Automated computer behavioral analysis system and methods
AssigneeSoliton Systems K.K.
InventorsTetsuo Fujisawa, Cheree James, Tedd Hadley, Jay C. Kim
Life of this patent
Estimating the term…
Abstract
Events related to an end-point connected with one or more devices are recorded and collected to observe end-point behavior and determine the risk of unfavorable conduct occurring on a network/system. The analysis may include a behavioral analysis that matches events to behaviors, and scores behaviors along factors or parameters of fraud including opportunity (O), pressure (P), and rationalization (R). Malicious behavior may be anticipated or identified prior to commission, allowing preventative measures to be taken or behavior intercepted within the early stages.
Claims20
A system for securing a networked endpoint connected with one or more devices, comprising:
- a data collection device and an analysis device;
- the data collection device, comprising instructions stored in a non-volatile data collection device memory that when executed by a data collection device processor configure the data collection device to:
- passively monitor, one or more devices associated with a user;
- create, an event log based on the monitored one or more devices, wherein the event log includes events associated with the user;
- the analysis device, comprising instructions stored in a non-volatile analysis device memory that when executed by an analysis device processor configure the analysis device to:
- determine, based on accessing the event log, an opportunity indicator of behavior (IoB) for the user;
- determine, based on the event log, a pressure IoB for the user;
- determine, based on the event log, a rationalization IoB for the user;
- determine, based on the opportunity IoB, an opportunity score;
- determine, based on the pressure IoB, a pressure score;
- determine, based on the rationalization IoB, a rationalization score;
- determine an OPR score, for the user based on the opportunity score, pressure score, and rationalization score;
- determine a security risk score threshold;
- determine whether the security risk score exceeds the security risk score threshold, and in circumstances that the security risk score exceeds the security risk score threshold, the analysis device is further configured to:
- access search and website data associated with the user, wherein the search and website data comprises a result of a keyword-based analysis of unstructured data related to the user;
- determine, search and website data, a search and website data score;
- determine, a user risk score for the user based on the OPR score and the search and website data score;
- compare, the user risk score to a final security risk score threshold, to determine if the user is a security threat.
An analysis device for securing a networked endpoint connected with one or more devices, comprising:
- processing circuitry configured to:
- receive an event log for one or more devices, wherein the event log includes events associated with a user of the one or more devices;
- determine, based on accessing the event log, an opportunity indicator of behavior (IoB) for the user;
- determine, based on the event log, a pressure IoB for the user;
- determine, based on the event log, a rationalization IoB for the user;
- determine, based on the opportunity IoB, an opportunity score;
- determine, based on the pressure IoB, a pressure score;
- determine, based on the rationalization IoB, a rationalization score;
- determine an OPR score, for the user based on the opportunity score, pressure score, and rationalization score;
- determine a security risk score threshold;
- determine whether the security risk score exceeds the security risk score threshold, and in circumstances when the security risk score exceeds the security risk score threshold, the processing circuitry is further configured to:
- access search and website data associated with the user, wherein the search and website data comprises a result of a keyword-based analysis of unstructured data related to the user;
- determine, search and website data, a search and website data score;
- determine, a user risk score for the user based on the OPR score and the search and website data score;
- compare, the user risk score to a final security risk score threshold, to determine if the user is a security threat.
Dependencies are inferred from the claim text.