Granted Patent B2

US 12,373,585 · App. 18/232,692 · Granted Jul 29, 2025

Inventors: Arjun Sambamoorthy (Sunnyvale, CA); Prashanth Arun (Sunnyvale, CA); Dhananjay Sampath (Sunnyvale, CA); Sanjay Singh (Sunnyvale, CA); Salil Kanetkar (Sunnyvale, CA)

Assignee: ArmorBlox LLC

G06F21/6209G06F21/604G06F40/40H04L51/08G06F2221/2141

Abstract

Claims (90)

1. A method comprising:

obtaining a behavioral model that represents first behavioral characteristics of a user account in a set of messages sent from the user account, the first behavioral characteristics indicating historical behavior of the user account observed in the set of messages;

storing an association between the behavioral model and the user account;

accessing an outbound message sent from the user account and destined for a recipient account, the outbound message at least one of indicating a storage location of a document or having the document as an attachment;

identifying, from words in the outbound message, second behavioral characteristics representing a current behavior of the user account represented in the words of the outbound message;

determining a sensitivity level of information in the document;

obtaining a data access policy associated with the sensitivity level, the data access policy indicating a behavioral threshold according to which access to the document is managed;

determining a difference between the first behavioral characteristics represented in the behavioral model and the second behavioral characteristics identified from the outbound message, wherein the difference indicates a measure of deviation in behavior of the user account in the historical behavior relative to the current behavior;

using the difference and the behavioral threshold to determine that

the current behavior of the user account deviates from the historical behavior such that the behavioral threshold is violated;

determining that the outbound message was transmitted to the recipient account;

receiving, from the recipient account, an access request associated with the outbound message to access the at least one of the storage location of the document or the document as the attachment; and

based on the behavioral threshold being violated, blocking the access request associated with the at least one of the storage location of the document or the document as the attachment by restricting access to the document by the recipient account.

2. The method of claim 1 , further comprising:

calculating a risk score for the outbound message based on the difference; and

based on the risk score violating the behavioral threshold, restricting access to the document by the recipient account.

3. The method of claim 1 , wherein the data access policy further comprises a second behavioral threshold at which a notification to an administrator of the document is generated,

further comprising, in response to determining that the difference violates the second behavioral threshold, generating the notification, to the administrator, comprising an indication of the outbound message, from the user account, associated with the document.

4. The method of claim 1 , wherein the data access policy further comprises a rule requiring encryption of an outbound messages having documents that are associated with the sensitivity level,

further comprising, in response to determining that the difference violates the behavioral threshold, encrypting the outbound message, to the recipient account, having the document as an attachment to the outbound message.

5. The method of claim 1 , further comprising:

determining that the sensitivity level indicates that sensitive information is included in the document;

determining that at least one of the user account or recipient account is restricted from accessing the sensitive information; and

restricting access to the document.

6. The method of claim 1 , wherein the data access policy further comprises a set of identities permitted to access documents associated with the sensitivity level, the set of identities including the user account;

further comprising, in response to the difference violating the behavioral threshold, modifying the data access policy by removing the recipient account from the set of identities.

7. The method of claim 1 , further comprising:

identifying a characteristic of the user account;

obtaining a group behavioral model that represents third behavioral characteristics identified in a second set of messages sent from a group of users exhibiting the characteristic;

determining a second difference between the third behavioral characteristics represented in the group behavioral model and the second behavioral characteristics identified from the outbound message; and

wherein the blocking the access request to the document by the recipient account is further performed based at least in part on the second difference.

8. A computing system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

obtaining a behavioral model that represents first behavioral characteristics of a user account in a set of messages sent from the user account, the first behavioral characteristics indicating historical behavior of the user account observed in the set of messages;

storing an association between the behavioral model and the user account;

accessing an outbound message sent from the user account and destined for a recipient account, the outbound message at least one of indicating a storage location of a document or having the document as an attachment;

identifying, from words in the outbound message, second behavioral characteristics representing a current behavior of the user account represented in the words of the outbound message;

determining a sensitivity level of information in the document;

obtaining a data access policy associated with the sensitivity level, the data access policy indicating a behavioral threshold according to which access to the document is managed;

determining a difference between the first behavioral characteristics represented in the behavioral model and the second behavioral characteristics identified from the outbound message, wherein the difference indicates a measure of deviation in behavior of the user account in the historical behavior relative to the current behavior;

using the difference and the behavioral threshold to determine that

the current behavior of the user account deviates from the historical behavior such that the behavioral threshold is violated;

determining that the outbound message was transmitted to the recipient account;

receiving, from the recipient account, an access request associated with the outbound message to access the at least one of the storage location of the document or the document as the attachment; and

based on the behavioral threshold being violated, blocking the access request associated with the at least one of the storage location of the document or the document as the attachment by restricting access to the document by the recipient account.

