Patent ID: 9589245
Date: 2017-03-07
CPC Classifications: G06F,G06Q,H04L

Claim:
1. A method comprising: deploying a plurality of detectors within an infrastructure of an organization; storing electronic data in a database, the electronic data corresponding to computer activity of an entity detected by the plurality of detectors within the infrastructure of an organization; determining, using the plurality of detectors, features of the electronic data corresponding to the computer activity of the entity, wherein different ones of the plurality of detectors are configured to detect different features; classifying the features corresponding to the computer activity of the entity to determine classified features, each of the classified features having a score; determining a plurality of sequences of the classified features, wherein each of the sequences of the classified features matches a different pattern of insider threat from among a plurality of models of insider threat activity, wherein the models of insider threat activity each include one or more of the patterns of insider threat; determining a plurality of scores for the entity, each of the scores determined using an aggregation of the scores of the classified features in a corresponding one of the sequences of the classified features matching the patterns of insider threat; and predicting an insider threat corresponding to the entity and at least one of the patterns of insider threat using the scores, wherein the prediction of the insider threat causes a security procedure to be enacted within the infrastructure of the organization.