corresponding to the event, and a hash of at least a portion of content of the resource corresponding to the event;
- and
- determine a traversal of a resource through the plurality of nodes corresponding to a potential security breach based on the records, wherein the instructions to identify the traversal of the resource comprise instructions to identify a sequence of the records based on the time of day indicated in the records and based on each consecutive pair of records in the sequence indicating at least one of a same hash of at least a portion of content and a same identifier of the resource of the determined traversal.
3 more elements
A apparatus comprising:
- a processor;
- and
- a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
- monitor activity of a plurality of users at a plurality of browser instances running on respective ones of a plurality of nodes in a network corresponding to a company, wherein the instructions to monitor activity of the plurality of users comprise instructions executable by the processor to cause the apparatus to,
- detect events at the plurality of browser instances that trigger auditing of activity of the plurality of users;
- and
- generate records corresponding to the events, wherein each record indicates a time stamp of the corresponding one of the events, an identifier of a resource corresponding to the event, and a hash of at least a portion of content of the resource corresponding to the event;
- and
- determine a traversal of a resource through the plurality of nodes corresponding to a potential security breach based on the records, wherein the instructions to identify the traversal of the resource comprise instructions executable by the processor to cause the apparatus to identify a sequence of the records based on the time of day indicated in the records and based on each consecutive pair of records in the sequence indicating at least one of a same hash of at least a portion of content and a same identifier of the resource of the determined traversal.
6 more elements
Dependencies are inferred from the claim text.