Granted Patent B1

US 12,598,205 · App. 18/483,263 · Granted Apr 7, 2026

Inventors: Conor Hayes (Monte Sereno, CA); Ying Xie (Cupertino, CA); Vimalkumar Jeyakumar (Los Altos, CA); Theron Tock (Mountain View, CA); Harish Kumar Bharat Singh (Pleasanton, CA); Vikram Kapoor (Saratoga, CA); Weifei Zeng (Sunnyvale, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (38)

1 . A method of browser-based detection of data exfiltration, the method comprising:

gathering, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;

generating a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;

computing a risk score based on the deviation between the first information and the behavioral profile; and

determining whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.

2 . The method of claim 1 wherein determining whether the first information indicates the data exfiltration comprises:

identifying, based on the first information, data input to the browser, wherein the behavioral profile is continuously updated based on ongoing browser activity.

3 . The method of claim 2 , wherein the risk score is based on at least in part on a confidence level associated with the deviation.

4 . The method of claim 2 , wherein determining whether the first information indicates the data exfiltration is based on contents of the data.

5 . The method of claim 1 , further comprising:

gathering second information describing user activity with the device and generated by an application executed on the device, wherein determining whether the first information indicates the data exfiltration is based on the second information.

6 . The method of claim 5 , wherein determining whether the first information indicates the data exfiltration is based on a source of data input to the browser as indicated in the second information.

7 . The method of claim 6 , wherein the source comprises another application executed on the user device.

8 . The method of claim 5 , wherein determining whether the first information indicates the data exfiltration comprises correlating activity indicated in the first information with activity indicated in the second information.

9 . The method of claim 1 , further comprising enforcing, by the browser extension, one or more data exfiltration policies.

10 . The method of claim 1 further comprising generating, based on the first information, one or more performance benchmarks.

11 . A computer program product for browser-based detection of data exfiltration, the computer program product including computer program instructions configurable to:

gather, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;

generate a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;

compute a risk score based on the deviation between the first information and the behavioral profile; and

determine whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.

12 . The computer program product of claim 11 wherein determining whether the first information indicates the data exfiltration comprises:

identifying, based on the first information, data input to the browser, wherein determining whether the first information indicates the data exfiltration is based on the data input to the browser.

13 . The computer program product of claim 12 , wherein determining whether the first information indicates the data exfiltration is based on a page into which the data is input.

14 . The computer program product of claim 12 , wherein determining whether the first information indicates the data exfiltration is based on contents of the data.

15 . The computer program product of claim 11 , wherein the steps further comprise:

gathering second information describing user activity with the device and generated by an application executed on the device, wherein determining whether the first information indicates the data exfiltration is based on the second information.

16 . The computer program product of claim 15 , wherein determining whether the first information indicates the data exfiltration is based on a source of data input to the browser as indicated in the second information.

17 . The computer program product of claim 15 , wherein determining whether the first information indicates the data exfiltration comprises correlating activity indicated in the first information with activity indicated in the second information.

18 . The computer program product of claim 11 , wherein the steps further comprise enforcing, by the browser extension, one or more data exfiltration policies.

19 . The computer program product of claim 11 wherein the steps further comprise generating, based on the first information, one or more performance benchmarks.

20 . An apparatus for browser-based detection of data exfiltration, the apparatus comprising:

a processor; and

memory operatively coupled to the processor, wherein the memory stores computer program instructions that, when executed by the processor, cause the apparatus to:

gather, by a browser extension on a user device, first information describing browser activity of a browser of the device, wherein the first information includes user input activity and network destinations accessed by the browser;

generate a behavioral profile representing normal browser activity of a user of the device based on historical browser activity;

compute a risk score based on the deviation between the first information and the behavioral profile; and

determine whether the first information indicates a data exfiltration based on whether the risk score exceeds a predefined threshold.

Assignments (1)

Continuity (8)

References Cited (400)