Patent ID: 8707431
Filing Date: 2014-04-22
Classification: H04L

Abstract:
1. A method for insider threat detection in a network, comprising: collecting network packets associated with a set of network protocols, wherein the network packets are transmitted over the network; processing the collected network packets to generate information-use events for a user of the network, wherein the information-use events provide information regarding information-use activities performed by said user; generating contextual information, wherein said contextual information includes at least one of: user directory information of said user, past information-use activity of said user, and meta-data associated with information residing on the network; processing the information-use events in view of the generated contextual information to generate an alert for said user when the information-use activities performed by said user substantially matches one or more types of targeted behaviors, wherein processing the information-use events further comprises: processing the generated alert using a Bayesian network system to determine a threat score of said user.