Granted Patent B1

US 9,798,876 · App. 14/829,676 · Granted Oct 24, 2017

Abstract

Claims (45)

1. A computer-implemented method for creating security profiles, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, within a computing environment, a new actor as a target for creating a new security behavior profile that defines expected behavior for the new actor;

identifying a weighted graph that connects the new actor as a node to other actors;

creating, by analyzing the weighted graph that connects the new actor to the other actors, the new security behavior profile that defines expected behavior for the new actor based on the new actor's specific position within the weighted graph at least in part by calculating an average edge value of connections that connect the new actor to neighbors within the weighted graph;

detecting a security anomaly by comparing actual behavior of the new actor within the computing environment with the new security behavior profile that defines expected behavior for the new actor; and

performing, by a computer security system, a remedial action in response to detecting the security anomaly.

2. The computer-implemented method of claim 1 , wherein the new actor comprises one of:

a user account; and

a physical server.

3. The computer-implemented method of claim 1 , wherein identifying, within the computing environment, the new actor as the target for creating the new security behavior profile comprises identifying the new actor as newly inserted within the computing environment.

4. The computer-implemented method of claim 1 , wherein identifying the weighted graph that connects the new actor as the node to other actors comprises creating the weighted graph.

5. The computer-implemented method of claim 4 , wherein creating the weighted graph comprises:

identifying a data structure that indicates a position of the new actor within a network of actors having a same type categorization; and

creating the weighted graph based on the data structure.

6. The computer-implemented method of claim 5 , wherein the data structure comprises an organizational chart that indicates a hierarchy between individuals within a corresponding organization.

7. The computer-implemented method of claim 1 , wherein creating the new security behavior profile based on the new actor's specific position within the weighted graph comprises copying another security behavior profile as the new security behavior profile.

8. The computer-implemented method of claim 7 , wherein the new actor replaces another actor within the computing environment.

9. The computer-implemented method of claim 1 , wherein the new actor comprises a file.

10. The computer-implemented method of claim 1 , wherein detecting the security anomaly comprises determining that the actual behavior of the new actor differs from expected behavior defined by the new security behavior profile beyond a predefined threshold.

11. A system for creating security profiles, the system comprising:

an identification module, stored in memory, that:

identifies, within a computing environment, a new actor as a target for creating a new security behavior profile that defines expected behavior for the new actor; and

identifies a weighted graph that connects the new actor as a node to other actors;

a creation module, stored in memory, that creates, by analyzing the weighted graph that connects the new actor to the other actors, the new security behavior profile that defines expected behavior for the new actor based on the new actor's specific position within the weighted graph at least in part by calculating an average edge value of connections that connect the new actor to neighbors within the weighted graph;

a detection module, stored in memory, that detects a security anomaly by comparing actual behavior of the new actor within the computing environment with the new security behavior profile that defines expected behavior for the new actor;

a performance module, stored in memory, that performs a remedial action in response to detecting the security anomaly; and

at least one physical processor configured to execute the identification module, the creation module, the detection module, and the performance module.

12. The system of claim 11 , wherein the new actor comprises one of:

a user account; and

a physical server.

13. The system of claim 11 , wherein the identification module identifies, within the computing environment, the new actor as the target for creating the new security behavior profile by identifying the new actor as newly inserted within the computing environment.

14. The system of claim 11 , wherein the identification module identifies the weighted graph that connects the new actor as the node to other actors by creating the weighted graph.

15. The system of claim 14 , wherein the creation module creates the weighted graph by:

identifying a data structure that indicates a position of the new actor within a network of actors having a same type categorization; and

creating the weighted graph based on the data structure.

16. The system of claim 15 , wherein the data structure comprises an organizational chart that indicates a hierarchy between individuals within a corresponding organization.

17. The system of claim 11 , wherein the creation module creates the new security behavior profile based on the new actor's specific position within the weighted graph by copying another security behavior profile as the new security behavior profile.

18. The system of claim 17 , wherein the new actor replaces another actor within the computing environment.

19. The system of claim 11 , wherein the new actor comprises a file.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, within a computing environment, a new actor as a target for creating a new security behavior profile that defines expected behavior for the new actor;

identify a weighted graph that connects the new actor as a node to other actors;

create, by analyzing the weighted graph that connects the new actor to the other actors, the new security behavior profile that defines expected behavior for the new actor based on the new actor's specific position within the weighted graph at least in part by calculating an average edge value of connections that connect the new actor to neighbors within the weighted graph;

detect a security anomaly by comparing actual behavior of the new actor within the computing environment with the new security behavior profile that defines expected behavior for the new actor; and

perform, by a computer security system, a remedial action in response to detecting the security anomaly.

Assignments (6)