User behavioral risk assessment
AssigneeMcAfee, Inc.
InventorsPrasanna Ganapathi Basavapatna, Michael Mason Moyle, Sven Schrecker
Life of this patent
Estimating the term…
Abstract
A predetermined particular behavioral profile is identified associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system. Activities associated with use of the computing system by the particular user are identified and it is determined whether the identified activities correlate with the particular behavioral profile. Identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.
Claims23
A method comprising:
- identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;
- identifying, using at least one computer processing device, activities associated with use of the computing system by the particular user;
- and
- determining whether the identified activities correlate with the particular behavioral profile, wherein identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.
The method of 1, wherein the particular behavioral profile is based on a plurality of inputs received from a plurality of security tools providing security services within the computing system.
Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
- identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;
- identifying activities associated with use of the computing system by the particular user;
- and
- determining whether the identified activities correlate with the particular behavioral profile, wherein identifying an activity that deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user.
A system comprising:
- at least one processor device;
- at least one memory element;
- and
- a user behavioral risk analysis engine, adapted when executed by the at least one processor device to:
- identify a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of the at least one user within the computing system;
- identify a particular activity associated with use of the computing system by the particular user;
- and
- determine whether the particular identified activity deviates from the particular behavioral profile beyond a particular threshold.
Dependencies are inferred from the claim text.