Patent Description:
To guard against security threats, various security controls can be deployed to monitor operations and operational parameters in computer systems and generate notifications or alerts based on security rules. For example, when a user requests access to data that the user is not granted access to, an access control can generate an alert indicating an unauthorized access request. In another example, a firewall may detect a large number of incoming network requests that exceeds a set threshold. In response, the firewall can generate another alert indicating, for instance, a potential distributed denial of service attack to a local area network protected by the firewall.

Typically, a team of security analysts can review various alerts generated by security controls and determine whether an alert is a false positive, or remedial actions may be needed in response to the alert. However, in large-scale computer systems, numbers of alerts generated by security controls over a short period can be voluminous. Reviewing such large numbers of alerts for false positives or remedial actions can be labor intensive, costly, and prone to "alert fatigue. " Thus, the alerts are normally sorted, ranked, or classified according to some criteria for urgency of review by security analysts. In one example, an importance score may be calculated for each alert based on how much the detected operation deviates from a baseline value. For instance, if a number of detected network requests by the firewall only exceeds the preset threshold by a small amount, the importance score for the generated alert may be low. In another example, an importance score may also be calculated based on a number of similar alerts previously generated for a user. For instance, if the access control has detected that the user has repeatedly attempted unauthorized access to data, the importance score for the unauthorized access alert may be high.

The foregoing importance scoring may help to classify large numbers of alerts based on deviation from baseline values of operational parameters in computer systems. However, importance scoring does not consider impact potential that a compromised user may cause a computer system and/or an organization associated with the computer system. For instance, in the unauthorized access example above, if a large number of alerts were generated corresponding to a first user, the first user may have a higher importance score than a second user corresponding to a single generated alert. However, the second user may have a higher data access privilege, higher organizational position, or authorization to access high value assets than the first user. As such, if the second user were compromised, damage caused by the second user to the computer system or the organization can be much higher than the first user.

Several embodiments of the disclosed technology can address certain aspects of the foregoing drawbacks by implementing an alert management system that is configured to derive impact scores corresponding to individual alerts associated with the users based on user profiles. The impact scores represent levels of potential damage the users can cause the computer system and/or the organization in relation to other users in the organization. Various types of user data may be used to derive an impact score. For example, an impact score can be generated based on one or more of the following:.

In other examples, an impact score can also be derived based on a number of other users reporting to the user, a security clearance of the user, and/or other suitable types of user data, manually tagged as sensitive by the security analyst.

In certain implementations, machine learning may be applied to perform an unsupervised statistical analysis of the user data of the users. In one example, values of the user data may be pre-processed to have corresponding numerical values prior to performing the statistical analysis. For instance, a position of "software engineer" can be assigned a position value of ten while a position of "chief executive officer" is assigned a position value of one hundred. A first network privilege can be assigned a privilege value of one while a second network privilege higher than the first network privilege can be assigned a privilege value often, fifty, or one hundred. As such, various types of user data can be converted into corresponding sets of numerical values for statistical analysis. In certain implementations, a security analyst can assign the various numerical values to the user data. In other implementations, the assigned numerical values may be from machine learning or other suitable sources.

For a certain type of the user data, the alert management system can be configured to perform a statistical analysis to determine a statistical distribution of such user data. For instance, position values of multiple users in an organization can be summed and averaged to derive a position mean in the organization. In other examples, position values can also be used to derive a medium, a standard deviation, or other suitable statistical parameters.

Subsequently, the alert management system can be configured to calculate or assign an impact score for each of the users based on a deviation of the corresponding value of the user data to the derived mean (or other suitable statistical parameters) in the organization. In certain implementations, the deviation can be a linear difference. For example, if the position mean in the organization is eleven and a first user has a position value often (e.g., corresponding to a "software engineer"), the first user can be assigned an importance score of one. If a second user has a position value of one hundred (e.g., corresponding to a "chief executive officer"), the second user can be assigned an importance score of eighty-nine. In other implementations, the deviation can be a non-linear difference between values of the user data and the derived mean. Example non-linear functions suitable for calculating the impact scores include logarithmic, exponential, and other suitable non-linear functions.

