Granted Patent B1

US 12,549,575 · App. 18/065,477 · Granted Feb 10, 2026

Inventors: Harish Kumar Bharat Singh (Pleasanton, CA); Weifei Zeng (Sunnyvale, CA); Trevor A. Welsh (Sherborn, MA); Vikram Kapoor (Cupertino, CA); Theron Tock (Mountain View, CA); Ying Xie (Cupertino, CA); Vimalkumar Jeyakumar (Los Altos, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (26)

1 . A method of determining user risk based on user posture and activity, the method comprising:

determining a risk score for a user based on a security posture associated with the user and historical activity associated with the user, wherein the risk score is based, at least in part, on use of a privilege change graph that represents privilege changes as edges to indicate changes in user privilege levels corresponding to the user;

generating a dossier for a domain based on the risk score, wherein the dossier provides statistical information corresponding to the user and historical activity for a time frame; and

controlling access by the user to one or more resources based on the risk score.

2 . The method of claim 1 wherein determining a risk score comprises calculating a security posture score based on the security posture, wherein the security posture comprises a degree of access associated with the user, wherein the risk score is based on the security posture score.

3 . The method of claim 2 wherein the security posture further comprises one or more authentication mechanisms enabled for the user.

4 . The method of claim 2 wherein determining the risk score comprises determining an activity risk score based on the historical activity associated with the user, wherein the risk score is based on the activity risk score.

5 . The method of claim 4 wherein the historical activity associated with the user comprises information describing one or more locations associated with the user.

6 . The method of claim 4 wherein the historical activity associated with the user comprises information describing one or more devices associated with the user.

7 . The method of claim 4 wherein the historical activity associated with the user comprises information describing one or more resources accessed by the user.

8 . The method of claim 1 further comprising generating a report based on the risk score for the user.

9 . The method of claim 8 wherein the report is based on one or more other risk scores corresponding to one or more other users.

10 . The method of claim 1 wherein controlling access to the one or more resources comprises initiating, based on the risk score, an approval workflow in response to a request to access the one or more resources.

11 . A computer program product for determining user risk based on user posture and activity, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions configurable to:

determine a risk score for a user based on a security posture associated with the user and historical activity associated with the user, wherein the risk score is based, at least in part, on use of a privilege change graph that represents privilege changes as edges to indicate changes in user privilege levels;

generate a dossier for a domain based on the risk score, wherein the dossier provides statistical information corresponding to the user and historical activity for a time frame; and

control access by the user to one or more resources based on the risk score.

12 . The computer program product of claim 11 wherein determining a risk score comprises calculating a security posture score based on the security posture, wherein the security posture comprises a degree of access associated with the user, wherein the risk score is based on the security posture score.

13 . The computer program product of claim 12 wherein the security posture further comprises one or more authentication mechanisms enabled for the user.

14 . The computer program product of claim 12 wherein determining the risk score comprises determining an activity risk score based on the historical activity associated with the user, wherein the risk score is based on the activity risk score.

15 . The computer program product of claim 14 wherein the historical activity associated with the user comprises information describing one or more locations associated with the user.

16 . The computer program product of claim 14 wherein the historical activity associated with the user comprises information describing one or more devices associated with the user.

17 . The computer program product of claim 14 wherein the historical activity associated with the user comprises information describing one or more resources accessed by the user.

18 . The computer program product of claim 11 wherein the steps further comprise generating a report based on the risk score for the user.

19 . The computer program product of claim 18 wherein the report is based on one or more other risk scores corresponding to one or more other users.

20 . The computer program product of claim 11 wherein controlling access to the one or more resources comprises initiating, based on the risk score, an approval workflow in response to a request to access the one or more resources.

Assignments (2)

Continuity (8)

References Cited (400)