Granted Patent B2

US 10,542,013 · App. 16/102,029 · Granted Jan 21, 2020

Inventors: Richard Anthony Ford (Austin, TX); Brandon L. Swafford (Stamford, CT); Christopher Brian Shirey (Leander, TX); Matthew P. Moynahan (Austin, TX); Richard Heath Thompson (Austin, TX)

Assignee: Forcepoint LLC

H04L63/14H04L9/3236H04L63/1433H04L67/306H04L2209/38H04L2209/56

Abstract

Claims (65)

1. A computer-implementable method for generating a cyber behavior profile, comprising:

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the electronically-observable user behavior comprising respective user behavior elements;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior;

storing information relating to the user behavior profile in a behavior blockchain;

determining whether a user behavior is suspect;

generating a user behavior block representing the suspect user behavior; and,

appending the user behavior block to the behavior blockchain, the user behavior block comprising a known good user behavior representation when the user behavior is not suspect and a suspect user behavior representation when the user behavior is suspect.

2. The method of claim 1 , wherein:

the electronic information representing the user interactions comprise a user behavior element; and further comprising

storing information relating to the user behavior element in a user behavior block of the behavior blockchain.

3. The method of claim 2 , wherein:

the user behavior block comprises a transaction payload; and,

the transaction payload includes a representation of the user behavior profile.

4. The method of claim 3 , wherein:

the transaction payload comprises executable code, the executable code being used by a user behavior monitoring system to detect at least one of acceptable behavior, anomalous behavior, malicious behavior and unknown behavior being enacted by a user.

5. The method of claim 3 , wherein:

the transaction payload comprises a user behavior score, the user behavior score being used by a user behavior monitoring system to assess a particular user while enacting a given user behavior.

6. The method of claim 1 , wherein:

the user behavior profile is based upon at least one of an identification factor and a user behavior factor.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the electronically-observable user behavior comprising respective user behavior elements;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior;

storing information relating to the user behavior profile in a behavior blockchain;

determining whether a user behavior is suspect;

generating a user behavior block representing the suspect user behavior; and,

appending the user behavior block to the behavior blockchain, the user behavior block comprising a known good user behavior representation when the user behavior is not suspect and a suspect user behavior representation when the user behavior is suspect.

8. The system of claim 7 , wherein:

the electronic information representing the user interactions comprise a user behavior element; and the instructions are further configured for:

storing information relating to the user behavior element in a user behavior block of the behavior blockchain.

9. The system of claim 8 , wherein:

the user behavior profile is based upon at least one of an identification factor and a user behavior factor.

10. The system of claim 8 , wherein:

the user behavior block comprises a transaction payload; and,

the transaction payload includes a representation of the unique cyber behavior profile.

11. The system of claim 10 , wherein:

the transaction payload comprises executable code, the executable code being used by a user behavior monitoring system to detect at least one of acceptable behavior, anomalous behavior, malicious behavior and unknown behavior being enacted by a user.

12. The system of claim 10 , wherein:

the transaction payload comprises a user behavior score, the user behavior score being used by a user behavior monitoring system to assess a particular user while enacting a given user behavior.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user behavior;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior, the electronic information representing the electronically-observable user behavior comprising respective user behavior elements;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior;

storing information relating to the user behavior profile in a behavior blockchain;

determining whether a user behavior is suspect;

generating a user behavior block representing the suspect user behavior; and,

appending the user behavior block to the behavior blockchain, the user behavior block comprising a known good user behavior representation when the user behavior is not suspect and a suspect user behavior representation when the user behavior is suspect.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the electronic information representing the user interactions comprise a user behavior element; and the instructions are further configured for:

storing information relating to the user behavior element in a user behavior block of the behavior blockchain.

15. The non-transitory, computer-readable storage medium of claim 14 , wherein:

the user behavior profile is based upon at least one of an identification factor and a user behavior factor.

16. The non-transitory, computer-readable storage medium of claim 14 , wherein:

the user behavior block comprises a transaction payload; and,

the transaction payload includes a representation of the unique cyber behavior profile.

17. The non-transitory, computer-readable storage medium of claim 16 , wherein:

the transaction payload comprises executable code, the executable code being used by a user behavior monitoring system to detect at least one of acceptable behavior, anomalous behavior, malicious behavior and unknown behavior being enacted by a user.

18. The non-transitory, computer-readable storage medium of claim 16 , wherein:

the transaction payload comprises a user behavior score, the user behavior score being used by a user behavior monitoring system to assess a particular user while enacting a given user behavior.

19. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (10)