US 8,474,042 B2Granted

Insider threat correlation tool

AssigneeBank of America Corporation

InventorsAmanda Sorensen, Allan Byers

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for calculating threat scores for individuals within an organization or domain are provided. Aspects of the invention relate to computer-implemented methods that form a predictive threat rating for user accounts. In one implementation, a threat score representing a first time period may be calculated. The first threat score may be calculated from a quantification of a plurality of activity violations across a plurality of control groups. Weighting schemes may be applied to certain activities, controls, and/or user accounts. Further embodiments may be configured to consider additional indicators. Further aspects relate to apparatuses configured to execute methods for ranking individual user accounts. Certain embodiments may not block transmissions that violate predefine rules, however, indications of such improper transmission may be considered when constructing a threat rating.

Claims15

Dependent claims

A non-transitory computer-readable medium comprising computer-executable instructions that when executed by a processor cause the processor to perform:

detecting activities associated with a plurality of user accounts involving a plurality of removable media controls, unencrypted transmission controls, and encrypted targeted communication controls over a first network;
quantifying a quantity of attributes of accesses having access rights during a first time period;
detecting that a user account accessed a removable storage device;
determining if the user account has permission rights to conduct the access to the removable storage device;
wherein if the user account does not have permission rights, determining that an activity violation has occurred, and wherein if the user account does have permission rights, storing an attribute of the access;
determining if an activity violation occurred;
quantifying activity violations of the detected activities;
determining whether a threshold quantity of activity violations has been met for a first user account of the plurality of user accounts;
and
calculating a predictive threat rating for the first user account if the threshold quantity is met.

7 more elements

An apparatus comprising:

a processor;
a control module configured to detect activities associated with a plurality of user accounts involving a plurality of removable media controls, unencrypted transmission controls, and encrypted targeted communication controls over a first network;
and
a non-transitory computer-readable medium comprising computer-executable instructions that when executed by the processor cause the apparatus to:
quantify a quantity of attributes of accesses having access rights during a first time period;
detect that a user account accessed a removable storage device;
determine if the user account has permission rights to conduct the access to the removable storage device;
wherein if the user account does not have permission rights, determine that an activity violation has occurred, and wherein if the user account does have permission rights, storing store an attribute of the access;
determine if an activity violation occurred;
quantify activity violations of the detected activities detected by the control module;
determine whether a threshold quantity of activity violations has been met for a first user account of the plurality of user accounts, wherein if the threshold quantity of activity violations is met, then determining whether additional indicators are present;
and
calculate, with the processor, a predictive threat rating for the first user account if the threshold quantity is met.

10 more elements

Dependencies are inferred from the claim text.