IP Library › Granted Patent US 11,783,053
Granted Patent B2
US 11,783,053 · App. 17/709,673 · Granted Oct 10, 2023

Entity behavior catalog architecture

Inventors: Raffael Marty (Austin, TX); Alan Ross (Austin, TX); Nicolas Christian Fischbach (Uitikon, CH); Matthew P. Moynahan (Austin, TX); Chad Anson (Austin, TX)
Assignee: Forcepoint LLC
G06F21/577G06F21/552G06F21/554G06F21/566G06F21/6227G06N5/04G06N20/00H04L63/102H04L63/1425H04L63/1433H04L63/1441G06F2221/033G06F2221/034
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,783,053
App. No.
17/709,673
Granted
Oct 10, 2023
Kind
B2
Abstract

A system, method, and computer-readable medium are disclosed for performing an entity behavior cataloging operation. The entity behavior cataloging operation includes: identifying a security related activity, the security related activity being based upon an observable from an electronic data source; analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity; generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity; and, storing the entity behavior catalog data within an entity behavior catalog, the entity behavior catalog providing an inventory of entity behaviors for use when performing a security operation.

Claims (61)

1. A computer-implementable method for cataloging entity behavior, comprising:

identifying a security related activity, the security related activity being based upon an observable from an electronic data source;

analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity;

generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity;

storing the entity behavior catalog data within an entity behavior catalog system, the entity behavior catalog system providing an inventory of entity behaviors for use when performing a security operation, the entity behavior catalog system comprising an entity behavior profiles repository, the entity behavior profiles repository containing a plurality of entity behavior profiles, each entity behavior profile comprising information that describes an identity of a particular entity and behavior associated with the particular entity;

processing an entity behavior profile of a particular entity and contextual information relating to the particular entity to generate an inference regarding the particular entity;

processing the entity behavior profile of the particular entity and the inference regarding the particular entity to associate the entity behavior profile with a corresponding security risk use case; and,

associating the corresponding security risk use case with a corresponding security vulnerability scenario.

2. The method of claim 1 , wherein:

the entity behavior catalog data includes security vulnerability scenario data.

3. The method of claim 1 , wherein:

the entity behavior catalog data includes security risk use case data.

4. The method of claim 1 , wherein:

the entity behavior catalog data includes entity behavior profile data.

5. The method of claim 1 , wherein:

the entity behavior catalog data includes entity attribute and behavior data.

6. The method of claim 1 , wherein:

the entity behavior catalog data includes at least one of activity data and observable data.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

identifying a security related activity, the security related activity being based upon an observable from an electronic data source;

analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity;

generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity;

storing the entity behavior catalog data within an entity behavior catalog system, the entity behavior catalog system providing an inventory of entity behaviors for use when performing a security operation, the entity behavior catalog system comprising an entity behavior profiles repository, the entity behavior profiles repository containing a plurality of entity behavior profiles, each entity behavior profile comprising information that describes an identity of a particular entity and behavior associated with the particular entity;

processing an entity behavior profile of a particular entity and contextual information relating to the particular entity to generate an inference regarding the particular entity;

processing the entity behavior profile of the particular entity and the inference regarding the particular entity to associate the entity behavior profile with a corresponding security risk use case; and,

associating the corresponding security risk use case with a corresponding security vulnerability scenario.

8. The system of claim 7 , wherein:

the entity behavior catalog data includes security vulnerability scenario data.

9. The system of claim 7 , wherein:

the entity behavior catalog data includes security risk use case data.

10. The system of claim 7 , wherein:

the entity behavior catalog data includes entity behavior profile data.

11. The system of claim 7 , wherein:

the entity behavior catalog data includes entity attribute and behavior data.

12. The system of claim 11 , wherein:

the entity behavior catalog data includes at least one of activity data and observable data.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

identifying a security related activity, the security related activity being based upon an observable from an electronic data source;

analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity;

generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity;

storing the entity behavior catalog data within an entity behavior catalog system, the entity behavior catalog system providing an inventory of entity behaviors for use when performing a security operation, the entity behavior catalog system comprising an entity behavior profiles repository, the entity behavior profiles repository containing a plurality of entity behavior profiles, each entity behavior profile comprising information that describes an identity of a particular entity and behavior associated with the particular entity;

processing an entity behavior profile of a particular entity and contextual information relating to the particular entity to generate an inference regarding the particular entity;

processing the entity behavior profile of the particular entity and the inference regarding the particular entity to associate the entity behavior profile with a corresponding security risk use case; and,

associating the corresponding security risk use case with a corresponding security vulnerability scenario.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the entity behavior catalog data includes security vulnerability scenario data.

15. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the entity behavior catalog data includes security risk use case data.

16. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the entity behavior catalog data includes entity behavior profile data.

17. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the entity behavior catalog data includes entity attribute and behavior data.

18. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the entity behavior catalog data includes at least one of activity data and observable data.

19. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 31, 2022
From: MARTY, RAFFAEL; ROSS, ALAN; FISCHBACH, NICOLAS CHRISTIAN; ANSON, CHAD
To: FORCEPOINT, LLC
Reel/Frame 059456/0671 →