Cyber security enhanced monitoring
AssigneeJPMorgan Chase Bank, N.A.
InventorsMackenzie KYLE, Benjamin ARNOLD, Brandley N. GUNNER, Rohith KONDETI, Michael MONTE
Life of this patent
Estimating the term…
Abstract
Systems for and methods of detecting cyber-attacks by selecting a group of users and monitoring those user's computer systems for behavior that indicates a series of actions reflecting behavior indicative of a cyber-attack.
Claims18
A system for detecting behavior associated with a potential security breach of an enterprise, the system comprising:
- a computing device;
- a network in communication with the computer device;
- a baseline generation and monitoring system in communication with the network;
- a correlation/alert generator in communication with the network;
- and
- a memory storing instructions that when executed, cause the baseline generation and monitoring system to:
- identify an employee of the enterprise that represents an elevated risk of contributing to the potential security breach where the computing device is associated with the employee;
- store a list of predetermined behaviors indicative of the potential security breach;
- determine a baseline of the computing device behaviors;
- monitor the computing device associated with the identified employee for occurrence of a behavior that exceeds the baseline;
- monitor the behavior of the computing device for an occurrence of a second behavior that is related to the first behavior;
- and
- generate an alert using the correlation and alert generator if both the first behavior and second behavior occurs.
A method of detecting behavior associated with a potential security breach of an enterprise, the method comprising:
- identifying an employee of the enterprise that represents an elevated risk of contributing to the potential security breach;
- providing a list of predetermined behaviors indicative of the potential security breach;
- determining a baseline of the behaviors;
- monitoring a network for activity associated with the employee for occurrence of any of the behaviors that exceeds the baseline;
- and
- generating an alert if at least one of the behaviors is detected from the network activity.
A method of detecting behavior associated with a potential security breach of an enterprise, the method comprising:
- identifying an employee of the enterprise that represents an elevated risk of contributing to the potential security breach;
- providing a list of predetermined behaviors indicative of the potential security breach;
- storing network activity of the employee in an event log;
- determining a baseline of the behaviors indicative of the potential security breach comprising at least one of:
- email activity, process activity, installations, register modifications, new proxy connections, new user agents, new user connections, new source authorizations, new attempted accesses, or new outbound data connections;
- generating a whitelist of network activities from the network activity
- developing use cases based on cyber-attack methodology;
- monitoring the network activity;
- detecting a network activity that is not included on the whitelist of activities;
- comparing the detected activity to the use cases;
- upon detection of network activity that satisfies a use case, monitoring the network activity for activity that satisfies a second use case that is related to the first use case;
- and
- generating an alert if network activity compares to at least one second use case.
Dependencies are inferred from the claim text.