# US 2021/0342467 A1 · Dynamic policy based on user experience > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0342467 A1 - Document ID: US20210342467A1 - Status: Published application - Kind: A1 - Application number: 17/373,916 - Filed: 2021-07-13 - Published: 2021-11-04 - Earliest claimed: 2018-04-13 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Joseph H. Levy; Andrew J. Thomas; Daniel Salvatore Schiappa; Kenneth D. Ray - Web page: https://patentgrep.com/patent/US20210342467A1 ## CPC - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)} - G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)} - G06F 16/285: {Clustering or classification} - G06F 16/93: Document management systems - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06N 3/0675: {using electro-optical, acousto-optical or opto-electronic means} - G06N 5/046: Forward inferencing; Production systems - G06N 5/048: Fuzzy inferencing - G06N 20/00: Machine learning - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/16: the keys or algorithms being changed during operation - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L 9/3271: {using challenge-response} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 41/20: {Network management software packages} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0838: {using one-time-passwords} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 2221/034: Test or assess a computer or a system - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 2463/082: applying multi-factor authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Entity models are used to evaluate potential risk of entities, either individually or in groups, in order to evaluate suspiciousness within an enterprise network. These individual or aggregated risk assessments can be used to adjust the security policy for compute instances within the enterprise network. A security policy may specify security settings such as network speed, filtering levels, network isolation, levels of privilege, and the like. ## Claims ### Claim 1 A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of: storing an entity model for an entity at a threat management facility for an enterprise network, the entity including at least one of an identity and access management system, a domain controller, a physical device, a user, an operating system, or an application associated with the enterprise network, and the entity model characterizing a baseline of expected events based on events from the entity over an historical window as a vector in an event vector space; instrumenting a compute instance associated with the entity to report event vectors based on one or more events from one or more sensors associated with the compute instance; receiving an event stream at the threat management facility, the event stream including a plurality of event vectors from the compute instance; monitoring the event stream and creating the entity model based on a baseline of event vectors for the entity in the event stream over an interval, wherein the interval is algorithmically determined; calculating a risk score for the compute instance based on a distance between the entity model and one or more event vectors in the event stream in the event vector space; and adjusting local monitoring activity on the compute instance to increase a level of local activity monitoring when the risk score indicates a deviation from the baseline. ### Claim 2 (depends on 1) The computer program product of claim 1, wherein the historical window is algorithmically determined. ### Claim 3 (depends on 1) The computer program product of claim 1, wherein the threat management facility stores a plurality of entity models for a plurality of different entity types within the enterprise network. ### Claim 4 (depends on 1) The computer program product of claim 1, wherein the event stream includes event vectors from a plurality of compute instances associated with the enterprise network. ### Claim 5 (depends on 1) The computer program product of claim 1, wherein the event stream includes event vectors from two or more different entities associated with the compute instance. ### Claim 6 (depends on 1) The computer program product of claim 1, further comprising code that performs the step of refining the entity model based on additional event vectors in the event stream received after the entity model is created. ### Claim 7 (depends on 6) The computer program product of claim 6, wherein the step of refining the entity model is based on an interval determined from information contained in the additional event vectors. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein refining the entity model is based on a distance in the event vector space between the entity model and one or more of the additional event vectors in the event stream. ### Claim 9 (depends on 1) The computer program product of claim 1, wherein instrumenting the compute instance includes configuring the compute instance to normalize at least one of the events from at least one of the one or more sensors. ### Claim 10 (depends on 1) The computer program product of claim 1, wherein instrumenting the compute instance includes configuring the compute instance to tokenize at least one of the events from at least one of the one or more sensors. ### Claim 11 (depends on 1) The computer program product of claim 1, wherein instrumenting the compute instance includes configuring the compute instance to encrypt at least one of the events from at least one of the one or more sensors. ### Claim 12 (depends on 1) The computer program product of claim 1, wherein instrumenting the compute instance includes prioritizing at least one of the events from at least one of the one or more sensors. ### Claim 13 (depends on 1) The computer program product of claim 1, wherein the distance is at least one of a Mahalanobis distance, a Euclidean distance, and a Minkowski distance. ### Claim 14 (depends on 1) The computer program product of claim 1, wherein the distance is evaluated using a k-nearest neighbor algorithm. ### Claim 15 A method, comprising: storing an entity model at a threat management facility for an enterprise network, the entity model characterizing expected events for an entity; instrumenting a compute instance in the enterprise network to detect one or more events and report a number of event vectors including the one or more events to the threat management facility; receiving an event stream of the number of event vectors from the compute instance at the threat management facility; monitoring the event stream and creating the entity model based on a baseline of event vectors for the entity in the event stream over an interval, wherein the interval is algorithmically determined; calculating a risk score for the compute instance based on a comparison of one or more of the event vectors in the event stream with the entity model for the entity; and adjusting local monitoring activity on the compute instance to increase a level of local activity monitoring when the risk score indicates a deviation from the baseline. ### Claim 16 (depends on 15) The method of claim 15, further comprising refining the entity model based on additional event vectors in the event stream received after the entity model is created. ### Claim 17 (depends on 16) The method of claim 16, wherein refining the entity model is based on an interval determined from information contained in the additional event vectors. ### Claim 18 (depends on 15) The method of claim 15, wherein the event stream includes event vectors from a plurality of compute instances associated with the enterprise network. ### Claim 19 (depends on 15) The method of claim 15, wherein the event stream includes event vectors from two or more different entities associated with the compute instance. ### Claim 20 A system, comprising: a compute instance in an enterprise network, the compute instance configured to detect one or more events associated with the compute instance and to report an event vector including the one or more events to a remote resource; and a threat management facility, the threat management facility including a memory storing an entity model characterizing expected events for an entity, and the threat management facility configured to receive an event stream including the event vector, to monitor the event stream, to create the entity model based on a baseline of event vectors for the entity in the event stream over an algorithmically determined interval, to calculate a risk score for the compute instance based on a comparison of the event vector with the entity model, and to adjust local monitoring activity on the compute instance to increase a level of local activity monitoring when the risk score indicates a deviation from the baseline.