# US 2021/0240835 A1 · External Trigger Induced Behavioral Analyses > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240835 A1 - Document ID: US20210240835A1 - Status: Published application - Kind: A1 - Application number: 16/780,428 - Filed: 2020-02-03 - Published: 2021-08-05 - Earliest claimed: 2020-02-03 - Assignees: Forcepoint LLC - Applicants: Forcepoint, LLC - Inventors: Sri Koganti - Web page: https://patentgrep.com/patent/US20210240835A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A mechanism is provided for using triggered stimuli to enhance contextual information regarding detected risk events in a networked system. Embodiments monitor a system to identify risk-associated behavior, and upon detecting such behavior, can provide stimulus to a user associated with the risk-associated behavior to determine additional context behind the behavior, thereby initiating a two-way communication to acquire more information. If user response to the stimulus indicates a high risk associated with the behavior, then the system can trigger security measures to restrict the behavior. Some embodiments provide stimuli that are directly related to the nature of the risk-associated behavior, in order to better contextualize the behavior. In some embodiments, the stimuli are only applied if the risk-associated behavior presents a measure of risk above a predetermined threshold. ## Claims ### Claim 1 A computer-implemented method for developing context of risk-associated behavior in a security analytics environment, the method comprising: monitoring a first plurality of electronically-observable actions of a user entity operating within the security analytics environment, wherein the first plurality of electronically-observable actions of the user entity correspond to a respective plurality of events enacted by the user entity; converting the first plurality of electronically-observable actions of the user entity to electronic information representing the plurality of events enacted by the user entity; generating a risk adaptive score based on the electronic information representing the plurality of events enacted by the user entity; and generating one or more stress triggers at an endpoint device in the security analytics environment accessed by the user entity if the risk adaptive score exceeds a predetermined threshold in order to develop a context of the first plurality of electronically-observable actions of the user entity. ### Claim 2 (depends on 1) The method of claim 1 further comprising subsequent to said generating the one or more stress triggers: monitoring a second plurality of electronically-observable actions of the user entity, wherein the second plurality of electronically-observable actions of the user entity correspond to a respective second plurality of events enacted by the user entity and the second plurality of events are in response to one or more of the stress triggers; converting the second plurality of electronically-observable actions of the user entity to second electronic information representing the second plurality of actions by the user entity; modifying the risk adaptive score in response to the second plurality of electronically-observable actions; and responding to the first and second plurality of electronically-observable actions of the user entity if the modified risk adaptive score exceeds a second predetermined threshold. ### Claim 3 (depends on 2) The method of claim 2 wherein said responding to the first and second plurality of electronically-observable actions comprises reducing a risk presented by the first plurality of electronically-observable actions of the user entity to a system encompassed within the security analytics environment. ### Claim 4 (depends on 2) The method of claim 2 wherein said responding to the first and second plurality of electronically-observable actions comprises one or more of logging the user entity off the endpoint device, shutting down the endpoint device, cancelling a process executed by the user entity, signaling a security administrator, and signaling the user entity. ### Claim 5 (depends on 2) The method of claim 2 wherein the second plurality of electronically-observable actions of the user entity comprise physical behavior interactions with the endpoint device comprising one or more of key stroke impact, key stroke speed, misspelling words, facial expressions, and movement of a gesture input device. ### Claim 6 (depends on 2) The method of claim 2 wherein the second plurality of electronically-observable actions of the user entity comprise cyber behavior interactions with the endpoint device comprising one or more of discontinuing file access, disconnecting a storage device from the endpoint device, closing a display window on a display coupled to the endpoint device, changing an operational state of the endpoint device, and closing a lid of the endpoint device. ### Claim 7 (depends on 1) The method of claim 1 wherein the one or more stress triggers comprise one or more of: modifying brightness of a screen coupled to the endpoint device; modifying display speed of a gesture input device coupled to the endpoint device; modifying responsiveness of a gesture input device coupled to the endpoint device; temporarily swapping one or more key associations of a keyboard coupled to the endpoint device; generating a sound on a speaker coupled to the endpoint device; displaying a popup window on the screen coupled to the endpoint device; and sending an electronic mail message to the user entity. ### Claim 8 (depends on 1) The method of claim 1 further comprising performing said generating the one or more stress triggers if the first plurality of electronically-observable actions are identified as risk-associated behavior. ### Claim 9 (depends on 8) The method of claim 8 wherein a risk-associated behavior comprises one or more of accessing data labeled as critical, accessing customer data, copying significant quantities of data to a removable memory device, copying significant quantities of data across a network external to the security analytics environment. ### Claim 10 A security analytics system comprising: a processor; a network interface, coupled to the processor and communicatively coupled to a remote network node via a