Granted Patent B2

US 10,447,718 · App. 15/979,023 · Granted Oct 15, 2019

Abstract

Claims (63)

1. A computer-implementable method for performing a security analysis operation within a security environment, comprising:

monitoring electronically-observable user behavior about a particular entity;

maintaining a state about the particular entity, the state representing a context of a particular event;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a collection of information that describes the particular entity, the collection of information comprising at least one of a user profile attribute, a user behavior factor and a user mindset factor;

generating a mindset profile for the particular entity, the mindset profile representing aspects of the particular entity that are inferred based upon the electronically-observable user behavior, the mindset profile being generated using a combination of the user behavior profile and the state;

performing a security analysis operation via a security analytics system, the security analysis operation analyzing the event using the state of the entity, the mindset profile and the user behavior profile, the analyzing determining whether the electronically-observable user behavior about the particular entity does not correspond to known good behavior, the security analysis operation determining that the particular entity represents a security threat to an organization associated with the security analytics system when the electronically-observable user behavior about the particular entity does not correspond to known good behavior; and,

performing an enforcement operation when the electronically-observable user behavior about the particular entity does not correspond to known good behavior.

2. The method of claim 1 , further comprising:

associating the mindset profile within the user behavior profile.

3. The method of claim 1 , further comprising:

associating a higher-level meaning with the event based upon the analyzing.

4. The method of claim 1 , wherein:

the analyzing calculates how anomalous the event is.

5. The method of claim 1 , wherein:

the monitoring electronically-observable user behavior comprises monitoring a plurality of points of observability, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

6. The method of claim 5 , wherein:

the plurality of points of observability comprise an action based point of observability, an activity based point of observability and a behavior based point of observability.

7. The method of claim 5 , wherein:

the plurality of points of observability observer user behavior within at least one of a physical domain and a cyberspace environment.

8. The method of claim 1 , wherein:

the user behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

9. The method of claim 1 , further comprising:

identifying certain electronically-observable user behavior used for generating the user behavior profile as known good behavior;

determining whether additional electronically-observable user behavior do not correspond to the known good behavior; and,

performing an enforcement operation when additional electronically-observable user behavior do not correspond to the known good behavior.

10. The method of claim 8 , further comprising:

monitoring an information technology environment using the user behavior profile;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon the user behavior profile.

11. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code for generating a user behavior profile, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

monitoring electronically-observable user behavior about a particular entity;

maintaining a state about the particular entity, the state representing a context of a particular event;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a collection of information that describes the particular entity, the collection of information comprising at least one of a user profile attribute, a user behavior factor and a user mindset factor;

generating a mindset profile for the particular entity, the mindset profile representing aspects of the particular entity that are inferred based upon the electronically-observable user behavior, the mindset profile being generated using a combination of the user behavior profile and the state;

performing a security analysis operation via a security analytics system, the security analysis operation analyzing the event using the state of the entity, the mindset profile and the user behavior profile, the analyzing determining whether the electronically-observable user behavior about the particular entity does not correspond to known good behavior, the security analysis operation determining that the particular entity represents a security threat to an organization associated with the security analytics system when the electronically-observable user behavior about the particular entity does not correspond to known good behavior; and,

performing an enforcement operation when the electronically-observable user behavior about the particular entity does not correspond to known good behavior.

12. The system of claim 11 , wherein the instructions executable by the processor are further configured for:

associating the mindset profile within the user behavior profile.

13. The system of claim 11 , wherein:

associating a higher-level meaning with the event based upon the analyzing.

14. The system of claim 11 , wherein:

the analyzing calculates how anomalous the event is.

15. The system of claim 11 , wherein:

the monitoring electronically-observable user behavior comprises monitoring a plurality of points of observability, at least some of the plurality of points of observability corresponding to respective layers of user interaction; and,

each of the plurality of points of observability is converted into respective electronic information representing respective points of observability.

16. The system of claim 15 , wherein:

the plurality of points of observability comprise an action based point of observability, an activity based point of observability and a behavior based point of observability.

17. The system of claim 15 , wherein:

the plurality of points of observability observer user behavior within at least one of a physical domain and a cyberspace environment.

18. The system of claim 11 , wherein:

the user behavior profile comprises a multi-faceted user behavior profile comprising a plurality of facets, each of the plurality of facets corresponding to at least one of a user authentication factor, a user identification factor and a user behavior factor.

19. The system of claim 18 , wherein the instructions executable by the processor are further configured for:

identifying certain electronically-observable user behavior used for generating the user behavior profile as known good behavior;

determining whether additional electronically-observable user behavior do not correspond to the known good behavior; and,

performing an enforcement operation when additional electronically-observable user behavior do not correspond to the known good behavior.

20. The system of claim 18 , wherein the instructions executable by the processor are further configured for:

monitoring an information technology environment using the plurality of user behavior profiles;

performing an enforcement operation if a user interaction with the information technology environment does not correspond to interactions based upon at least one of the plurality of user behavior profiles.

Assignments (10)