Granted Patent B2

US 9,648,035 · App. 14/531,881 · Granted May 9, 2017

Abstract

Claims (41)

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify that a particular one of a plurality of behavioral profiles is associated with a particular user of a computing system, wherein the particular behavioral profile identifies expected behavior for users associated with the particular behavioral profile, the particular behavioral profile is based on previously detected activities of a set of one or more users, and the set of users comprises the particular user;

interpret data to identify one or more detected activities of the particular user involving the computing system as detected by a plurality of security tools to provide security services to the computing system;

determine that at least a particular one of the detected activities deviates from the particular behavioral profile beyond a particular threshold;

trigger a risk event related to the particular detected activity; and

revise the particular behavioral profile based on the detected activity.

2. The storage medium of claim 1 , wherein activities of the particular user that do not deviate beyond the particular threshold are determined to be consistent with the particular behavioral profile and do not trigger risk events.

3. The storage medium of claim 1 , wherein the particular behavioral profile is associated with a plurality of users and the plurality of users comprises the particular user.

4. The storage medium of claim 3 , wherein at least some of the plurality of users are included in the set of users.

5. The storage medium of claim 1 , wherein the set of users comprises at least one user other than the particular user.

6. The storage medium of claim 1 , wherein the instructions, when executed, further cause the machine to determine an aggregate risk profile for the computing system based at least in part on the plurality of behavioral profiles.

7. The storage medium of claim 6 , wherein determining the aggregate risk profile for the computing system includes:

identifying an association between a particular computing device in the computing system and the particular user;

determining a device risk profile of the particular computing device; and

determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device.

8. The storage medium of claim 7 , wherein determining the composite risk comprises identifying, from the particular behavioral profile, a behavioral tendency of the particular user that corresponds to a particular vulnerability of the particular computing device identified from the device risk profile of the particular computing device.

9. The storage medium of claim 7 , wherein a plurality of users are associated with the particular computing device, each user in the plurality of users is associated with one or more behavioral profiles in the plurality of behavioral profiles, and the composite risk associated with the particular computing device is based on each behavioral profile associated with the plurality of users.

10. The storage medium of claim 1 , wherein the set of users comprises a plurality of users and the particular behavioral profile is a group-based behavioral profile based on a plurality of previously detected activities.

11. The storage medium of claim 1 , wherein the plurality of security tools include at least two of a firewall, a web gateway, a mail gateway, a host intrusion protection (HIP) tool, a network intrusion protection (NIP) tool, an anti-malware tool, a data loss prevention (DLP) tool, a system vulnerability manager, a system policy compliance manager, an asset criticality tool, and a security information management (SIM) tool.

12. The storage medium of claim 1 , wherein the instructions, when executed, further cause the machine to initiate deployment of a countermeasure in response to the security event.

13. The storage medium of claim 12 , wherein the instructions, when executed, further cause the machine to identify that the countermeasure addresses one or more of the activities of the particular user.

14. The storage medium of claim 1 , wherein at least a portion of the data is generated by a host-based security tool on at least one end user computing device in the computing system identified as used by the particular user.

15. The storage medium of claim 14 , wherein at least a portion of the data is generated by a network-based security tool remote from the end user computing device.

16. The storage medium of claim 14 , wherein the instructions, when executed, further cause the machine to corroborate a determined deviation from the particular behavioral profile with a particular violation of a user behavior rule detected from monitoring of the end user computing device by the host-based security tool.

17. The storage medium of claim 1 , wherein the particular behavioral profile includes a plurality of categorical risk profiles for the particular user, each categorical risk profile describing determined tendencies of the particular user with regard to a respective category of system use.

18. A method comprising:

identifying that a particular one of a plurality of behavioral profiles is associated with a particular user of a computing system, wherein the particular behavioral profile identifies expected behavior for users associated with the particular behavioral profile, the particular behavioral profile is based on previously detected activities of a set of one or more users, and the set of users comprises the particular user;

interpreting data to identify one or more detected activities of the particular user involving the computing system, wherein the data is generated by a plurality of security tools to providing security services to the computing system and the data is based on activities detected by the plurality of security tools;

determining that at least a particular one of the detected activities deviates from the particular behavioral profile beyond a particular threshold;

triggering a risk event related to the particular detected activity;

revising the particular behavioral profile based on the detected activity; and

applying the revised particular behavioral profile to subsequent detected activities of users associated with the particular behavioral profile.

19. A system comprising:

at least one processor device;

at least one memory element; and

a user behavioral risk analysis engine, adapted when executed by the at least one processor device to:

identify that a particular one of a plurality of behavioral profiles is associated with a particular user of a computing system, wherein the particular behavioral profile identifies expected behavior for users associated with the particular behavioral profile, the particular behavioral profile is based on previously detected activities of a set of one or more users, and the set of users comprises the particular user;

interpret data to identify one or more detected activities of the particular user involving the computing system, wherein the detected activities are detected by a plurality of security tools to provide security services to the computing system;

determine that at least a particular one of the detected activities deviates from the particular behavioral profile beyond a particular threshold;

trigger a risk event related to the particular detected activity; and

revise the particular behavioral profile based on the detected activity.

Assignments (20)