# US 12,764,137 B2 · Systems and methods for automatically correlating digital events for actor attribution across disparate digital platforms

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,764,137 B2
- Document ID: US12764137B2
- Status: Granted
- Kind: B2
- Application number: 19/394,310
- Filed: 2025-11-19
- Published: 2026-05-21
- Granted: 2026-10-13
- Earliest claimed: 2024-11-20
- Assignees: Permiso Security Inc.
- Applicants: Permiso Security Inc.
- Inventors: Stephen Demjanenko; Wei Quan; Jason Martin; Thomas Kurty; Andrew Shu; Nihar Patel; Charan Sunkara; Xavier Chemla; Nathan Eades; Ian Ahl; Phani Modali
- Web page: https://patentgrep.com/patent/US12764137B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system, method, and computer-program product includes obtaining digital event data that occurred on a plurality of disparate computing environments of a subscribing entity, converting the digital event data into normalized digital event data, constructing, for the subscribing entity, a plurality of individual session objects detected across the plurality of disparate computing environments, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects, generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects, and detecting, using the cross-environment session artifact, a root actor responsible for the target set of individual session objects.

## Claims

### Claim 1

A computer-implemented method comprising:
at an identity-based threat detection and response service implemented by a network of distributed computers:
obtaining, by the network of distributed computers, digital event data that occurred on a plurality of disparate computing environments of a subscribing entity;
in response to obtaining the digital event data, converting the digital event data into normalized digital event data that conforms to a target data schema specified by the identity-based threat detection and response service;
constructing, for the subscribing entity in real-time or near real-time, a plurality of individual session objects detected across the plurality of disparate computing environments in response to the network of distributed computers executing one or more session construction instructions against the normalized digital event data, wherein:
each individual session object of the plurality of individual session objects includes a distinct set of digital events performed in a respective computing environment of the plurality of disparate computing environments by a distinct digital account during a distinct time span;
in response to constructing the plurality of individual session objects, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects;
generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects;
detecting, using the cross-environment session artifact, a root actor responsible for the distinct set of digital events performed across the target set of individual session objects;
detecting that the root actor accessed the respective computing environment associated with one of the target set of individual session objects using multi-factor authentication (MFA); and
displaying, within the cross-environment session artifact, an MFA user interface element that indicates MFA was used by the root actor to access the respective computing environment associated with the one of the target set of individual session objects.

### Claim 2 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
in response to constructing a respective individual session object of the plurality of individual session objects:
providing the respective individual session object to an actor-type machine learning classification model;
computing, using the actor-type machine learning classification model, an actor-type classification inference comprising a confidence score indicating a probability of a machine actor using the distinct digital account of the respective individual session object to perform the distinct set of digital events included in the respective individual session object; and
assessing, in real-time or near real-time, a security threat of the respective individual session object using one of:
a first set of threat detection instructions operably configured to assess the distinct set of digital events of the respective individual session object as machine activity when the confidence score satisfies a predetermined confidence score threshold, and
a second set of threat detection instructions operably configured to assess the distinct set of digital events of the respective individual session object as human activity when the confidence score fails to satisfy the predetermined confidence score threshold.

### Claim 3 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
in response to constructing a respective individual session object of the plurality of individual session objects:
assessing the distinct set of digital events associated with the respective individual session object;
detecting, based on the assessment, that the respective individual session object corresponds to one of:
an application programming interface-type session when metadata included in the distinct set of digital events of the respective individual session object indicates that access to the respective computing environment of the respective individual session object was obtained using an application programming interface (API) key, and
a console-type session when the distinct set of digital events of the respective individual session object is indicative of a human user using one or more graphical user interfaces of the respective computing environment of the respective individual session object to perform the distinct set of digital events associated with the respective individual session object; and
attributing, using the network of distributed computers, one of:
an API session label to the respective individual session object when the respective individual session object is detected to be the application programming interface-type session, and
a console session label to the respective individual session object when the respective individual session object is detected to be the console-type session.

### Claim 4 (depends on 1)

The computer-implemented method according to claim 1, wherein:
executing the one or more session construction instructions causes the network of distributed computers to:
partition the normalized digital event data into a plurality of distinct sets of normalized digital event data based in part on actor metadata and time metadata included in the normalized digital event data, and
construct the plurality of individual session objects based on the plurality of distinct sets of normalized digital event data, wherein:
each individual session object of the plurality of individual session objects corresponds to a single actor, and
the single actor corresponding to a respective individual session object of the plurality of individual session objects performed the distinct set of digital events of the respective individual session object within an amount of time less than a maximum time duration permitted by the identity-based threat detection and response service.

