# US 8,782,735 B1 · Runtime risk detection based on user, application, and system action sequence correlation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,735 B1 - Document ID: US8782735B1 - Status: Granted - Kind: B1 - Application number: 13/741,878 - Filed: 2013-01-15 - Published: 2014-07-17 - Granted: 2014-07-15 - Earliest claimed: 2013-01-15 - Assignees: Taasera, Inc. - Applicants: Taasera, Inc. - Inventors: Srinivas Kumar - Web page: https://patentgrep.com/patent/US8782735B1 ## CPC - H04L 47/10: Flow control; Congestion control - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/102: {Entity profiles} - H04L 47/2458: {Modification of priorities while in transit} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for assessing runtime risk for an application or device includes: storing, in a rules database, a plurality of rules, wherein each rule identifies an action sequence; storing, in a policy database, a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; identifying, using at least one assessment policy, a runtime risk for an application or device, wherein the identified runtime risk identifies and predicts a specific type of threat; and identifying, by a processing device, a behavior score for the application or device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action. ## Claims ### Claim 1 A method for assessing runtime risk for an application program that executes on a device, comprising: storing, in a rules database, a plurality of rules, wherein each rule identifies an action sequence; storing, in a policy database, a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; identifying, using at least one assessment policy, a runtime risk for an application program that executes on a device, wherein the identified runtime risk indicates a risk or threat of the identified action sequence of the application; and identifying, by a runtime monitor including a processing device, a behavior score for the application program that executes on the device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action. ### Claim 2 (depends on 1) The method of claim 1, wherein the user action is any form of explicit input from a user of a computing system. ### Claim 3 (depends on 1) The method of claim 1, wherein the application action is any activity performed by the application initiated programmatically by a task in execution of a computing system. ### Claim 4 (depends on 1) The method of claim 1, wherein the system action is any operation performed by a computing system on behalf of, or as a consequence of, a user action or application action that changes the state of the computing system. ### Claim 5 (depends on 1) The method of claim 1, wherein a first action of the at least two performed actions is performed at a first time, and the second action of the at least two performed actions is performed at a second time. ### Claim 6 (depends on 5) The method of claim 5, wherein the first action is a user action, the second action is a system action, and the second time occurs after the first time. ### Claim 7 (depends on 5) The method of claim 5, wherein the first action is a user action, the second action is an application action, and the second time occurs after the first time. ### Claim 8 (depends on 5) The method of claim 5, wherein the first action is an application action, the second action is a system action, and the second time occurs after the first time. ### Claim 9 (depends on 1) The method of claim 1, wherein the action sequence includes three performed actions, a first action of the three performed actions is a user action, a second action of the three performed actions is an application action, a third action of the three performed actions is a system action, the second action is performed temporally after the first action, and the third action is performed temporally after the second action. ### Claim 10 (depends on 1) The method of claim 1, wherein the runtime risk is identified based on matching rules and probabilistic weights and scores of performed actions on the device. ### Claim 11 (depends on 1) The method of claim 1, wherein the runtime risk is identified based on time proximity of the at least two performed actions of the action sequence and natural affinity inferred between the at least two performed actions. ### Claim 12 (depends on 1) The method of claim 1, further comprising: assessing, by the processing device, that the at least two performed actions of the action sequence describe a forensic chain of events based on a plurality of factors, wherein the plurality of factors includes at least one of: ordered sequences, unordered sequences, proximity analysis, outliers, probabilistic weights and scores, and probable action inferences based on an application's competency. ### Claim 13 A system for assessing runtime risk for an application program that executes on a device, comprising: a rules database storing a plurality of rules, wherein each rule identifies an action sequence; a policy database storing a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; and a runtime monitor including a processing device identifying, using at least one assessment policy, a runtime risk for an application program that executes on a device, wherein the identified runtime risk indicates a risk or threat of the identified action sequence of the application, and identifying a behavior score for the application program that executes on the device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action. ### Claim 14 (depends on 13) The system of claim 13, wherein the user action is any form of explicit input from a user of a computing system. ### Claim 15 (depends on 13) The system of claim 13, wherein the application action is any activity performed by the application initiated programmatically by a task in execution of a computing system. ### Claim 16 (depends on 13) The system of claim 13, wherein the system action is any operation performed by a computing system on behalf of, or as a consequence of, a user action or application action that changes the state of the computing system. ### Claim 17 (depends on 13) The system of claim 13, wherein a first action of the at least two performed actions is performed at a first time, and the second action of the at least two performed actions is performed at a second time. ### Claim 18 (depends on 17) The system of claim 17, wherein the first action is a user action, the second action is a system action, and the second time occurs after the first time. ### Claim 19 (depends on 17) The system of claim 17, wherein the first action is a user action, the second action is an application action, and the second time occurs after the first time. ### Claim 20 (depends on 17) The system of claim 17, wherein the first action is an application action, the second action is a system action, and the second time occurs after the first time. ### Claim 21 (depends on 13) The system of claim 13, wherein the action sequence includes three performed actions, a first action of the three performed actions is a user action, a second action of the three performed actions is an application action, a third action of the three performed actions is a system action, the second action is performed temporally after the first action, and the third action is performed temporally after the second action. ### Claim 22 (depends on 13) The system of claim 13, wherein the runtime risk is identified based on matching rules and probabilistic weights and scores of performed actions on the device. ### Claim 23 (depends on 13) The system of claim 13, wherein the runtime risk is identified based on time proximity of the at least two performed actions of the action sequence and natural affinity inferred between the at least two performed actions. ### Claim 24 (depends on 13) The system of claim 13, wherein the processing device assesses that the at least two performed actions of the action sequence describe a forensic chain of events based on a plurality of factors, and the plurality of factors includes at least one of: ordered sequences, unordered sequences, proximity analysis, outliers, probabilistic weights and scores, and probable action inferences based on an application's competency.