Granted Patent B2

US 10,171,488 · App. 15/867,960 · Granted Jan 1, 2019

Abstract

Claims (32)

1. A computer-implementable method for generating a cyber behavior profile, comprising:

monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction; and

generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;

identifying a known good interaction between the user and the information handling system;

storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;

identifying an anomalous interaction between the user and the information handling system;

storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;

generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and,

storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.

2. The method of claim 1 , further comprising:

associating the multi-dimensional cyber behavior profile with the user.

3. The method of claim 2 , wherein:

the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

4. The method of claim 1 , wherein:

at least one of the respective layer of user interactions correspond to temporal user interactions.

5. The method of claim 1 , wherein:

the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

6. The method of claim 3 , wherein:

the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.

7. The method of claim 1 , further comprising:

identifying the known good interactions as known good behavior;

determining whether additional interactions do not correspond to the known good behavior; and,

performing an enforcement operation when the additional interactions do not correspond to the known good behavior.

8. The method of claim 1 , further comprising:

storing the multi-dimensional cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of cyber behavior profiles, each the plurality of cyber behavior profiles corresponding to a respective user.

9. The method of claim 8 , further comprising:

securing each of the plurality of cyber behavior profiles prior to storing within the cyber behavior repository.

10. The method of claim 8 , further comprising:

monitoring an information technology environment using the plurality of behavioral identifiers;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of cyber behavior profiles.

Assignments (8)