### Claim 5 (depends on 1)

The computer-implemented method according to claim 1, wherein:
executing the one or more session construction instructions causes the network of distributed computers to:
assess the normalized digital event data based in part on timestamp metadata and actor metadata included in the normalized digital event data;
identify, based on the normalized digital event data, a sequence of digital events performed by a single actor that occurred on one of the plurality of disparate computing environments;
construct a respective individual session object of the plurality of individual session objects based in part on the sequence of digital events performed by the single actor, wherein the respective individual session object includes:
a session start time corresponding to a timestamp of a first digital event included in the sequence of digital events,
a session end time corresponding to a timestamp of a last digital event included in the sequence of digital events,
a session time duration determined from a difference between the session end time and the session start time,
a digital account identifier indicating the distinct digital account used by the single actor to perform the sequence of digital events,
a representation of the one of the plurality of disparate computing environments where the sequence of digital events occurred,
the sequence of digital events performed by the single actor on the one of the plurality of disparate computing environments, and
identity and access data associated with the single actor.

### Claim 6 (depends on 5)

The computer-implemented method according to claim 5, wherein the identity and access data included in the respective individual session object includes:
an internet protocol address from which the single actor accessed the one of the plurality of disparate computing environments,
a geolocation derived from the internet protocol address,
an autonomous system number identifying a network organization from which the internet protocol address originates,
a user-agent identifying an interface or client application used by the single actor to perform the sequence of digital events.

### Claim 7 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
generating, using the network of distributed computers, a session information graphical user interface based on a target individual session object of the plurality of individual session objects, wherein a single actor used the distinct digital account of the target individual session object to perform the distinct set of digital events included in the target individual session object;
displaying, by the network of distributed computers, the session information graphical user interface to the subscribing entity, wherein:
a first portion of the session information graphical user interface includes at least a session start time of the target individual session object, a session end time of the target individual session object, a session time duration of the target individual session object, and identity and access data associated with the single actor, and
a second portion of the session information graphical user interface includes an interactive data table that includes a plurality of distinct interactive data rows, wherein each distinct interactive data row of the plurality of distinct interactive data rows:
corresponds to a respective digital event of the distinct set of digital events included in the target individual session object, and
includes a distinct column describing an event name of the respective digital event.

### Claim 8 (depends on 7)

The computer-implemented method according to claim 7, further comprising:
detecting an input from the subscribing entity hovering over the event name of a target interactive data row of the plurality of distinct interactive data rows;
in response to detecting the input from the subscribing entity, displaying a digital event explainability user interface object in association with the target interactive data row, wherein the event explainability user interface object includes one or more text strings providing a natural-language explanation of the respective digital event corresponding to the target interactive data row.

### Claim 9 (depends on 1)

The computer-implemented method according to claim 1, wherein:
executing the one or more session construction instructions against the normalized digital event data causes the network of distributed computers to:
detect a console login digital event that occurred within the normalized digital event data, wherein the console login digital event includes an account identifier indicating a subject computing environment where the console login digital event occurred; and
commence the construction of a subject individual session object of the plurality of individual session objects in response to the detection of the console login digital event, wherein constructing the subject individual session object includes:
appending the console login digital event to the subject individual session object;
assigning a session start time to the subject individual session object that corresponds to a timestamp of the console login digital event;
appending, to the subject individual session object, one or more subsequent digital events included in the normalized digital event data that follow the console login digital event and correspond to the account identifier of the console login digital event; and
assigning a session end time to the subject individual session object that corresponds to a timestamp of a respective subsequent digital event of the one or more subsequent digital events determined to occur last in time among the one or more subsequent digital events.

### Claim 10 (depends on 9)

The computer-implemented method according to claim 9, further comprising:
obtaining, by the network of distributed computers, additional event data at a different time than the digital event data;
in response to obtaining the additional event data, converting the additional event data into normalized event data that conforms to the target data schema specified by the identity-based threat detection and response service;
detecting, by the identity-based threat detection and response service, that at least one event included in the normalized event data is associated with the console login digital event, wherein the at least one event occurred after the one or more subsequent digital events;
appending, to the subject individual session object, the at least one event included in the normalized event data that is associated with the console login digital event; and
updating the session end time from the timestamp of the respective subsequent digital event determined to occur last in time to a new time value that corresponds to a timestamp of the at least one event.

### Claim 11 (depends on 10)

The computer-implemented method according to claim 10, wherein:
a single actor performed the console login digital event on the subject computing environment,
the subject computing environment is provided by a cloud service provider, and
the identity-based threat detection and response service detects the at least one event included in the normalized event data is associated with the console login digital event based on detecting at least one of:
that a session identifier attributed to the at least one event by the cloud service provider is equivalent to a session identifier attributed to the console login digital event by the cloud service provider,
the at least one event included in the normalized event data and the console login digital event originated from a same internet protocol address, and
the at least one event included in the normalized event data and the console login digital event were performed using a same hardware device associated with the single actor.

