Identifying anomalous behavior of end users or end user devices
AssigneeFortinet, Inc.
InventorsVikram Kapoor, Harish Kumar Bharat Singh, Weifei Zeng, Vimalkumar Jeyakumar, Theron Tock, Ying Xie, Yijou Chen
Life of this patent
Estimating the term…
Abstract
Identifying anomalous behavior of end users or end user devices, including: detecting that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user; determining device activity for the device; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location.
Claims20
A method of identifying anomalous behavior of end users or end-user devices, the method comprising:
- detecting that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user by:
- performing, by the device, one or more short-range wireless device discovery operations;
- detecting, via the one or more short-range wireless device discovery operations, one or more nearby wireless devices within a threshold proximity of the device;
- identifying device types associated with the one or more nearby wireless devices;
- and
- determining a physical environment classification for the known location based at least in part on the identified device types associated with the one or more nearby devices;
- determining device activity for the device;
- and
- detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location, wherein normal activity for the user is determined based on historical usage of the device.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, the processing device configured to:
- detect that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user by:
- performing, by the device, one or more short-range wireless device discovery operations;
- detecting, via the one or more short-range wireless device discovery operations, one or more nearby wireless devices within a threshold proximity of the device;
- identifying device types associated with the one or more nearby wireless devices;
- and
- determining a physical environment classification for the known location based at least in part on the identified device types associated with the one or more nearby devices;
- determine device activity for the device;
- and
- detect, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location, wherein normal activity for the user is determined based on historical usage of the device.
A non-transitory computer readable storage medium storing instructions which, when executed, cause a processing device to:
- detect that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user by:
- performing, by the device, one or more short-range wireless device discovery operations;
- detecting, via the one or more short-range wireless device discovery operations, one or more nearby wireless devices within a threshold proximity of the device;
- identifying device types associated with the one or more nearby wireless devices;
- and
- determining a physical environment classification for the known location based at least in part on the identified device types associated with the one or more nearby devices;
- determine device activity for the device;
- and
- detect, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location, wherein normal activity for the user is determined based on historical usage of the device.
Dependencies are inferred from the claim text.