Using Information Usage Data to Detect Behavioral Patterns and Anomalies
AssigneeNextLabs, Inc.
InventorKeng Lim
Life of this patent
Estimating the term…
Abstract
Activity data is analyzed or evaluated to detect behavioral patterns and anomalies. When a particular pattern or anomaly is detected, a system may send a notification or perform a particular task. This activity data may be collected in an information management system, which may be policy based. Notification may be by way e-mail, report, pop-up message, or system message. Some tasks to perform upon detection may include implementing a policy in the information management system, disallowing a user from connecting to the system, and restricting a user from being allowed to perform certain actions. To detect a pattern, activity data may be compared to a previously defined or generated activity profile.
Claims20
A method of operating a system comprising:
- providing a plurality of devices;
- providing an activity database;
- collecting information usage data from the plurality of devices in the activity database;
- analyzing the information usage data in the activity database to detect a condition;
- and
- when the condition is detected, generating a notification of the condition.
A method of operating a system comprising:
- providing a plurality of devices;
- providing an activity database, stored at a server;
- storing on a first device of the plurality of devices a first set of rules;
- storing on a second device of the plurality of devices a second set of rules, wherein the second set of rules is different from the first set of rules;
- upon a first operation requested by a first user at the first device of the plurality of devices, evaluating at the first device a first rule of the first set of rules stored at the first device;
- upon a second operation requested by a second user at the second device of the plurality of devices, evaluating at the second device a second rule of the second set of rules stored at the second device;
- at the server, collecting information usage data from the first and second devices in the activity database, wherein the information usage data comprises data associated with the first operation requested by the first user at the first device that caused evaluating at the first device the first rule of the first set of rules stored at the first device and data associated with the second operation requested by the second user at the second device that caused evaluating at the second device the second rule of the second set of rules stored at the second device;
- at the server, analyzing the information usage data in the activity database to detect a plurality of conditions that occurred at either the first or second devices, or both, wherein the plurality of conditions considered during the analyzing comprise:
- a first condition is detected when the first device or second device, or both, has attempted to access a unit of information more than X times in a Y time period;
- and
- a second condition is detected when a username has connected to the system from a first location E at a first time T1, via the first device, and the username has connected to the system from a second location F at a second time T2, via the second device, and a distance between the first location E and the second location F divided by (T2−T1) is greater than Z;
- when one or more of the plurality of conditions is detected, generating a notification of the one or more conditions detected.
Dependencies are inferred from the claim text.