### Claim 12 (depends on 9)

The computer-implemented method according to claim 9, further comprising:
obtaining, by the network of distributed computers, additional event data at a different time than the digital event data;
in response to obtaining the additional event data, converting the additional event data into normalized event data that conforms to the target data schema specified by the identity-based threat detection and response service;
detecting, by the identity-based threat detection and response service, that at least one new event included in the normalized event data is not associated with the console login digital event and the one or more subsequent digital events, and
constructing a new individual session object different from the plurality of individual session objects in response to detecting that the at least new one event included in the normalized event data is not associated with the console login digital event and the one or more subsequent digital events, wherein constructing the new individual session object includes appending the at least one new event to the new individual session object.

### Claim 13 (depends on 12)

The computer-implemented method according to claim 12, wherein:
a single actor performed the console login digital event and the at least one new event on the subject computing environment;
the identity-based threat detection and response service detects the at least one new event included in the normalized event data is not associated with the console login digital event and the one or more subsequent digital events based on detecting at least one of:
an amount of time elapsed between the at least one new event and the one or more subsequent digital events is greater than a predetermined elapsed time threshold, and
a change in access data associated with the single actor for the at least one new event relative to access data associated with the subject individual session object.

### Claim 14 (depends on 12)

The computer-implemented method according to claim 12, wherein:
a same actor performed the console login digital event and the at least one new event;
the identity-based threat detection and response service detects the at least one new event included in the normalized event data is not associated with the console login digital event and the one or more subsequent digital events based on detecting at least one of:
an amount of time elapsed between the at least one new event and the one or more subsequent digital events is greater than a predetermined elapsed time threshold, and
a change in access data associated with the same actor between the at least one new event and the subject individual session object.

### Claim 15 (depends on 12)

The computer-implemented method according to claim 12, wherein:
a first user performed the console login digital event and the one or more subsequent digital events,
a second user performed the least one new event,
the first user is different from the second user,
the identity-based threat detection and response service detects the at least one new event is not associated with the console login digital event and the one or more subsequent digital events based on detecting a difference between a digital account identifier corresponding to the at least one new event and the account identifier corresponding to the console login digital event and the one or more subsequent digital events.

### Claim 16

A computer-implemented system comprising:
one or more processors;
a memory;
a computer-readable medium operably coupled to the one or more processors, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the one or more processors, cause a computing device to perform operations comprising:
obtaining digital event data that occurred on a plurality of disparate computing environments of a subscribing entity;
in response to obtaining the digital event data, converting the digital event data into normalized digital event data that conforms to a target data schema specified by an identity-based threat detection and response service;
constructing, for the subscribing entity in real-time or near real-time, a plurality of individual session objects detected across the plurality of disparate computing environments in response to executing one or more session construction instructions against the normalized digital event data, wherein:
each individual session object of the plurality of individual session objects includes a distinct set of digital events performed in a respective computing environment of the plurality of disparate computing environments by a distinct digital account during a distinct time span;
in response to constructing the plurality of individual session objects, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects;
generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects;
detecting, using the cross-environment session artifact, a root actor responsible for the distinct set of digital events performed across the target set of individual session objects;
detecting that the root actor accessed the respective computing environment associated with one of the target set of individual session objects using multi-factor authentication (MFA); and
displaying, within the cross-environment session artifact, an MFA user interface element that indicates MFA was used by the root actor to access the respective computing environment associated with the one of the target set of individual session objects.

### Claim 17 (depends on 16)

The computer-implemented system according to claim 16, wherein generating the plurality of session correlation links includes:
generating a first session correlation link of the plurality of session correlation links that connects a first individual session object of the plurality of individual session objects to a second individual session object of the plurality of individual session objects based on detecting a chronological relationship between the first individual session object and the second individual session object, wherein the chronological relationship is detected based on identifying that an amount of time elapsed between a session end time of the first individual session object and a session start time of the second individual session object is less than a predetermined elapsed-time threshold, and
generating a second session correlation link of the plurality of session correlation links that connects the second individual session object to a third individual session object of the plurality of individual session objects based on detecting a causal relationship between the second individual session object and the third individual session object, wherein the causal relationship is detected based on identifying that at least one digital event of the distinct set of digital events included in the second individual session object triggered or enabled the distinct set of digital events included in the third individual session object.

