US 8,799,462 B2Granted

Insider threat correlation tool

AssigneeBank of America Corporation

InventorsBrian McHugh, Ronald Ramcharran, Peter J. Langsam, Timothy C. Metzger, Dan P. Antilley, Jonathan W. Deats

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for calculating threat scores for individuals within an organization or domain are provided. Aspects of the invention relate to computer-implemented methods that form a predictive threat rating for user accounts. In one implementation, a first threat score representing a first time period may be calculated. The first threat score may be compared with aspects of the same user accounts for a second time period. Weighting schemes may be applied to certain activities, controls, and/or user accounts. Further aspects relate to apparatuses configured to execute methods for ranking individual user accounts. Certain embodiments may not block transmissions that violate predefine rules, however, indications of such improper transmission may be considered when constructing a threat rating. Blocked transmissions enforced upon a user account may also be received. Certain activity, such as accessing the internet, may be monitored for the presence of a security threat and/or an ethics threat.

Claims18

Dependent claims

A computer-implemented method comprising:

calculating, by a computing device having a processor, a threat score for a plurality of user accounts having access to a first network and at least a portion of the user accounts having access to a second network that comprises a centralized store of electronic data, comprising, for each user account determining, by the computing device, an overall threat score (foverall), where
f
overall
=
(
f
live
+
f
analytic
)
*
f
person
100
,
wherein flive includes calculation of data from a first time period and is calculated, by the computing device, for a plurality of activities, wherein for each activity:
-
f
live
=
∑
x
=
0
n
⁢
⁢
x
greaterThan
⁢
⁢
0
(
weight
x
live
2
)
+
(
hit
x
max
hit
x
)
⁢
(
weight
x
live
2
)
,
where x specifies a predefined activity selected from a plurality of activities, and
x
greaterThan
⁢
⁢
0
=
{
1
,
hits
x
>
0
0
,
hits
x
=
0
⁢
wherein fanalytic includes the calculation of data from a second time period and is calculated, by the computing device, for the plurality of activities of flive, wherein:
fanalytic=(spikex+aboveAvgx+offHoursx)*(weightxanalytic)
wherein spikex is assigned, by the computing device, a zero value unless the user account comprises an activity level during the first time period that is over a first threshold level above an average of the same user account during the second time period and a first integer if the user account comprises an activity level during the first time period that is over the first threshold level above the average of the same user account during the second time period;
wherein aboveavgx is assigned, by the computing device, a zero unless the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period and a first integer if the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period;
wherein offhoursx is assigned, by the computing device, a zero unless the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account and a first integer if the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account;
wherein fperson is a variable that considers one or more weights given to the user account;
and
wherein weightxlive is a weighting value used for activities during the first time period and weightxanalytic is a weighting value used for activities during the second time period;
ranking the plurality of user accounts based on the calculated threat score;
and
displaying the ranking of the plurality of user accounts.

84 more elements

One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed by a processor, cause the processor to:

calculate a threat score for a plurality of user accounts having access to a first network and at least a portion of the user accounts having access to a second network that comprises a centralized store of electronic data, comprising, for each user account determining an overall threat score (foverall), where
f
overall
=
(
f
live
+
f
analytic
)
*
f
person
100
,
wherein flive includes calculation of data from a first time period and is calculated for a plurality of activities, wherein for each activity:
-
f
live
=
∑
x
=
0
n
⁢
⁢
x
greaterThan
⁢
⁢
0
(
weight
x
live
2
)
+
(
hit
x
max
hit
x
)
⁢
(
weight
x
live
2
)
,
where x specifies a predefined activity selected from a plurality of activities, and
x
greaterThan
⁢
⁢
0
=
{
1
,
hits
x
>
0
0
,
hits
x
=
0
⁢
wherein fanalytic includes the calculation of data from a second time period and is calculated for the plurality of activities of flive, wherein:
fanalytic=(spikex+aboveAvgx+offHoursx)*(weightxanalytic)
assign spikex a zero value unless the user account comprises an activity level during the first time period that is over a first threshold level above an average of the same user account during the second time period and a first integer if the user account comprises an activity level during the first time period that is over the first threshold level above the average of the same user account during the second time period
assign aboveavgx a zero unless the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period and a first integer if the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period;
assign offhoursx a zero unless the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account and a first integer if the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account;
wherein fperson is a variable that considers one or more weights given to the user account;
and wherein weightxlive is a weighting value used for activities during the first time period and weightxanalytic is a weighting value used for activities during the second time period;
ranking the plurality of user accounts based on the calculated threat score;
and
displaying the ranking of the plurality of user accounts.

83 more elements

An apparatus, comprising:

a processor;
memory storing computer-readable instructions that, when executed, cause the apparatus to:
calculate a threat score for a plurality of user accounts having access to a first network and at least a portion of the user accounts having access to a second network that comprises a centralized store of electronic data, comprising, for each user account determining an overall threat score (foverall), where
f
overall
=
(
f
live
+
f
analytic
)
*
f
person
100
,
wherein flive includes calculation of data from a first time period and is calculated for a plurality of activities, wherein for each activity:
-
f
live
=
∑
x
=
0
n
⁢
⁢
x
greaterThan
⁢
⁢
0
(
weight
x
live
2
)
+
(
hit
x
max
hit
x
)
⁢
(
weight
x
live
2
)
,
where x specifies a predefined activity selected from a plurality of activities, and
x
greaterThan
⁢
⁢
0
=
{
1
,
hits
x
>
0
0
,
hits
x
=
0
⁢
wherein fanalytic includes the calculation of data from a second time period and is calculated for the plurality of activities of flive, wherein:
fanalytic=(spikex+aboveAvgx+offHoursx)*(weightxanalytic) Equation 1b:
assign spikex a zero value unless the user account comprises an activity level during the first time period that is over a first threshold level above an average of the same user account during the second time period and a first integer if the user account comprises an activity level during the first time period that is over the first threshold level above the average of the same user account during the second time period;
assign aboveavgx a zero unless the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period and a first integer if the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period;
assign offhoursx a zero unless the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account and a first integer if the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account;
wherein fperson is a variable considers one or more weights given to the user account;
and
wherein weightxlive is a weighting value used for activities during the first time period and weightxanalytic is a weighting value used for activities during the second time period;
ranking the plurality of user accounts based on the calculated threat score;
and
displaying the ranking of the plurality of user accounts.

86 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/736,594Filed 8 Jan 2013 · division
Priority: 26 Jan 2010
Published: US 2013/0125239 A116 May 2013
Granted: 5 Aug 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 63/14
Network architectures or network communication protocols for network security: for detecting or protecting against malicious traffic
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
G06F 2221/2101
Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for…:…

Family

Application12/694,067Parent of this division · filed 26 Jan 2010
US 2013/0125239 A1Pre-grant publication · published 16 May 2013
US 2011/0185056 A1Published application
US 8,782,209 B2Related patent
US 8,799,462 B2This patent

From the US filing history. Foreign family members aren’t listed.