Security analytics system for performing a risk analysis operation taking into account social behavior peer grouping
View Patent ↗A system, method, and computer-readable medium are disclosed for performing entity interaction risk analysis operation. The entity interaction risk analysis operation includes: monitoring an entity, the monitoring observing an electronically-observable data source; identifying an interaction between the entity and another entity based upon the monitoring; analyzing the interaction between the entity and the another entity; and, performing a security operation in response to the analyzing the interaction.
1. A computer-implementable method for performing an entity interaction risk analysis operation, comprising:
monitoring an entity, the monitoring observing an electronically-observable data source;
identifying a security related activity associated with the entity, the security related activity comprising a concerning behavior, the concerning behavior comprising a corresponding concerning behavior score,
identifying an interaction between the entity and another entity based upon the monitoring;
analyzing the interaction between the entity and the another entity;
generating a user behavior score based upon the corresponding concerning behavior score and the analyzing the interaction between the entity and the another entity; and,
performing a security operation via a security analytics system based upon the user behavior score, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
2. The method of claim 1 , wherein:
the analyzing includes generating an interaction factor based upon the interaction between the entity and the another entity and the security related activity.
3. The method of claim 1 , wherein:
the analyzing includes generating an amplification factor based upon the interaction between the entity and the another entity and the security related activity.
4. The method of claim 1 , wherein:
the analyzing includes generating a social interaction factor based upon the interaction between the entity and the another entity and the security related activity.
5. The method of claim 1 , wherein:
the interaction between the entity and the another entity is identified based upon a type of interaction between the entity and the another entity.
6. The method of claim 5 , wherein:
the type of interaction includes at least one of a collaboration interaction, a team interaction, a parallel peer interaction and a geographic interaction.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring an entity, the monitoring observing an electronically-observable data source;
identifying a security related activity associated with the entity, the security related activity comprising a concerning behavior, the concerning behavior comprising a corresponding concerning behavior score,
identifying an interaction between the entity and another entity based upon the monitoring;
analyzing the interaction between the entity and the another entity;
generating a user behavior score based upon the corresponding concerning behavior score and the analyzing the interaction between the entity and the another entity; and,
performing a security operation via a security analytics system based upon the user behavior score, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
8. The system of claim 7 , wherein:
the analyzing includes generating an interaction factor based upon the interaction between the entity and the another entity and the security related activity.
9. The system of claim 7 , wherein:
the analyzing includes generating an amplification factor based upon the interaction between the entity and the another entity and the security related activity.
10. The system of claim 7 , wherein:
the analyzing includes generating a social interaction factor based upon the interaction between the entity and the another entity and the security related activity.
11. The system of claim 10 , wherein:
the interaction between the entity and the another entity is identified based upon a type of interaction between the entity and the another entity.
12. The system of claim 11 , wherein:
the type of interaction includes at least one of a collaboration interaction, a team interaction, a parallel peer interaction and a geographic interaction.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring an entity, the monitoring observing an electronically-observable data source;
identifying a security related activity associated with the entity, the security related activity comprising a concerning behavior, the concerning behavior comprising a corresponding concerning behavior score,
identifying an interaction between the entity and another entity based upon the monitoring;
analyzing the interaction between the entity and the another entity;
generating a user behavior score based upon the corresponding concerning behavior score and the analyzing the interaction between the entity and the another entity; and,
performing a security operation via a security analytics system based upon the user behavior score, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the analyzing includes generating an interaction factor based upon the interaction between the entity and the another entity and the security related activity.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the analyzing includes generating an amplification factor based upon the interaction between the entity and the another entity and the security related activity.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the analyzing includes generating a social interaction factor based upon the interaction between the entity and the another entity and the security related activity.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the interaction between the entity and the another entity is identified based upon a type of interaction between the entity and the another entity.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
the type of interaction includes at least one of a collaboration interaction, a team interaction, a parallel peer interaction and a geographic interaction.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.