Adaptive trust profile behavioral fingerprint
A system, method, and computer-readable medium are disclosed for using a behavioral fingerprint via a behavioral fingerprint operation. In various embodiments the behavioral fingerprint operation includes: monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity; converting the electronically-observable action of the entity to electronic information representing the action of the entity; generating the behavioral fingerprint based upon observations associated with the action of the entity; and, using the behavioral fingerprint in combination with an adaptive trust profile to generate an inference regarding the entity.
1. A computer-implementable method for using a behavioral fingerprint, comprising:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity, the entity comprising a user entity, the user entity enacting a user behavior;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating the behavioral fingerprint based upon observations associated with the action of the entity, the behavioral fingerprint comprising a distinctive, characteristic indicator of an identity of an enactor of an entity behavior;
using the behavioral fingerprint in combination with an adaptive trust profile to generate an inference regarding the entity;
performing a security analytics operation via a security analytics system, the security analytics operation using the behavioral fingerprint and the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating entity behavior representing a security risk; and,
mitigating the security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
2. The method of claim 1 , wherein:
the behavioral fingerprint comprises a session-based fingerprint.
3. The method of claim 1 , wherein:
the behavioral fingerprint comprises a collection of information reflecting an inferred mental state of a user entity during occurrence of the event.
4. The method of claim 1 , wherein:
the behavioral fingerprint is uniquely associated with a particular entity.
5. The method of claim 1 , wherein:
the behavioral fingerprint is used by a security analytics system when performing a security analytics operation.
6. The method of claim 5 , wherein:
the security analytics operation determines whether the event is of analytic utility.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity, the entity comprising a user entity, the user entity enacting a user behavior;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating the behavioral fingerprint based upon observations associated with the action of the entity, the behavioral fingerprint comprising a distinctive, characteristic indicator of an identity of an enactor of an entity behavior;
using the behavioral fingerprint in combination with an adaptive trust profile to generate an inference regarding the entity;
performing a security analytics operation via a security analytics system, the security analytics operation using the behavioral fingerprint and the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating entity behavior representing a security risk; and,
mitigating a security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
8. The system of claim 7 , wherein:
the behavioral fingerprint comprises a session-based fingerprint.
9. The system of claim 7 , wherein:
the behavioral fingerprint comprises a collection of information reflecting an inferred mental state of a user entity during occurrence of the event.
10. The system of claim 7 , wherein:
the behavioral fingerprint is uniquely associated with a particular entity.
11. The system of claim 7 , wherein:
the behavioral fingerprint is used by a security analytics system when performing a security analytics operation.
12. The system of claim 11 , wherein:
the security analytics operation determines whether the event is of analytic utility.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity, the entity comprising a user entity, the user entity enacting a user behavior;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating the behavioral fingerprint based upon observations associated with the action of the entity, the behavioral fingerprint comprising a distinctive, characteristic indicator of an identity of an enactor of an entity behavior;
using the behavioral fingerprint in combination with an adaptive trust profile to generate an inference regarding the entity;
performing a security analytics operation via a security analytics system, the security analytics operation using the behavioral fingerprint and the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating entity behavior representing a security risk; and,
mitigating the security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the behavioral fingerprint comprises a session-based fingerprint.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the behavioral fingerprint comprises a collection of information reflecting an inferred mental state of a user entity during occurrence of the event.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the behavioral fingerprint is uniquely associated with a particular entity.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the behavioral fingerprint is used by a security analytics system when performing a security analytics operation.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
the security analytics operation determines whether the event is of analytic utility.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.