# US 2019/0173908 A1 · Automatic User Session Profiling System for Detecting Malicious Intent > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173908 A1 - Document ID: US20190173908A1 - Status: Published application - Kind: A1 - Application number: 15/832,164 - Filed: 2017-12-05 - Published: 2019-06-06 - Earliest claimed: 2017-12-05 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Russell L. Couturier; Michael Hanner; Iosif V. Onut; Ronald B. Williams - Web page: https://patentgrep.com/patent/US20190173908A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for analyzing past user sessions for malicious intent. A security incident is detected by a computer system. Responsive to detecting the security incident, a forensic investigation is triggered by the computer system using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product. ## Claims ### Claim 1 A method for analyzing past user sessions for malicious intent, the method comprising: detecting, by a computer system, a security incident; and responsive to detecting the security incident, triggering, by the computer system, a forensic investigation using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product. ### Claim 2 (depends on 1) The method of claim 1, wherein triggering the forensic investigation using the set of security rules for detecting the web site vulnerability comprises: identifying a set of past user sessions for a current user identified in the security incident; and applying the set of security rules to the set of past user sessions for the current user to identify a group of other security incidents associated with the current user. ### Claim 3 (depends on 2) The method of claim 2, wherein applying the set of security rules to the set of past user session to identify the group of other security incidents associated with the current user comprises: applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify the group of other security incidents associated with the current user. ### Claim 4 (depends on 2) The method of claim 2, wherein applying the set of security rules to the set of past user sessions to identify the group of other security incidents associated with the current user comprises: applying the set of security rules to patterns of network traffic to a past user session in the set of past user sessions for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify the group of other security incidents associated with the current user. ### Claim 5 (depends on 1) The method of claim 1, wherein detecting the security incident comprises: detecting the security incident using at least one of an intrusion protection system, an intrusion detection system, or a security information and event management system. ### Claim 6 (depends on 1) The method of claim 1 further comprising: identifying the set of past user sessions in a database; and performing the forensic investigation on the set of past user sessions using the set of security rules for detecting the web site vulnerability in which the set of security rules is applied to the set of past user sessions. ### Claim 7 (depends on 1) The method of claim 1 further comprising: configuring the dynamic analysis product, comprising a set of security tests for detecting the website vulnerability, and to a forensic analysis product, configured to analyze patterns of network traffic to investigate security incidents in the forensic investigation, to communicate with each other. ### Claim 8 (depends on 1) The method of claim 1 further comprising: downloading a database of the set of security rules associated with the dynamic analysis product for use by a forensic analysis product to perform the forensic investigation. ### Claim 9 A computer system comprising: a processor unit; and a forensic analysis product running on the processor unit, wherein the forensic analysis product, responsive to detecting a security incident, triggering a forensic investigation using a set of security rules for detecting web site vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product. ### Claim 10 (depends on 9) The computer system of claim 9, wherein the forensic analysis product triggers the forensic investigation using the set of security rules for detecting the web site vulnerability by identifying the set of past user sessions for a current user identified in the security incident and applying the set of security rules to the set of past user sessions for the current user to identify other security incidents associated with the current user. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the forensic analysis product applies the set of security rules to the set of past user session to identify a group of the other security incidents associated with the current user by applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify the group of the other security incidents associated with the current user. ### Claim 12 (depends on 10) The computer system of claim 10, wherein the forensic analysis product applies the set of security rules to a current user session to identify the group of the other security incidents associated with the current user comprises: applying the set of security rules to patterns of network traffic for a past user session for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify the group of the other security incidents associated with the current user. ### Claim 13 (depends on 9) The computer system of claim 9, wherein the forensic analysis product detects the security incident by receiving an indication from at least one of an intrusion protection system, an intrusion detection system, or a security information and event management system. ### Claim 14 (depends on 9) The computer system of claim 9, wherein the forensic analysis product identifies the set of past user sessions in a database and performs the forensic investigation on the set of past user sessions using the set of security rules for detecting the website vulnerability in which the set of security rules is applied to the set of past user sessions. ### Claim 15 (depends on 9) The computer system of claim 9, wherein the forensic analysis product communicates with the dynamic analysis product, comprising a set of security rules for detecting the website vulnerability, to receive the set of security rules. ### Claim 16 (depends on 9) The computer system of claim 9, wherein the forensic analysis product downloads a database of security rules associated with the dynamic analysis product for use by the forensic analysis product to perform the forensic investigation. ### Claim 17 A computer program product for analyzing user sessions for malicious intent, the computer program product comprising: a computer-readable storage media; first program code, stored on the computer-readable storage media, for detecting a security incident; and second program code, stored on the computer-readable storage media, for triggering a forensic investigation using a set of security rules for detecting web site vulnerability in response to detecting the security incident, in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the second program code comprises: program code, stored on the computer-readable storage media, for identifying the set of past user sessions for a current user identified in the security incident; and program code, stored on the computer-readable storage media, for applying the set of security rules to the set of past user sessions for the current user to identify other security incidents associated with the current user. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the program code for applying the set of security rules to the set of past user sessions to identify the other security incidents associated with the current user comprises: program code, stored on the computer-readable storage media, for applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify a group of the other security incidents associated with the current user. ### Claim 20 (depends on 18) The computer program product of claim 18, wherein the program code for applying the set of security rules to the set of past user sessions for the current user to identify the other security incidents associated with the current user comprises: program code, stored on the computer-readable storage media, for applying the set of security rules to patterns of network traffic to a past user session in the set of past user sessions for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify a group of the other security incidents associated with the current user.