IP Library Granted Patent US 12,671,691
Granted Patent B2
US 12,671,691 · App. 18/665,630 · Granted Jun 30, 2026

Mode-based user activity monitoring in web browser

Inventors: Ofer Ben-Noon (Tel Aviv, IL); Ohad Bobrov (Tel Aviv, IL); Tal Keren (Tel Aviv, IL)
Assignee: Palo Alto Networks, Inc.
H04L63/10G06F21/16G06F21/554G06F21/6245H04L63/105H04L63/1433H04L63/205H04L67/1396H04L67/535G06F2009/45587G06F2221/034G06F2221/2141H04L67/306
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,671,691
App. No.
18/665,630
Granted
Jun 30, 2026
Kind
B2
Abstract

User activity is monitored in a web browser according to a continuous monitoring mode or a duty cycle monitoring mode. The duty cycle monitoring mode is a temporal configuration wherein monitoring occurs during sampling periods at a certain sampling frequency within a monitoring period of interest. The choice of monitoring mode is determined based on user key performance indicators and can be adjusted based on intensity of user activity within the web browser during the monitoring period of interest.

Claims (34)

1 . A method for monitoring activity of a user interacting with a group of digital resources via a web browser, the method comprising:

determining a user profile for the user comprising at least one key performance indicator (KPI) that characterizes the user activity when using the web browser to interact with the group of digital resources;

configuring the web browser to monitor data characterizing user activity while interacting with the group of digital resources using the web browser in an initial monitoring mode based, at least in part, on the at least one KPI and the user profile, wherein the initial monitoring mode comprises a duty cycle monitoring mode or a continuous monitoring mode;

monitoring the data characterizing user activity according to the initial monitoring mode; and

based on the data characterizing user activity indicating a change in intensity of interactions of the user with the group of digital resources, adjusting the initial monitoring mode.

2 . The method of claim 1 , wherein configuring the web browser to monitor data characterizing user activity in the initial monitoring mode is responsive to at least one of a cyberattack vulnerability feature of at least one of the user and the web browser, software that provides cyber protection to at least one of the user and the web browser, a clearance profile that determines permissions to access the group of digital resources, and a website that the user accesses.

3 . The method of claim 1 , wherein configuring the web browser to monitor data characterizing user activity in the initial monitoring mode comprises selecting at least one active KPI from the at least one KPI for which the web browser acquires monitoring data while monitoring user activity during a monitoring period of interest.

4 . The method of claim 1 , wherein the initial monitoring mode comprises the duty cycle monitoring mode, wherein configuring the web browser to monitor data characterizing user activity in the duty cycle monitoring mode comprises determining a sampling frequency of sampling periods during which the at least one KPI of the user is monitored and a duration of the sampling periods.

5 . The method of claim 1 , wherein configuring the web browser to monitor data characterizing user activity in the initial monitoring mode comprises determining a data analytics profile for the initial monitoring mode that specifies a type of analytics data to be generated.

6 . The method of claim 5 , wherein determining a type of analytics data comprises selecting at least one of proactive help analytics, security analytics, enrichment analytics, and audit analytics as the type of analytics data.

7 . The method of claim 1 , wherein adjusting the initial monitoring mode comprises at least one of changing the initial monitoring mode from the duty cycle monitoring mode to the continuous monitoring mode and changing the initial monitoring mode from the continuous monitoring mode to the duty cycle monitoring mode.

8 . The method of claim 1 , wherein the intensity of interactions of the user with the group of digital resources comprises a frequency of events corresponding to the user in the data characterizing user activity.

9 . A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to monitor activity of a user interacting with a group of digital resources via a web browser, where the instructions to monitor activity of the user comprise instructions to:

determine a user profile for the user comprising at least one key performance indicator (KPI) that characterizes the user activity when using the web browser to interact with the group of digital resources;

configure the web browser to monitor data characterizing user activity while interacting with the group of digital resources using the web browser in an initial monitoring mode based, at least in part, on the at least one KPI and the user profile, wherein the initial monitoring mode comprises a duty cycle monitoring mode or a continuous monitoring mode;

monitor the data characterizing user activity according to the initial monitoring mode; and

based on the data characterizing user activity indicating a change in intensity of interactions of the user with the group of digital resources, adjust the initial monitoring mode.

10 . The non-transitory machine-readable medium of claim 9 , wherein the instructions to adjust the initial monitoring mode comprise instructions to at least one of change the initial monitoring mode from the duty cycle monitoring mode to the continuous monitoring mode and change the initial monitoring mode from the continuous monitoring mode to the duty cycle monitoring mode.