### Claim 18 (depends on 16)

The computer-implemented system according to claim 16, wherein:
the target set of individual session objects includes:
a first individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the first individual session object are performed on a first disparate computing environment of the plurality of disparate computing environments,
a second individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the second individual session object are performed on a second disparate computing environment of the plurality of disparate computing environments, and
a third individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the third individual session object are performed on a third disparate computing environment of the plurality of disparate computing environments, and
the computer-readable instructions, when executed by the one or more processors, cause the computing device to perform operations further comprising:
displaying, via a user interface (UI), the cross-environment session artifact, wherein the cross-environment session artifact includes:
a first session UI card representing the first individual session object,
a second session UI card representing the second individual session object,
a third session UI card representing the third individual session object,
a first directional graphical connector extending in a direction from the first session UI card to the second session UI card, and
a second directional graphical connector extending in a direction from the second session UI card to the third session UI card, wherein:
the first directional graphical connector and the second directional graphical connector graphically illustrate the directional access sequence, and
the directional access sequence indicates a directional flow of access by the root actor across the first disparate computing environment, the second disparate computing environment, and the third disparate computing environment.

### Claim 19 (depends on 16)

The computer-implemented system according to claim 16, wherein generating the plurality of session correlation links includes:
generating a first session correlation link of the plurality of session correlation links that connects a first individual session object of the plurality of individual session objects to a second individual session object of the plurality of individual session objects based on detecting the first individual session object and the second individual session object share at least a common internet protocol address,
generating a second session correlation link of the plurality of session correlation links that connects a third individual session object of the plurality of individual session objects to a fourth individual session object of the plurality of individual session objects based on detecting the third individual session object and the fourth individual session object share at least a common hardware device identifier, and
generating a third session link of the plurality of session correlation links that connects a fifth individual session object of the plurality of individual session objects to a sixth individual session object of the plurality of individual session objects based on Hypertext Transfer Protocol (HTTP) cookie data.

### Claim 20 (depends on 16)

The computer-implemented system according to claim 16, further comprising:
in response to constructing a respective individual session object of the plurality of individual session objects:
assessing the respective individual session object against a plurality of actor-type classification heuristics;
determining, in response to assessing the respective individual session object against the plurality of actor-type classification heuristics, the distinct set of digital events included in the respective individual session object was performed by a human actor or a non-human actor;
assessing, in real-time or near real-time, a security threat of the respective individual session object using-one of:
a first set of threat detection instructions operably configured to assess the distinct set of digital events of the respective individual session object as machine activity when the plurality of actor-type classification heuristics determines the distinct set of digital events included in the respective individual session object was performed by the non-human actor, and
a second set of threat detection instructions operably configured to assess the distinct set of digital events of the respective individual session object as human activity when the plurality of actor-type classification heuristics determines the distinct set of digital events included in the respective individual session object was performed by the human actor.

### Claim 21

A computer-implemented system comprising:
one or more processors;
a memory;
a computer-readable medium operably coupled to the one or more processors, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the one or more processors, cause a computing device to perform operations comprising:
obtaining digital event data that occurred on a plurality of disparate computing environments of a subscribing entity;
in response to obtaining the digital event data, converting the digital event data into normalized digital event data that conforms to a target data schema specified by an identity-based threat detection and response service;
constructing, for the subscribing entity in real-time or near real-time, a plurality of individual session objects detected across the plurality of disparate computing environments in response to executing one or more session construction instructions against the normalized digital event data, wherein:
each individual session object of the plurality of individual session objects includes a distinct set of digital events performed in a respective computing environment of the plurality of disparate computing environments by a distinct digital account during a distinct time span;
in response to constructing the plurality of individual session objects, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects, wherein the target set of individual session objects includes:
a first individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the first individual session object are performed on a first disparate computing environment of the plurality of disparate computing environments,
a second individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the second individual session object are performed on a second disparate computing environment of the plurality of disparate computing environments, and
a third individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the third individual session object are performed on a third disparate computing environment of the plurality of disparate computing environments;
generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects;
detecting, using the cross-environment session artifact, a root actor responsible for the distinct set of digital events performed across the target set of individual session objects; and
displaying, via a user interface (UI), the cross-environment session artifact, wherein the cross-environment session artifact includes:
a first session UI card representing the first individual session object,
a second session UI card representing the second individual session object,
a third session UI card representing the third individual session object,
a first directional graphical connector extending in a direction from the first session UI card to the second session UI card, and
a second directional graphical connector extending in a direction from the second session UI card to the third session UI card, wherein:
the first directional graphical connector and the second directional graphical connector graphically illustrate the directional access sequence, and
the directional access sequence indicates a directional flow of access by the root actor across the first disparate computing environment, the second disparate computing environment, and the third disparate computing environment.