The various calculated or assigned impact scores for the individual types of the user data can then be summed to derive an overall impact score for a user. In certain embodiments, the impact score and/or the overall impact score can be normalized, for instance, based on a scale of zero to one hundred. In other embodiments, the impact scores from corresponding types of user data may be weighted differently in the overall impact score, for instance, by assigning different weight factors to each type of the user data. In yet further embodiments, a security analyst or other suitable entities can manually modify the derived impact scores and/or overall impact scores of the users based on security system knowledge or other suitable information.

During operation, upon detecting an incoming alert, the alert management system can be configured to determine a user associated with the incoming alert. For example, the alert management system may determine that the incoming alert is alert associated with a user in the organization for unauthorized access. The alert management system can then be configured to calculate or otherwise determine an impact score associated with the user. In certain embodiments, determination of the impact score can include retrieving an impact record containing the impact score previously calculated for the user. For example, the alert management system can be configured to calculate and recalculate impact scores of users daily, weekly, monthly, or based on other suitable time intervals using current values of the user data. In another embodiment, the alert management system can be configured to calculate the impact score of the user on an ad hoc basis, i.e., in response to receiving the incoming alert. In further embodiments, the alert management system can be configured to determine the impact score in other suitable manners.

In certain embodiments, the alert management system can be configured to rank the incoming alert in relation to other alerts based on the impact scores or bias the importance scores using the impact score. For example, alerts with higher impact scores can be ranked higher than other alerts with lower impact scores. In another example, importance scores can be modified, e.g., using the impact scores as multipliers, additions, or in other suitable manners. As such, alerts associated with high impact scores can also have high modified importance scores.

In other embodiments, the alert management system can also be configured to automatically perform one or more security operations based on the impact scores. For example, when a determined impact score exceeds a preset impact threshold, the alert management system can be configured to perform one or more of the following:.

In other examples, the alert management system can also be configured to place a lock on data items, block incoming/outgoing network traffic, or perform other suitable computing operations.

Several embodiments of the disclosed technology can thus efficiently address alerts from various security controls based on impact potential to the computer system and/or the organization by a corresponding user. By determining impact scores based on user data for incoming alerts, the alert management system can prioritize and surface alerts with high impact potentials to security analysts, thereby allowing the security analysts to efficiently process the incoming alerts. The alert management system can also be configured to perform automated security actions in response to incoming alerts. As such, potential impact to the computer system and/or the organization caused by a compromised user associated with the incoming alert can be reduced, thereby improving computer security in computer systems.

Certain embodiments of systems, devices, components, modules, routines, and processes for impact potential based security alert management are described below. In the following description, specific details of components are included to provide a thorough understanding of certain embodiments of the disclosed technology. A person skilled in the relevant art can also understand that the disclosed technology may have additional embodiments or may be practiced without several of the details of the embodiments described below with reference to <FIG>.

As used herein, the term "computing cluster" generally refers to a computing system having a plurality of network devices that interconnect multiple servers or nodes to one another or to external networks (e.g., the Internet). One example of a computing cluster is one or more racks each holding multiple servers in a cloud computing datacenter (or portions thereof) configured to provide cloud services. One or more computing clusters can be interconnected to form a "computing fabric," which forms at least a part of a distributed computing system. The term "network device" generally refers to a network communications component. Example network devices include routers, switches, hubs, bridges, load balancers, security gateways, or firewalls. A "node" generally refers to a computing device configured to implement one or more virtual machines, virtual routers, virtual gateways, or other suitable virtualized computing components. In one example, a node can include a computing server having a hypervisor configured to support one or more virtual machines.

Further used herein, the term "computing service" generally refers to one or more computing resources provided over a computer network, such as the Internet. Common examples of computing services include software as a service ("SaaS"), platform as a service ("PaaS"), and infrastructure as a service ("IaaS"). SaaS is a software distribution technique in which software applications are hosted by a cloud service provider in, for instance, datacenters, and accessed by users over a computer network. PaaS generally refers to delivery of operating systems and associated services over the computer network without requiring downloads or installation. IaaS generally refers to outsourcing equipment used to support storage, hardware, servers, network devices, or other components, all of which are made accessible over a computer network.

Also used herein, a "security control" generally refers to computer hardware and/or software components that are configured to provide confidentiality, integrity, and availability of components in computer systems. For example, a firewall can be deployed between an external network and a local area network to monitor and direct incoming and outgoing network traffic. In another example, access control can be implemented to specify which users can have access to what data as well as what operations that the users are allowed to perform on the data. Various security controls can also be configured to generate security alerts during operation when, for instance, a user violates a security rule.

