Granted Patent B2

US 10,645,096 · App. 16/211,674 · Granted May 5, 2020

Abstract

Claims (82)

1. A computer-implementable method for monitoring user behavior elements, comprising:

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

2. The method of claim 1 , wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

3. The method of claim 1 , wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and,

the user profile comprises a multi-layered user behavior profile.

4. The method of claim 3 , wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

5. The method of claim 1 , wherein:

each electronically-observable user behavior has a corresponding behavior element.

6. The method of claim 5 , wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

8. The system of claim 7 , wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

9. The system of claim 7 , wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and,

the user profile comprises a multi-layered user behavior profile.

10. The system of claim 9 , wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

11. The system of claim 7 , wherein:

each electronically-observable user behavior has a corresponding behavior element.

12. The system of claim 11 , wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user behavior, the electronically-observable user behavior comprising interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a user behavior element, the user behavior element representing a user behavior activity;

identifying an anomalous interaction between at least one of the user and the user device, the user and the network and the user and the resource;

storing a representation of the anomalous interaction within the user behavior profile as a suspect user profile element;

providing the user behavior profile to a user behavior monitoring system;

generating a user behavior profile score for the user;

assessing a state of the user when enacting the user behavior activity, the accessing being based upon the user behavior profile score;

determining, via the user behavior monitoring system, whether the user behavior activity corresponds to a malicious activity, the determining using the user behavior element, the suspect user profile element and the state of the user when making the determination;

and,

performing, via the user behavior monitoring system, an enforcement operation when the user behavior activity is determined to be malicious.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the electronically-observable user behavior further comprise interactions between a user and another user.

15. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the generating the user profile comprises associating each of the interactions between a user and a user device, interactions between a user and a network and interactions between a user and a resource with a respective layer, each respective layer corresponding to a respective interaction; and,

the user profile comprises a multi-layered user behavior profile.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein:

the respective interaction corresponds to at least one of a particular user authentication, a particular identification and a particular behavior factor; and,

the respective layer comprises a level of temporal detail corresponding to the at least one particular user authentication, particular identification and particular behavior factor.

17. The non-transitory, computer-readable storage medium of claim 13 , wherein:

each electronically-observable user behavior has a corresponding behavior element.

18. The non-transitory, computer-readable storage medium of claim 17 , wherein:

at least one corresponding behavior element comprises a physical behavior element, the physical behavior element referring to a behavior of a user in performance of a particular action within a physical realm; and,

at least one corresponding behavior element comprises a cyber behavior element, the cyber behavior element referring to a behavior of a user in performance of a particular action within cyberspace.

19. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (7)