Systems and methods for detecting and monitoring suspicious system activity

A server computer comprising:

• a processor;
• and
• a computer-readable medium coupled with the processor, the computer-readable medium comprising instructions stored thereon that are executable by the processor to cause a computing device to perform operations comprising:
• receiving a plurality of categories of data, wherein each category of the plurality of categories of data comprises at least one subcategory;
• receiving a weight associated with each subcategory of each category of the plurality of categories of data;
• storing the plurality of categories of data and associated subcategories and the weight associated with each subcategory of each category of the plurality of categories of data;
• determining that an activity occurring in a system has triggered a risk analysis;
• determining a user associated with the activity;
• compiling data related to the user associated with the activity;
• analyzing the data related to the user and determining one or more subcategories for the data;
• analyzing the one or more subcategories for the data and determining a risk rating for the user based on the weight of each of the one or more subcategories;
• comparing the risk rating to one or more predetermined threshold values to determine an alert value for the user;
• and
• storing the risk rating for the user, the alert value for the user, and the data related to the user.

A computer-readable medium comprising instructions stored thereon that are executable by at least one processor to cause a computing device to perform operations comprising:

• receiving a plurality of categories of data, wherein each category of the plurality of categories of data comprises at least one subcategory;
• receiving a weight associated with each subcategory of each category of the plurality of categories of data;
• storing the plurality of categories of data and associated subcategories and the weight associated with each subcategory of each category of the plurality of categories of data;
• determining that an activity occurring in a system has triggered a risk analysis;
• determining a user associated with the activity;
• compiling data related to the user associated with the activity;
• analyzing the data related to the user and determining one or more subcategories for the data;
• analyzing the one or more subcategories of the data and determining a risk rating for the user based on the weight of each of the one or more subcategories;
• comparing the risk rating to one or more predetermined threshold values to determine an alert value for the user;
• and
• storing the risk rating for the user, the alert value for the user, and the data related to the user.