Granted Patent B2

US 10,664,614 · App. 16/295,429 · Granted May 26, 2020

Inventors: Richard A. Ford (Austin, TX); Ann Irvine (Baltimore, MD); Adam Reeve (Redmond, WA); Russell Snyder (Baltimore, MD); Benjamin Shih (Baltimore, MD)

Assignee: Forcepoint LLC

G06F21/6245G06F11/3438G06F21/552G06F21/577G06F21/602G06F21/6254G06F21/84H04L63/1408H04L63/1425H04L63/1433H04L63/1441H04L67/025H04L67/141H04L67/146H04L67/22H04L67/306G06F2221/031G06F2221/032G06F2221/034H04L63/20H04L67/289H04L2209/16

Abstract

Claims (52)

1. A computer-implementable method for adaptively assessing risk associated with an endpoint, comprising:

determining a risk level corresponding to an entity associated with an endpoint;

selecting a frequency of when to perform an endpoint monitoring interval and a duration of the endpoint monitoring interval;

collecting user behavior associated with the entity for the duration of the endpoint monitoring interval via the endpoint;

processing the user behavior to generate a current risk score for the entity, the processing comprising applying a risk-adaptive security policy to the user behavior, the risk-adaptive policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior;

comparing the current risk score of the entity to a historical risk score of the entity to determine whether a risk score of a user has changed; and

changing the risk score of the entity to the current risk score when the risk score of the entity has changed; and wherein

the risk adaptive policy is revised to increase the frequency of the endpoint monitoring interval when the current risk score of the entity increases over a plurality of endpoint monitoring intervals, the current risk score increasing being when the current risk score increases by less than 20% over the historical risk score; and,

the risk adaptive policy is revised to increase the frequency of the endpoint monitoring interval and the duration of the endpoint monitoring interval when the current risk score of the entity increases over a plurality of endpoint monitoring intervals, the current risk score increasing being when the current risk score increases by more than 20% over the historical risk score.

2. The method of claim 1 , wherein:

the risk adaptive security policy is revised via a security analytics system.

3. The method of claim 1 , wherein:

the endpoint comprises a risk-adaptive feature pack, the risk-adaptive feature pack comprising at least one of an event data detector module, an event data collector module and the risk-adaptive security policy.

4. The method of claim 1 further comprising:

decreasing the duration of the endpoint monitoring interval when the current risk score of the entity declines over a plurality of endpoint monitoring intervals; and,

decreasing the frequency of the endpoint monitoring interval when the current risk score of the entity remains substantially the same over a plurality of endpoint monitoring intervals.

5. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

determining a risk level corresponding to an entity associated with an endpoint;

selecting a frequency of when to perform an endpoint monitoring interval and a duration of the endpoint monitoring interval;

collecting user behavior associated with the entity for the duration of the endpoint monitoring interval via the endpoint;

processing the user behavior to generate a current risk score for the entity, the processing comprising applying a risk-adaptive security policy to the user behavior, the risk-adaptive policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior;

comparing the current risk score of the entity to a historical risk score of the entity to determine whether a risk score of a user has changed; and

changing the risk score of the entity to the current risk score when the risk score of the entity has changed; and wherein

the risk adaptive policy is revised to increase the frequency of the endpoint monitoring interval when the current risk score of the entity increases over a plurality of endpoint monitoring intervals, the current risk score increasing being when the current risk score increases by less than 20% over the historical risk score; and,

the risk adaptive policy is revised to increase the frequency of the endpoint monitoring interval and the duration of the endpoint monitoring interval when the current risk score of the entity increases over a plurality of endpoint monitoring intervals, the current risk score increasing being when the current risk score increases by more than 20% over the historical risk score.

6. The system of claim 5 , wherein:

the risk adaptive security policy is revised via a security analytics system.

7. The system of claim 5 , wherein:

the endpoint comprises a risk-adaptive feature pack, the risk-adaptive feature pack comprising at least one of an event data detector module, an event data collector module and the risk-adaptive security policy.

8. The system of claim 5 , wherein the instructions executable by the processor are further configured for:

decreasing the duration of the endpoint monitoring interval when the current risk score of the entity declines over a plurality of endpoint monitoring intervals; and,

decreasing the frequency of the endpoint monitoring interval when the current risk score of the entity remains substantially the same over a plurality of endpoint monitoring intervals.

9. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

determining a risk level corresponding to an entity associated with an endpoint;

collecting user behavior associated with the entity via the endpoint;

processing the user behavior to generate a current risk score for the entity, the processing comprising applying a risk-adaptive security policy to the user behavior, the risk-adaptive policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior;

comparing the current risk score of the entity to a historical risk score of the entity to determine whether a risk score of a user has changed; and

changing the risk score of the entity to the current risk score when the risk score of the entity has changed.

10. The non-transitory, computer-readable storage medium of claim 9 , wherein:

the risk adaptive security policy is revised via a security analytics system.

11. The non-transitory, computer-readable storage medium of claim 9 , wherein:

the endpoint comprises a risk-adaptive feature pack, the risk-adaptive feature pack comprising at least one of an event data detector module, an event data collector module and the risk-adaptive security policy.

12. The non-transitory, computer-readable storage medium of claim 9 , wherein the computer executable instructions are further configured for:

decreasing the duration of the endpoint monitoring interval when the current risk score of the entity declines over a plurality of endpoint monitoring intervals; and,

decreasing the frequency of the endpoint monitoring interval when the current risk score of the entity remains substantially the same over a plurality of endpoint monitoring intervals.

13. The non-transitory, computer-readable storage medium of claim 9 , wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

14. The non-transitory, computer-readable storage medium of claim 9 , wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (11)