Back to results
US 9,641,544 B1Granted
Automated insider threat prevention
AssigneePalo Alto Networks, Inc.
InventorsTim Treat, Cyrus Ziaeian, Gregory Grzegorzyk
Life of this patent
Estimating the term…
Abstract
Techniques for automated insider threat prevention are disclosed. In some embodiments, a system, process, and/or computer program product for automated insider threat prevention includes monitoring network communications at a network device; detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user; and performing an action in response to the detected anomalous activity based on a policy.
Claims33
A system for automated insider threat prevention, comprising:
- a processor of a network device configured to:
- monitor network communications at the network device, wherein monitor network communications at the network device comprises:
- monitor encrypted network communications between a client device and an external site, wherein the encrypted network communications are encrypted using a first protocol;
- decrypt the encrypted network communications between the client device and the external site;
- and
- determine if the encrypted network communications between the client device and the external site include a file transfer activity from the client device to the external site;
- detect an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, wherein the anomalous activity includes an anomalous file transfer activity associated with the user, and wherein the anomalous activity is determined to be suspicious based on one or more file transfer application activities associated with the user based on a threshold comparison with the behavior profile for the user;
- perform an action in response to the detected anomalous activity based on a policy, wherein perform the action in response to the detected anomalous activity based on the policy comprises:
- throttle the anomalous file transfer activity;
- and
- receive a notification associated with another anomalous activity associated with another user, wherein the another anomalous activity is detected based on monitored network communications associated with the another user based on another behavior profile for the another user;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
10 more elements
A method for automated insider threat prevention, comprising:
- monitoring network communications at a network device, wherein monitoring network communications at the network device comprises:
- monitoring encrypted network communications between a client device and an external site, wherein the encrypted network communications are encrypted using a first protocol;
- decrypting the encrypted network communications between the client device and the external site;
- and
- determining if the encrypted network communications between the client device and the external site include a file transfer activity from the client device to the external site;
- detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, wherein the anomalous activity includes an anomalous file transfer activity associated with the user, and wherein the anomalous activity is determined to be suspicious based on one or more file transfer application activities associated with the user based on a threshold comparison with the behavior profile for the user;
- performing an action in response to the detected anomalous activity based on a policy, wherein performing the action in response to the detected anomalous activity based on the policy comprises:
- throttling the anomalous file transfer activity;
- and
- receiving a notification associated with another anomalous activity associated with another user, wherein the another anomalous activity is detected based on monitored network communications associated with the another user based on another behavior profile for the another user.
7 more elements
A computer program product for automated insider threat prevention, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- monitoring network communications at a network device, wherein monitoring network communications at the network device comprises:
- monitoring encrypted network communications between a client device and an external site, wherein the encrypted network communications are encrypted using a first protocol;
- decrypting the encrypted network communications between the client device and the external site;
- and
- determining if the encrypted network communications between the client device and the external site include a file transfer activity from the client device to the external site;
- detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, wherein the anomalous activity includes an anomalous file transfer activity associated with the user, and wherein the anomalous activity is determined to be suspicious based on one or more file transfer application activities associated with the user based on a threshold comparison with the behavior profile for the user;
- performing an action in response to the detected anomalous activity based on a policy, wherein performing the action in response to the detected anomalous activity based on the policy comprises:
- throttling the anomalous file transfer activity;
- and
- receiving a notification associated with another anomalous activity associated with another user, wherein the another anomalous activity is detected based on monitored network communications associated with the another user based on another behavior profile for the another user.
7 more elements
Dependencies are inferred from the claim text.