# US 2019/0356699 A1 · Dividing Events into Sessions During Adaptive Trust Profile Operations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356699 A1 - Document ID: US20190356699A1 - Status: Published application - Kind: A1 - Application number: 16/530,740 - Filed: 2019-08-02 - Published: 2019-11-21 - Earliest claimed: 2017-05-15 - Assignees: Forcepoint LLC - Applicants: Forcepoint LLC - Inventors: Richard A. Ford - Web page: https://patentgrep.com/patent/US20190356699A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, method, and computer-readable medium are disclosed for generating an adaptive trust profile via an adaptive trust profile operation. In various embodiments the adaptive trust profile operation includes: monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; and generating the adaptive trust profile based upon the plurality of actions of the entity, the adaptive trust profile being generated by an adaptive trust profile system. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A computer-implementable method for generating an adaptive trust profile, comprising: monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; performing a sessionalization operation on the electronic information representing the plurality of actions of the entity, the sessionalization operation associating a first set of the plurality of actions of the entity with a first session and a second set of the plurality of actions of the entity with a second session; and generating the adaptive trust profile based upon the plurality of actions of the entity, the first session and the second session. ### Claim 22 (depends on 21) The method of claim 21, wherein: the first set of the plurality of actions of the entity correspond to a first interval of time, the first interval of time corresponding to the first session and the second set of the plurality of actions of the entity correspond to a second interval of time, the second interval of time corresponding to the second session. ### Claim 23 (depends on 22) The method of claim 22, wherein: the first session and the second session are at least one of contiguous and noncontiguous, but associated. ### Claim 24 (depends on 22) The method of claim 22, wherein: the first interval of time corresponding to the first session overlaps with the second interval of time corresponding to the second session. ### Claim 25 (depends on 21) The method of claim 21, wherein: a third set of the plurality of actions of the entity is associated with a third session, the third session corresponding to a third interval of time; and, the first interval of time overlaps with the third interval of time. ### Claim 26 (depends on 21) The method of claim 21, further comprising: performing an anomaly detection operation based upon the adaptive trust profile and the first session and the second session, the anomaly detection operation determining whether the event is of analytic utility. ### Claim 27 A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; performing a sessionalization operation on the electronic information representing the plurality of actions of the entity, the sessionalization operation associating a first set of the plurality of actions of the entity with a first session and a second set of the plurality of actions of the entity with a second session; and generating the adaptive trust profile based upon the plurality of actions of the entity, the first session and the second session. ### Claim 28 (depends on 27) The system of claim 27, wherein: the first set of the plurality of actions of the entity correspond to a first interval of time, the first interval of time corresponding to the first session and the second set of the plurality of actions of the entity correspond to a second interval of time, the second interval of time corresponding to the second session. ### Claim 29 (depends on 28) The system of claim 28, wherein: the first session and the second session are at least one of contiguous and noncontiguous, but associated. ### Claim 30 (depends on 28) The system of claim 28, wherein: the first interval of time corresponding to the first session overlaps with the second interval of time corresponding to the second session. ### Claim 31 (depends on 27) The system of claim 27, wherein: a third set of the plurality of actions of the entity is associated with a third session, the third session corresponding to a third interval of time; and, the first interval of time overlaps with the third interval of time. ### Claim 32 (depends on 21) The system of claim 21, wherein the instructions executable by the processor are further configured for: performing an anomaly detection operation based upon the adaptive trust profile and the first session and the second session, the anomaly detection operation determining whether the event is of analytic utility. ### Claim 33 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; performing a sessionalization operation on the electronic information representing the plurality of actions of the entity, the sessionalization operation associating a first set of the plurality of actions of the entity with a first session and a second set of the plurality of actions of the entity with a second session; and generating the adaptive trust profile based upon the plurality of actions of the entity, the first session and the second session. ### Claim 34 (depends on 33) The non-transitory, computer-readable storage medium of claim 33, wherein: the first set of the plurality of actions of the entity correspond to a first interval of time, the first interval of time corresponding to the first session and the second set of the plurality of actions of the entity correspond to a second interval of time, the second interval of time corresponding to the second session. ### Claim 35 (depends on 34) The non-transitory, computer-readable storage medium of claim 34, wherein: the first session and the second session are at least one of contiguous and noncontiguous, but associated. ### Claim 36 (depends on 34) The non-transitory, computer-readable storage medium of claim 34, wherein: the first interval of time corresponding to the first session overlaps with the second interval of time corresponding to the second session. ### Claim 37 (depends on 33) The non-transitory, computer-readable storage medium of claim 33, wherein: a third set of the plurality of actions of the entity is associated with a third session, the third session corresponding to a third interval of time; and, the first interval of time overlaps with the third interval of time. ### Claim 38 (depends on 37) The non-transitory, computer-readable storage medium of claim 37, wherein the computer executable instructions further configured for: performing an anomaly detection operation based upon the adaptive trust profile and the first session and the second session, the anomaly detection operation determining whether the event is of analytic utility. ### Claim 39 (depends on 33) The non-transitory, computer-readable storage medium of claim 33, wherein: the computer executable instructions are deployable to a client system from a server system at a remote location. ### Claim 40 (depends on 33) The non-transitory, computer-readable storage medium of claim 33, wherein: the computer executable instructions are provided by a service provider to a user on an on-demand basis.