Patent ID: 9641544
Date: 2017-05-02
CPC Classifications: H04L

Claim:
1. A system for automated insider threat prevention, comprising: a processor of a network device configured to: detect an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, wherein the anomalous activity includes an anomalous file transfer activity associated with the user, and wherein the anomalous activity is determined to be suspicious based on one or more file transfer application activities associated with the user based on a threshold comparison with the behavior profile for the user; perform an action in response to the detected anomalous activity based on a policy, wherein perform the action in response to the detected anomalous activity based on the policy comprises: throttle the anomalous file transfer activity; and receive a notification associated with another anomalous activity associated with another user, wherein the another anomalous activity is detected based on monitored network communications associated with the another user based on another behavior profile for the another user; and a memory coupled to the processor and configured to provide the processor with instructions.