network, and configured to receive electronic information representing a first plurality of events enacted by a user entity accessing the remote network node; and a nontransitory, computer-readable storage medium, coupled to the processor, and storing instructions executable by the processor and configured to generate a risk adaptive score based on the electronic information representing the first plurality of events enacted by the user entity, and transmit a signal to the remote network node to generate one or more stress triggers at the remote network node if the risk adaptive score exceeds a predetermined threshold in order to develop a context of the first plurality of events enacted by the user entity. ### Claim 11 (depends on 10) The system of claim 10 wherein the network interface is configured to receive second electronic information representing a second plurality of events enacted by a user entity accessing the remote network node; and the non-transitory, computer-readable storage medium stores further instructions executable by the processor configured to modify the risk adaptive score in response to the electronic information representing the second plurality of events, and respond to the first and second plurality of events if the modified risk adaptive score exceeds a second predetermined threshold. ### Claim 12 (depends on 11) The system of claim 11 wherein responding to the first and second plurality of events comprises reducing a risk presented by the first plurality of events to an environment secured by the security analytics system. ### Claim 13 (depends on 11) The system of claim 11 wherein responding to the first and second plurality of events comprises one or more of transmitting a signal to the remote network node to log the user entity off the remote network node; transmitting a signal to the remote network node to shut down the remote network node; transmitting a signal to the remote network node to cancel a process executed by the user entity; transmitting a signal to a security administrator of the security analytics system; and transmitting a signal to the user entity. ### Claim 14 (depends on 11) The system of claim 11 wherein the second plurality of events comprises physical behavior interactions with the remote network device comprising one or more of key stroke impact, key stroke speed, misspelling words, facial expressions, and movement of a gesture input device. ### Claim 15 (depends on 11) The system of claim 11 wherein the second plurality of events comprises cyber behavior interactions with the remote network device comprising one or more of discontinuing file access, disconnecting a storage device from the remote network node, closing a display window on a display coupled to the remote network node, changing an operational state of the remote network node, and closing a lid of the remote network node. ### Claim 16 (depends on 10) The system of claim 10 wherein the one or more stress triggers comprise one or more of: modifying display speed of a gesture input device coupled to the endpoint device; modifying responsiveness of a gesture input device coupled to the endpoint device; temporarily swapping one or more key associations of a keyboard coupled to the endpoint device; generating a sound on a speaker coupled to the endpoint device; displaying a popup window on the screen coupled to the endpoint device; and sending an electronic mail message to the user entity. ### Claim 17 (depends on 10) The system of claim 10 wherein the non-transitory, computer-readable storage medium stores further instructions executable by the processor configured to transmit the signal to the remote network node to generate the one or more stress triggers if the first plurality of electronically-observable actions are identified as risk-associated behavior. ### Claim 18 (depends on 17) The system of claim 17 wherein a risk-associated behavior comprises one or more of accessing data labeled as critical, accessing customer data, copying significant quantities of data to a removable memory device, copying significant quantities of data across a network external to the security analytics environment. ### Claim 19 A non-transitory, computer-readable storage medium storing computer program code, the computer program code comprising computer executable instructions configured for: monitoring a first plurality of electronically-observable actions of a user entity operating within a security analytics environment, wherein the plurality of electronically-observable actions of the user entity correspond to a respective plurality of events enacted by the user entity; converting the plurality of electronically-observable actions of the user entity to electronic information representing the plurality of actions by the user entity; generating a risk adaptive score based on the electronic information representing the plurality of actions by the user entity; and generating one or more stress triggers at an endpoint device in the security analytics environment accessed by the user entity if the risk adaptive score exceeds a predetermined threshold in order to develop a context of the first plurality of electronically-observable actions of the user entity. ### Claim 20 (depends on 19) The non-transitory, computer-readable storage medium storing computer program code of claim 19 further comprising computer executable instructions configured for, subsequent to said generating the one or more stress triggers: monitoring a second plurality of electronically-observable actions of the user entity, wherein the second plurality of electronically-observable actions of the user entity correspond to a respective second plurality of events enacted by the user entity and the second plurality of events are in response to one or more of the stress triggers; converting the second plurality of electronically-observable actions of the user entity to second electronic information representing the second plurality of actions by the user entity; modifying the risk adaptive score in response to the second plurality of electronically-observable actions; and responding to the first and second plurality of electronically-observable actions of the user entity if the modified risk adaptive score exceeds a second predetermined threshold.