As used herein, a "security alert" or "alert" generally refers to a data package containing information indicating that a security rule has been violated. For example, when a user requests access to data that the user is not granted access to, an access control can generate an alert indicating the unauthorized access request. In another example, a firewall may detect a large number of incoming network requests that exceeds a set threshold. In response, the firewall can generate another alert indicating, for instance, a potential distributed denial of service attack to a local area network protected by the firewall. Alerts can also contain information regarding identity of the user who violated the security rule, identity of the security rule, a date/time when the security rule is violated, and/or other suitable information.

As used herein, the phrase "machine learning" generally refers to a data analysis technique that computer systems use to perform a specific task without using explicit instructions and relying instead on patterns and inference. One example machine learning technique uses a "neural network" or "artificial neural network" that is configured to "learn," or progressively improve performance on tasks by studying examples, generally without task-specific programming. For example, in image recognition, a neural network may learn to identify images that contain cats by analyzing example images that have been manually labeled as "cat" or "no cat" and using the results to identify cats in new images.

In certain implementations, a neural network can include multiple layers of objects generally refers to as "neurons" or "artificial neurons. " Each neuron can be configured to perform a function such as a non-linear activation function based on one or more inputs via corresponding connections. Artificial neurons and connections typically have a weight that adjusts as learning proceeds. The weight increases or decreases a strength of an input at a connection. Typically, artificial neurons are organized in layers. Different layers may perform different kinds of transformations on respective inputs. Signals typically travel from an input layer, to an output layer, possibly after traversing one or more intermediate layers.

In addition, as used herein, an "impact score" is a value that represents a level of potential damage a user can cause a computer system and/or an organization associated with the computer system. An impact score can be derived from various types of user data included in a profile of a user. For example, an impact score can be a deviation of an assigned value to the profile of the user and a mean value of assigned values of profiles of all users in the organization. Other example processes for deriving an impact score are described below with reference to <FIG>.

To guard against security threats, various security controls can be deployed in computer systems to monitor operations and operational parameters and generate alerts based on predetermined security rules. Typically, a team of security analysts can review various alerts generated by security controls and determine whether an alert is a false positive, or remedial actions may be needed in response to the alert. However, in large-scale computer systems, numbers of alerts generated by security controls over a short period can be voluminous. Reviewing such large numbers of alerts for false positives or remedial actions can be labor intensive, costly, and prone to "alert fatigue.

In certain computer systems, alerts can be sorted, ranked, or classified according to an importance score that is calculated based on how much the detected operation deviates from a baseline value. Such importance scoring may help to classify large numbers of alerts based on deviation from baseline values of operational parameters in computer systems. However, importance scoring does not consider impact potential that a compromised user may cause a computer system and/or an organization associated with the computer system.

Several embodiments of the disclosed technology can address certain aspects of the foregoing drawbacks by implementing an alert management system that is impact scores of users corresponding to incoming alerts. Upon detecting an incoming alert, the alert management system can be configured to determine a user associated with the incoming alert. The alert management system can then be configured to calculate or otherwise determine an impact score associated with the user. The alert management system can be configured to rank the incoming alert in relation to other alerts based on the impact scores or bias the importance scores using the impact score. The alert management system can also be configured to automatically perform one or more security operations based on the impact scores. As such, potential impact to the computer system and/or the organization caused by a compromised user associated with the incoming alert can be reduced, as described in more detail below with reference to <FIG>.

<FIG> is a schematic diagram illustrating a computer system <NUM> having an alert management system implementing impact potential based security alert management in accordance with embodiments of the disclosed technology. As shown in <FIG>, the computer system <NUM> can include a computer network <NUM> interconnecting users <NUM> and a security analyst <NUM> via client devices <NUM>, nodes <NUM> in a computing fabric <NUM>, and an alert management system <NUM>. Even though particular components of the computer system <NUM> are shown in <FIG>, in other embodiments, the computer system <NUM> can also include additional and/or different constituents. For example, the computer system <NUM> can include additional computing fabrics, network storage devices, utility infrastructures, and/or other suitable components.

