Patent ID: 11902295
Assignee: FORCEPOINT LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 5:
6. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity, the first entity comprising a first user entity;
monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity, the second entity comprising a second user entity;
determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity a nd the second entity, the entity interaction between the first entity and the second entity comprises a conveyance of data;
generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity, the entity interaction map providing a historical mapping of the conveyance of data between the first entity to the second entity, the generating the entity interaction map including generating a representation of a concatenation of correlated entity interactions;
the entity interaction map providing a historical mapping of the conveyance of data between the first entity to the second entity, the generating the entity interaction map including generating a representation of a concatenation of correlated entity interactions; and,
using the entity interaction map to perform a forensics analysis upon detection of the anomalous event.