9. The computing system of claim 8 , the operations further comprising:

calculating a risk score for the outbound message based on the difference; and

based on the risk score violating the behavioral threshold, restricting access to the document by the recipient account.

10. The computing system of claim 8 , wherein the data access policy further comprises a second behavioral threshold at which a notification to an administrator of the document is generated,

further comprising, in response to determining that the difference violates the second behavioral threshold, generating the notification, to the administrator, comprising an indication of the outbound message, from the user account, associated with the document.

11. The computing system of claim 8 , wherein the data access policy further comprises a rule requiring encryption of an outbound messages having documents that are associated with the sensitivity level,

further comprising, in response to determining that the difference violates the behavioral threshold, encrypting the outbound message, to the recipient account, having the document as an attachment to the outbound message.

12. The computing system of claim 8 , wherein the data access policy further comprises a set of identities permitted to access documents associated with the sensitivity level, the set of identities including the user account;

further comprising, in response to the difference violating the behavioral threshold, modifying the data access policy by removing the recipient account from the set of identities.

13. The computing system of claim 8 , the operations further comprising: identifying a characteristic of the user account;

obtaining a group behavioral model that represents third behavioral characteristics identified in a second set of messages sent from a group of users exhibiting the characteristic;

determining a second difference between the third behavioral characteristics represented in the group behavioral model and the second behavioral characteristics identified from the outbound message; and

wherein the blocking the access request to the document by the recipient account is further performed based at least in part on the second difference.

14. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause a network orchestrator to perform operations comprising:

obtaining a behavioral model that represents first behavioral characteristics of a user account in a set of messages sent from the user account, the first behavioral characteristics indicating historical behavior of the user account observed in the set of messages;

storing an association between the behavioral model and the user account;

accessing an outbound message sent from the user account and destined for a recipient account, the outbound message at least one of indicating a storage location of a document or having the document as an attachment;

identifying, from words in the outbound message, second behavioral characteristics representing a current behavior of the user account represented in the words of the outbound message;

determining a sensitivity level of information in the document;

obtaining a data access policy associated with the sensitivity level, the data access policy indicating a behavioral threshold according to which access to the document is managed;

determining a difference between the first behavioral characteristics represented in the behavioral model and the second behavioral characteristics identified from the outbound message, wherein the difference indicates a measure of deviation in behavior of the user account in the historical behavior relative to the current behavior;

using the difference and the behavioral threshold to determine that

the current behavior of the user account deviates from the historical behavior such that the behavioral threshold is violated;

determining that the outbound message was transmitted to the recipient account;

receiving, from the recipient account, an access request associated with the outbound message to access the at least one of the storage location of the document or the document as the attachment; and

based on the behavioral threshold being violated, blocking the access request associated with the at least one of the storage location of the document or the document as the attachment by restricting access to the document by the recipient account.

15. The one or more non-transitory computer-readable media of claim 14 , the operations further comprising:

calculating a risk score for the outbound message based on the difference; and

based on the risk score violating the behavioral threshold, restricting access to the document by the recipient account.

16. The one or more non-transitory computer-readable media of claim 14 , wherein the data access policy further comprises a second behavioral threshold at which a notification to an administrator of the document is generated,

further comprising, in response to determining that the difference violates the second threshold, generating the notification, to the administrator, comprising an indication of the outbound message, from the user account, associated with the document.

17. The one or more non-transitory computer-readable media of claim 14 , wherein the data access policy further comprises a rule requiring encryption of an outbound messages having documents that are associated with the sensitivity level,

further comprising, in response to determining that the difference violates the behavioral threshold, encrypting the outbound message, to the recipient account, having the document as an attachment to the outbound message.

18. The one or more non-transitory computer-readable media of claim 14 , wherein the first data access policy further comprises a set of identities permitted to access documents associated with the sensitivity level, the set of identities including the user account;

further comprising, in response to the difference violating the behavioral threshold, modifying the data access policy by removing the recipient account from the set of identities.

19. The one or more non-transitory computer-readable media of claim 14 , the operations further comprising:

identifying a characteristic of the user account;

obtaining a group behavioral model that represents third behavioral characteristics identified in a second set of messages sent from a group of users exhibiting the characteristic; and

determining a second difference between the third behavioral characteristics represented in the group behavioral model and the second behavioral characteristics identified from the outbound message;

wherein the blocking the access request to the document by the recipient account is further performed based at least in part on the second difference.

20. The one or more non-transitory computer-readable media of claim 14 , the operations further comprising:

determining that the sensitivity level indicates that sensitive information is included in the document;

determining that at least one of the user account or recipient account is restricted from accessing the sensitive information; and

restricting access to the document.

Assignments (2)

Continuity (3)

References Cited (17)