11 . The non-transitory machine-readable medium of claim 9 , wherein the intensity of interactions of the user with the group of digital resources comprises a frequency of events corresponding to the user in the data characterizing user activity.

12 . The non-transitory machine-readable medium of claim 9 , wherein the instructions to configure the web browser to monitor data characterizing user activity in the initial monitoring mode comprise instructions to select at least one active KPI from the at least one KPI for which the web browser acquires monitoring data while monitoring user activity during a monitoring period of interest.

13 . The non-transitory machine-readable medium of claim 9 , wherein the initial monitoring mode comprises the duty cycle monitoring mode, wherein the instructions to configure the web browser to monitor data characterizing user activity in the duty cycle monitoring mode comprise instructions to determine a sampling frequency of sampling periods during which the at least one KPI of the user is monitored and a duration of the sampling periods.

14 . The non-transitory machine-readable medium of claim 9 , wherein the instructions to configure the web browser to monitor data characterizing user activity in the initial monitoring mode comprise instructions to determine a data analytics profile for the initial monitoring mode that specifies a type of analytics data to be generated.

15 . An apparatus comprising:

a processor; and

a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to monitor activity of a user interacting with a group of digital resources via a web browser, wherein the instructions to monitor activity of the user comprise instructions executable by the processor to cause the apparatus to,

determine a user profile for the user comprising at least one key performance indicator (KPI) that characterizes the user activity when using the web browser to interact with the group of digital resources;

configure the web browser to monitor data characterizing user activity while interacting with the group of digital resources using the web browser in an initial monitoring mode based, at least in part, on the at least one KPI and the user profile, wherein the initial monitoring mode comprises a duty cycle monitoring mode or a continuous monitoring mode;

monitor the data characterizing user activity according to the initial monitoring mode; and

based on the data characterizing user activity indicating a change in intensity of interactions of the user with the group of digital resources, adjust the initial monitoring mode.

16 . The apparatus of claim 15 , wherein the instructions to adjust the initial monitoring mode comprise instructions executable by the processor to cause the apparatus to at least one of change the initial monitoring mode from the duty cycle monitoring mode to the continuous monitoring mode and change the initial monitoring mode from the continuous monitoring mode to the duty cycle monitoring mode.

17 . The apparatus of claim 15 , wherein the intensity of interactions of the user with the group of digital resources comprises a frequency of events corresponding to the user in the data characterizing user activity.

18 . The apparatus of claim 15 , wherein the instructions to configure the web browser to monitor data characterizing user activity in the initial monitoring mode comprise instructions executable by the processor to cause the apparatus to select at least one active KPI from the at least one KPI for which the web browser acquires monitoring data while monitoring user activity during a monitoring period of interest.

19 . The apparatus of claim 15 , wherein the initial monitoring mode comprises the duty cycle monitoring mode, wherein the instructions to configure the web browser to monitor data characterizing user activity in the duty cycle monitoring mode comprise instructions executable by the processor to cause the apparatus to determine a sampling frequency of sampling periods during which the at least one KPI of the user is monitored and a duration of the sampling periods.

