System and method for determining risk posed by a web user
AssigneeZscaler, Inc.
InventorBrenda Larcom
Life of this patent
Estimating the term…
Abstract
A system and method for determining the risk posed by a web user. The web user can be an individual, a department, a location, or an organization. The method includes the steps of capturing user generated web actions, and classifying the web actions under zero or more risk criteria. The risk criteria include one or more risk calculating and weighting factors. The method further includes the steps of calculating risk scores for the classified risk criteria, combining the calculated risk scores to obtain a total risk score, assigning a qualitative value to the total risk score, and reporting the total risk score. The reported total risk score can be used to enforce security policies based on the value of the risk scores.
Claims20
A method for assessing the risk posed by a web user, comprising the steps of:
- assembling a set of risk scores associated with the web user, including capturing one or more web actions taken by the user;
- computing a risk score for zero or more risk criteria, including assigning the web action to zero or more risk criteria, the risk criteria having one or more associated risk calculating and weighting factor;
- and
- applying the calculating and weighting factor to obtain the risk score and using historical data from various intervals prior to a duration of the one or more web actions to provide a hysteresis effect with older data having less effect over time on the risk score;
- and
- storing the risk score together with selected information about the user and the web action;
- and
- determining a total risk score for the user over a selected time period;
- wherein the risk criteria is segmented between external risk categories and internal risk categories, wherein the internal risk categories are utilized to reveal gaps in coverage of the risk criteria to assist in developing new criteria for the risk criteria and the external risk categories are utilized to enforce security measures with the risk score.
A system for assessing the risk posed by a web user, the system comprising:
- a traffic-capturing module executed on a server configured to detect one or more web actions taken by the user;
- a classification module executed on the server configured to assign the web action to zero or more risk criteria, the risk criteria having associated risk calculating and weighting factors;
- a computing agent executed on the server configured to:
- compute a risk score for each assigned risk criterion by applying the calculating and weighting factors;
- and
- determine a total risk score based on the risk score for each assigned risk criterion and based on historical data from various intervals prior to a duration of the one or more web actions to provide a hysteresis effect with older data having less effect over time on the risk score;
- an analyzing module configured to assign a qualitative value to the total risk score;
- and
- a reporting agent configured to report the risk value associated with the user;
- wherein the risk criteria is segmented between external risk categories and internal risk categories, wherein the internal risk categories are utilized to reveal gaps in coverage of the risk criteria to assist in developing new criteria for the risk criteria and the external risk categories are utilized to enforce security measures with the risk score.
Dependencies are inferred from the claim text.