User behavior profile
View Patent ↗A method, system and computer-usable medium are disclosed for generating a cyber behavior profile comprising monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions, the electronic information representing the user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction; and generating a unique multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions.
1. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code for generating a cyber behavior profile, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;
converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction;
generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;
identifying a known good interaction between the user and the information handling system;
storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;
identifying an anomalous interaction between the user and the information handling system;
storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;
generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and,
storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.
2. The system of claim 1 , wherein the instructions executable by the processor are further configured for:
associating the unique multi-dimensional cyber behavior profile with the user.
3. The system of claim 2 , wherein:
the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and,
each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.
4. The system of claim 1 , wherein:
at least one respective layer of user interaction corresponds to temporal user interactions.
5. The system of claim 1 , wherein:
the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.
6. The system of claim 3 , wherein:
the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.
7. The system of claim 1 , wherein the instructions executable by the processor are further configured for:
identifying the interactions between the user and the information handling system used for generating the unique cyber behavior profile as known good behavior;
determining whether additional interactions identified as between the user and the information handling system do not correspond to the known good behavior; and,
performing an enforcement operation when additional interactions identified as between the user and the information handling system do not correspond to the known good behavior.
8. The method of claim 1 , wherein the instructions executable by the processor are further configured for:
storing the unique cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of unique cyber behavior profiles, each the plurality of unique cyber behavior profiles corresponding to a respective user.
9. The method of claim 8 , wherein the instructions executable by the processor are further configured for:
securing each of the plurality of unique cyber behavior profiles prior to storing within the cyber behavior repository.
10. The method of claim 8 , wherein the instructions executable by the processor are further configured for:
monitoring an information technology environment using the plurality of unique behavioral identifiers;
performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of unique cyber behavior profiles.
11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring electronically-observable user interactions, the electronically-observable user interactions comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;
converting the electronically-observable user interactions into electronic information representing the electronically-observable user interactions, the electronic information representing the electronically-observable user interactions comprising multi-layered electronic information, each layer of the multi-layered electronic information corresponding to a respective layer of user interaction;
generating a multi-dimensional cyber behavior profile based upon the multi-layered electronic information representing the user interactions;
identifying a known good interaction between the user and the information handling system;
storing a representation of the known good interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a known good user behavior element;
identifying an anomalous interaction between the user and the information handling system;
storing a representation of the anomalous interaction between the user and the information handling system within the multi-dimensional cyber behavior profile as a suspect user behavior element;
generating a user behavior profile score and a hash based upon the known good interaction and the anomalous interaction; and,
storing the user behavior profile score and the hash within the multi-dimensional cyber behavior profile.
12. The non-transitory, computer-readable storage medium of claim 11 , wherein the computer executable instructions are further configured for:
associating the unique multi-dimensional cyber behavior profile with the user.
13. The non-transitory, computer-readable storage medium of claim 12 , wherein:
the monitoring user interactions comprises monitoring a plurality of points of observability of the information handling system, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and,
each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.
14. The non-transitory, computer-readable storage medium of claim 11 , wherein:
at least one respective layer of user interaction corresponds to temporal user interactions.
15. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the multi-dimensional cyber behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the plurality of points of observability comprise an action based point of observability, activity based point of observability and behavior based point of observability.
17. The non-transitory, computer-readable storage medium of claim 11 , wherein the computer executable instructions are further configured for:
identifying the interactions between the user and the information handling system used for generating the unique cyber behavior profile as known good behavior;
determining whether additional interactions identified as between the user and the information handling system do not correspond to the known good behavior; and,
performing an enforcement operation when additional interactions identified as between the user and the information handling system do not correspond to the known good behavior.
18. The non-transitory, computer-readable storage medium of claim 11 , wherein the computer executable instructions are further configured for:
storing the unique cyber behavior profile within a cyber behavior repository, the cyber behavior repository containing a plurality of unique cyber behavior profiles, each the plurality of unique cyber behavior profiles corresponding to a respective user.
19. The non-transitory, computer-readable storage medium of claim 18 , wherein the computer executable instructions are further configured for:
securing each of the plurality of unique cyber behavior profiles prior to storing within the cyber behavior repository.
20. The non-transitory, computer-readable storage medium of claim 18 , wherein the computer executable instructions are further configured for:
monitoring an information technology environment using the plurality of unique behavioral identifiers;
performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of unique cyber behavior profiles.