The client devices <NUM> can each include a computing device that facilitates corresponding users <NUM> to access computing services provided by the computing fabric <NUM> via the computer network <NUM>. For example, in the illustrated embodiment, the client devices <NUM> individually include a desktop computer. In other embodiments, the client devices <NUM> can also include laptop computers, tablet computers, smartphones, or other suitable computing devices. Even though two users <NUM> and corresponding client devices <NUM> are shown in <FIG> for illustration purposes, in other embodiments, the computer system <NUM> can facilitate any suitable number of users <NUM> to access computing services provided by the computing fabric <NUM>.

As shown in <FIG>, the computer network <NUM> can include one or more network devices <NUM> that interconnect the users <NUM> and components of the computing fabric <NUM>. Examples of the network devices <NUM> can include routers, switches, firewalls, load balancers, or other suitable network components. Even though particular connection scheme is shown in <FIG> for illustration purposes, in other embodiments, the network devices <NUM> can be operatively coupled in a hierarchical, flat, "mesh," or other suitable topologies. In one embodiment, the computer network <NUM> includes the Internet. In other embodiments, the computer network <NUM> can also include a local area network, a wide area network, a virtual private network, or other suitable types of computer network.

In certain embodiments, the nodes <NUM> can individually include a processor, a physical server, or a blade containing several physical servers. In other embodiments, the nodes <NUM> can also include a virtual server or several virtual servers. The nodes <NUM> can be organized into racks, availability zones, groups, sets, computing clusters, or other suitable divisions. For example, in the illustrated embodiment, the nodes <NUM> are grouped into three computing clusters <NUM> (shown individually as first, second, and third computing clusters 105a-105c, respectively), which are operatively coupled to corresponding network devices <NUM> in the computer network <NUM>. Even though three computing clusters <NUM> are shown in <FIG> for illustration purposes, in other embodiments, the computing fabric <NUM> can include one, two, eight, sixteen, or any other suitable numbers of computing clusters <NUM> with similar or different components and/or configurations.

As shown in <FIG>, the computer system <NUM> can also deploy one or more security controls <NUM>. In certain embodiments, the security controls <NUM> can include hardware and/or software components deployed on the nodes <NUM> and/or the network device <NUM>. In one example, a security control can be deployed on a node <NUM> as a computing service (e.g., an access control service). In another example, a security control can be deployed in the computer network <NUM> as a standalone firewall. In further examples, a security control can be deployed on multiple nodes <NUM> and/or network devices <NUM> for network filtering, virus scanning, and/or other suitable operations. During operation, the various security controls <NUM> can be configured to generate alerts <NUM> when a security rule is violated. The generated alerts <NUM> can be transmitted to the alert management system <NUM> for further processing via the computer network <NUM>.

The alert management system <NUM> can be configured to implement impact potential based alert management when processing the incoming alerts <NUM>. In certain embodiments, the alert management system <NUM> can include an impact engine <NUM> (shown in Figure 2A) that is configured to determine an impact score of a user associated with an incoming alert. The determined impact score can then be used to sort, rank, or modify priority of the incoming alerts <NUM>. The impact score can also be used to trigger automatic security actions based on present impact thresholds. Using such a technique, sorted alerts <NUM>' with high impact scores may be selectively surfaced to security analyst <NUM> for efficient processing. Example components of the impact engine <NUM> are described in more detail below with reference to <FIG>.

<FIG> is a schematic diagram illustrating certain hardware/software components of an impact engine <NUM> suitable for the alert management system <NUM> in <FIG> in accordance with embodiments of the disclosed technology. In <FIG> and in other Figures herein, individual software components, objects, classes, modules, and routines may be a computer program, procedure, or process written as source code in C, C++, C#, Java, and/or other suitable programming languages. A component may include, without limitation, one or more modules, objects, classes, routines, properties, processes, threads, executables, libraries, or other components. Components may be in source or binary form. Components may include aspects of source code before compilation (e.g., classes, properties, procedures, routines), compiled binary units (e.g., libraries, executables), or artifacts instantiated and used at runtime (e.g., objects, processes, threads). In certain embodiments, the various components and modules described below can be implemented with actors. In other embodiments, generation of the application and/or related services can also be implemented using monolithic applications, multi-tiered applications, or other suitable components.

