# US 8,752,180 B2 · Behavioral engine for identifying patterns of confidential data use > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,180 B2 - Document ID: US8752180B2 - Status: Granted - Kind: B2 - Application number: 12/472,339 - Filed: 2009-05-26 - Published: 2010-12-02 - Granted: 2014-06-10 - Earliest claimed: 2009-05-26 - Assignees: Symantec Corporation - Applicants: Ian Barile; Mario Espinoza - Inventors: Ian Barile; Mario Espinoza - Web page: https://patentgrep.com/patent/US8752180B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A client device hosts a behavioral engine. Using the behavioral engine, the client device analyzes behavior of a client application with respect to confidential information. The client device assigns a rating indicative of risk to the client application based on the behavior of the client application. The client device performs an action to mitigate risk of data loss if the rating exceeds a threshold. ## Claims ### Claim 1 A computer-implemented method comprising: monitoring, by a computing device, operations by a client application; determining, by the computing device, that data of one of the operations contain confidential information protected by a data loss prevention (DLP) policy; and in response to determining that the data contains the confidential information, determining whether the client application is using the confidential information for a legitimate purpose or an illegitimate purpose, comprising: analyzing, by the computing device, behavior of the client application with respect to the confidential information; identifying a pattern of how the client application uses the confidential information based at least in part on the behavior of the client application, wherein the identified pattern is not associated with a user; performing a comparison of the identified pattern to at least one of a model of legitimate use of the confidential information or a model of illegitimate use of the confidential information to determine a security risk of the client application; and assigning a risk rating indicative of the security risk to the client application; performing an action to mitigate risk of data loss if the risk rating exceeds a threshold. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising assigning the risk rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes the confidential information. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein a first risk rating that exceeds the threshold is assigned to the client application upon detecting the operation on the data that includes the confidential information, the method further comprising: modifying the first risk rating assigned to the client application if no additional operations of the client application on data that includes the confidential information are detected within a specified time frame. ### Claim 4 (depends on 2) The method of claim 2, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the computing device operates. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising assigning the risk rating only if the client application is not a trusted client application. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein performing the action comprises: at least one of quarantining the client application, blocking access to the client application or terminating the client application if a first risk rating is assigned to the client application; and at least one of notifying a system administrator of the client application or requesting a detailed scan of the client application if a second risk rating is assigned to the client application. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: profiling activities of one or more legitimate applications to develop the model of legitimate use of the confidential information; and profiling activities of one or more illegitimate applications to develop the model of illegitimate use of the confidential information. ### Claim 8 A non-transitory computer-readable storage medium including instructions that, when executed by a computing device, cause the computing device to perform operations comprising: monitoring, by the computing device, operations by a client application; determining, by the computing device, that data of one of the operations contain confidential information protected by a data loss prevention (DLP) policy; and in response to determining that the data contains the confidential information, determining whether the client application is using the confidential information for a legitimate purpose or an illegitimate purpose, comprising: analyzing, by the computing device, behavior of the client application with respect to the confidential information; identifying a pattern of how the client application uses the confidential information based at least in part on the behavior of the client application, wherein the identified pattern is not associated with a user; performing a comparison of the identified pattern to at least one of a model of legitimate use of the confidential information or a model of illegitimate use of the confidential information to determine a security risk of the client application; and assigning a rating indicative of the security risk to the client application; performing an action to mitigate risk of data loss if the rating exceeds a threshold. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, the operations further comprise assigning the rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes the confidential information. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein a first rating that exceeds the threshold is assigned to the client application upon detecting the operation on the data that includes the confidential information, the operations further comprise reducing the first rating assigned to the client application if no additional operations of the client application on data that includes the confidential information are detected within a specified time frame. ### Claim 11 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the computing device operates. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, the operations further comprise assigning the rating only if the client application is not a trusted client application. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein performing the action comprises: at least one of quarantining the client application, blocking access to the client application or terminating the client application if a first rating is assigned to the client application; and at least one of notifying a system administrator of the client application or requesting a detailed scan of the client application if a second rating is assigned to the client application. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, the operations further comprise: profiling activities of one or more legitimate applications to develop the model of legitimate use of the confidential information; and profiling activities of one or more illegitimate applications to develop the model of illegitimate use of the confidential information. ### Claim 15 A computing apparatus comprising: a memory to store instructions for a behavioral engine; and a processor, connected with the memory, to execute the instructions, wherein the instructions cause the processor to: monitor operations by a client application by a data loss prevention (DLP) agent; determine by the DLP agent that data of one of the operations contain confidential information protected by a data loss prevention (DLP) policy; and in response to determining that the data contains the confidential information, notify a behavior engine to determine whether the client application is using the confidential information for a legitimate purpose or an illegitimate purpose, comprising: analyze, by the behavior engine, behavior of a client application with respect to confidential information; identify, by the behavior engine, a pattern of how the client application uses the confidential information based at least in part on the behavior of the client application, wherein the identified pattern is not associated with a user; perform, by the behavior engine, a comparison of the identified pattern to at least one of a model of legitimate use of the confidential information or a model of illegitimate use of the confidential information to determine a security risk of the client application; assign, by the behavior engine, a rating indicative of the security risk to the client application; and perform, by the DLP agent, an action to mitigate risk of data loss if the rating exceeds a threshold. ### Claim 16 (depends on 15) The computing apparatus of claim 15, wherein the instructions further cause the processor to assign the rating to the client application based on at least one of the detected operation and one or more previous operations of the client application on additional data that includes the confidential information. ### Claim 17 (depends on 16) The computing apparatus of claim 16, wherein a first rating that exceeds the threshold is assigned to the client application upon detecting the operation on the data that includes confidential information, the instructions further to cause the processor to reduce the first rating assigned to the client application if no additional operations of the client application on data that includes the confidential information are detected within a specified time frame. ### Claim 18 (depends on 16) The computing apparatus of claim 16, wherein the detected operation comprises at least one of an operation to store the data, an operation to transform the data or an operation to transmit the data to a destination outside of an enterprise network within which the computing apparatus operates. ### Claim 19 (depends on 15) The computing apparatus of claim 15, wherein the instructions further cause the processor to assign the rating only if the client application is not a trusted client application. ### Claim 20 (depends on 15) The computing apparatus of claim 15, wherein the instructions further cause the processor to: profile activities of one or more legitimate applications to develop the model of legitimate use of the confidential information; and profile activities of one or more illegitimate applications to develop the model of illegitimate use of the confidential information.