Threat personalization
View Patent ↗A determination is made as to whether there is a correlation between a user's security risk profile and a personalized threat profile of an actual or spreading threat. If there is a correlation, a personalized reactive alert is issued in the case of an actual threat. The personalized reactive alert informs the user of specific suspected data that may have been compromised by the threat and the specific non-computer related action that the user should take. Further, if there is a correlation, a personalized proactive alert is issued and/or personalized proactive protective action taken in the case of a spreading threat. The personalized proactive alert informs the user of the spreading threat that the user and/or the user's host computer system is particularly susceptible to. Further, the personalized proactive protective action taken provides automated risk mitigation.
1. A computer-program product comprising a tangible, non-transitory computer readable medium containing computer program code comprising:
a threat personalization application for creating, on a host computer system of a user, a user's security risk profile for a user, wherein said user is a human user of said host computer system;
said user's security risk profile is specific to said user; and said user's security risk profile comprises: building said user's security risk profile from a user's behavior profile and a user's system profile, wherein said user's behavior profile is a personalized behavior of said user on said host computer system; and said user's system profile is a profile of a personalized system of said user on said host computer system; said threat personalization application further for creating a personalized threat profile for a threat with respect to information on said host computer system of a user; said threat personalization application further for determining whether there is a correlation between said user's security risk profile and said personalized threat profile; and said threat personalization application further for issuing a personalized alert to said user based on an outcome of said determining whether there is correlation,
wherein upon said threat being detected, said personalized alert is a personalized reactive alert;
and upon said threat not being detected, said personalized alert is a personalized proactive alert;
wherein said user's behavior profile is characterized by at least one attribute selected from the group comprising of: (1) accounts and memberships of said user; (2) online activities of said user; (3) network behavior of said user; (4) use of external devices by said user; and (5) update behavior of said user; wherein said user's system profile is characterized by at least one attribute selected from the group comprising of: 1) sensitive applications; (2) high-risk applications; (3) valuable data/files; and (4) system and application modification frequency.
2. The computer-program product of claim 1 wherein said personalized threat profile of said threat includes metadata content that details at least one attribute of said threat, said at least one attribute being selected from the group consisting of: (1) propagation vectors of said threat; (2) targeted accounts of said threat; (3) targeted locations/applications of said threat; (4) targeted data of said threat; (5) geographic vicinity of said threat; (6) exploited vulnerabilities of said threat; (7) update/install activity of said threat; and (8) denial of service capabilities and targets of said threat.
3. The computer-program product of claim 1 wherein said threat personalization application is further for taking personalized proactive protective action.
4. The computer-program product of claim 1 wherein said creating a personalized threat profile for a threat comprises retrieving said personalized threat profile from an update server.
5. The computer-program product of claim 4 wherein said threat personalization application is further for retrieving a threat protection profile for said threat, said threat protection profile for detecting said threat on said host computer system.
6. The computer-program product of claim 5 wherein said personalized reactive alert informs said user of data said threat may have compromised.
7. The computer-program product of claim 5 wherein said personalized proactive alert informs said user that said host computer system is particularly susceptible to said threat.
8. The computer-program product of claim 5 wherein said personalized proactive alert informs said user of specific action that should be taken to minimize the susceptibility to said threat.
9. The computer-program product of claim 5 wherein said personalized proactive alert informs said user of risky behavior to be avoided to minimize the susceptibility to said threat.
10. The computer-program product of claim 1 wherein said threat personalization application is further for creating personalized threat profiles for threats comprising said creating a personalized threat profile for a threat.
11. The computer-program product of claim 10 wherein said threat personalization application is further for creating threat protection profiles for said threats.
12. A computer system comprising:
a memory having stored therein a threat personalization application; and
a processor coupled to said memory, wherein execution of said threat personalization application generates a method comprising:
creating, on a host computer system of a user, a user's security risk profile for a user,
wherein said user is a human user of said host computer system;
said user's security risk profile is specific to said user; and
said user's security risk profile comprises:
building said user's security risk profile from a user's behavior profile and a user's system profile,
wherein said user's behavior profile is a personalized behavior of said user on said host computer system of a user; and
said user's system profile is a profile of a personalized system of said user on said host computer system;
creating a personalized threat profile for a threat with respect to information on said host computer system of a user;
determining whether there is a correlation between said user's security risk profile and said personalized threat profile; and
issuing a personalized alert to said user based on an outcome of said determining whether there is correlation,
wherein upon said threat being detected, said personalized alert is a personalized reactive alert; and
upon said threat not being detected, said personalized alert is a personalized proactive alert;
wherein said user's behavior profile is characterized by at least one attribute selected from the group comprising of: (1) accounts and memberships of said user; (2) online activities of said user; (3) network behavior of said user; (4) use of external devices by said user; and (5) update behavior of said user;
wherein said user's system profile is characterized by at least one attribute selected from the group comprising of: 1) sensitive applications; (2) high-risk applications; (3) valuable data/files; and (4) system and application modification frequency.