20 . The apparatus of claim 15 , wherein the instructions to configure the web browser to monitor data characterizing user activity in the initial monitoring mode comprise instructions executable by the processor to cause the apparatus to determine a data analytics profile for the initial monitoring mode that specifies a type of analytics data to be generated.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 24, 2025
From: TALON CYBER SECURITY LTD.
To: PALO ALTO NETWORKS, INC.
Reel/Frame 069993/0831 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 20, 2024
From: BEN-NOON, OFER; BOBROV, OHAD; KEREN, TAL
To: TALON CYBER SECURITY LTD.
Reel/Frame 067788/0483 →
Continuity (2)
Provisional Application 63354896 · Jun 23, 2022
Related Publication 20250181681A1 · Jun 5, 2025
References Cited (61)
US 9497205B1 · Claudatos et al. · 2016 [cited by applicant]
US 10552639B1 · Buzbee et al. · 2020 [cited by applicant]
US 11010476B2 · Wilczynski et al. · 2021 [cited by applicant]
US 11290429B1 · Ashley et al. · 2022 [cited by applicant]
US 11388167B2 · Boodaei · 2022 [cited by applicant]
US 11582316B1 · Danyi · 2023 [cited by examiner]
US 11949707B1 · Syme et al. · 2024 [cited by applicant]
US 12277246B1 · Manton et al. · 2025 [cited by applicant]
US 12299119B2 · Ko et al. · 2025 [cited by applicant]
US 20080159146A1 · Claudatos et al. · 2008 [cited by applicant]
US 20080162135A1 · Claudatos et al. · 2008 [cited by applicant]
US 20130227714A1 · Gula et al. · 2013 [cited by applicant]
US 20140129920A1 · Sheretov et al. · 2014 [cited by applicant]
US 20150047034A1 · Burnham et al. · 2015 [cited by applicant]
US 20150149558A1 · Mendez et al. · 2015 [cited by applicant]
US 20160019002A1 · Kurtin et al. · 2016 [cited by applicant]
US 20160080397A1 · Bacastow et al. · 2016 [cited by applicant]
US 20160286410A1 · O'Malley · 2016 [cited by examiner]
US 20170186019A1 · Loeb · 2017 [cited by examiner]
US 20170353496A1 · Pai et al. · 2017 [cited by applicant]
US 20180075058A1 · Boutnara · 2018 [cited by applicant]
US 20180191770A1 · Nachenberg · 2018 [cited by examiner]
US 20180219849A1 · Jones et al. · 2018 [cited by applicant]
US 20180351979A1 · Mandrychenko et al. · 2018 [cited by applicant]
US 20180373578A1 · Bridges · 2018 [cited by examiner]
US 20180375877A1 · Jakobsson · 2018 [cited by examiner]
US 20200151348A1 · Chauhan · 2020 [cited by applicant]
US 20200250323A1 · Remington et al. · 2020 [cited by applicant]
US 20200265112A1 · Fox et al. · 2020 [cited by applicant]
US 20200293684A1 · Harris et al. · 2020 [cited by applicant]
US 20210026982A1 · Amarendran et al. · 2021 [cited by applicant]
US 20210194888A1 · Bhaskar et al. · 2021 [cited by applicant]
US 20210250333A1 · Negrea et al. · 2021 [cited by applicant]
US 20210409446A1 · Di Mattia · 2021 [cited by applicant]
US 20220067216A1 · Bokade et al. · 2022 [cited by applicant]
US 20220188438A1 · Lewin et al. · 2022 [cited by applicant]
US 20220309183A1 · Jose et al. · 2022 [cited by applicant]
US 20220358234A1 · Shank et al. · 2022 [cited by applicant]
US 20220382902A1 · Panikkar · 2022 [cited by applicant]
US 20230140559A1 · Bendersky et al. · 2023 [cited by applicant]
US 20230262053A1 · Nilgiri et al. · 2023 [cited by applicant]
US 20230267219A1 · Perumalla et al. · 2023 [cited by applicant]
US 20240012941A1 · Goradia et al. · 2024 [cited by applicant]
US 20240039918A1 · Ben-Noon et al. · 2024 [cited by applicant]
US 20240045953A1 · Ben-Noon et al. · 2024 [cited by applicant]
US 20240193539A1 · Leu et al. · 2024 [cited by applicant]
US 20240378314A1 · Chawla et al. · 2024 [cited by applicant]
US 20250094593A1 · Smith et al. · 2025 [cited by applicant]
US 20250150512A1 · Ben-Noon et al. · 2025 [cited by applicant]
WO 2018213457A1 · 2018 [cited by applicant]
WO 2025015927A1 · 2025 [cited by applicant]
U.S. Appl. No. 18/665,654, Non-Final Office Action mailed Sep. 26, 2025, 7 pages. [cited by applicant]
U.S. Appl. No. 18/487,085, Notice of Allowance mailed Dec. 10, 2025, 17 pages. [cited by applicant]
U.S. Appl. No. 18/487,085, Notice of Allowance mailed Oct. 16, 2025, 11 pages. [cited by applicant]
U.S. Appl. No. 18/487,087, Final Office Action mailed Nov. 3, 2025, 9 pages. [cited by applicant]
U.S. Appl. No. 18/665,625, Notice of Allowance mailed Sep. 23, 2025, 24 pages. [cited by applicant]
U.S. Appl. No. 18/665,647, Non-Final Office Action mailed Nov. 3, 2025, 10 pages. [cited by applicant]
PCT Application PCT/IL2023/050652, International Preliminary Report on Patentability, mailed Jan. 2, 2025, 12 pages. [cited by applicant]
PCT Application PCT/IL2023/050652, International Search Report & Written Opinion mailed Nov. 28, 2023, 17 pages. [cited by applicant]
U.S. Appl. No. 18/487,087, Non-Final Office Action mailed May 8, 2025, 9 pages. [cited by applicant]
U.S. Appl. No. 18/487,085, Non-Final Office Action mailed Jun. 27, 2025, 14 pages. [cited by applicant]