Components within a system can take different forms within the system. As one example, a system comprising a first component, a second component and a third component can, without limitation, encompass a system that has the first component being a property in source code, the second component being a binary compiled library, and the third component being a thread created at runtime. The computer program, procedure, or process may be compiled into object, intermediate, or machine code and presented for execution by one or more processors of a personal computer, a network server, a laptop computer, a smartphone, and/or other suitable computing devices. Equally, components may include hardware circuitry.

A person of ordinary skill in the art would recognize that hardware may be considered fossilized software, and software may be considered liquefied hardware. As just one example, software instructions in a component may be burned to a Programmable Logic Array circuit or may be designed as a hardware circuit with appropriate integrated circuits. Equally, hardware may be emulated by software. Various implementations of source, intermediate, and/or object code and associated data may be stored in a computer memory that includes read-only memory, random-access memory, magnetic disk storage media, optical storage media, flash memory devices, and/or other suitable computer readable storage media excluding propagated signals.

As shown in <FIG>, the impact engine <NUM> can include an interface component <NUM>, an analysis component <NUM>, and a control component <NUM> operatively coupled to one another. Though particular components are shown in <FIG>, in other embodiments, the impact engine <NUM> can also include network, calculation, and/or other suitable types of components. In further embodiments, one or more of the components shown in <FIG> may be omitted to be implemented as a separate component. For example, in certain embodiments, the analysis component <NUM> can be omitted from the impact engine <NUM> and instead be implemented as a separate application. In other examples, the control component <NUM> can be implemented as a separate component of the alert management system <NUM> or as a standalone application.

The interface component <NUM> can be configured to facilitate accessing user profile <NUM> of users <NUM> (<FIG>) in a datastore <NUM>. In certain implementations, the user profile <NUM> can include user data aggregated from an organization chart, user directory, network administration information, and/or other suitable sources. Various types of user data may be used to derive an impact score. For example, an impact score can be generated based on one or more of the following:.

In other examples, an impact score can also be derived based on a number of other users reporting to the user, a security clearance of the user, and/or other suitable types of user data.

Upon accessing the user profile <NUM>, the interface component <NUM> can be configured to provide the user profile <NUM> to the analysis component <NUM> to derive impact scores <NUM> for the users <NUM>. In one example, values of the user data in the user profile <NUM> can be pre-processed to have corresponding numerical values prior to performing statistical analysis. For instance, a position of "software engineer" can be assigned a position value of ten while a position of "chief executive officer" is assigned a position value of one hundred. A first network privilege can be assigned a privilege value of one while a second network privilege higher than the first network privilege can be assigned a privilege value of ten, fifty, or one hundred. As such, various types of user data can be converted into corresponding sets of numerical values for statistical analysis. In certain implementations, a security analyst <NUM> can assign the various numerical values to the user data by providing a user input <NUM>. In other implementations, the assigned numerical values may be from machine learning or other suitable sources.

For a certain type of the user data, the analysis component <NUM> can be configured to perform a statistical analysis to determine a statistical distribution of such user data. For instance, position values of multiple users <NUM> in an organization can be summed and averaged to derive a position mean in the organization. In other examples, position values can also be used to derive a medium, a standard deviation, or other suitable statistical parameters.

Subsequently, the analysis component <NUM> can be configured to calculate or assign an impact score <NUM> for each of the users <NUM> based on a deviation of the corresponding value of the user data to the derived mean (or other suitable statistical parameters) in the organization. In certain implementations, the deviation can be a linear difference. For example, if the position mean in the organization is eleven and a first user has a position value often (e.g., corresponding to a "software engineer"), the first user <NUM> can be assigned an importance score of one. If a second user <NUM> has a position value of one hundred (e.g., corresponding to a "chief executive officer"), the second user <NUM> can be assigned an importance score of eighty-nine. In other implementations, the deviation can be a non-linear difference between values of the user data and the derived mean. Example non-linear functions suitable for calculating the impact scores include logarithmic, exponential, and other suitable non-linear functions.

The various calculated or assigned impact scores <NUM> for the individual types of the user data can then be summed to derive an overall impact score for a user <NUM>. In certain embodiments, the impact score <NUM> and/or the overall impact score <NUM> can be normalized, for instance, based on a scale of zero to one hundred. In other embodiments, the impact scores <NUM> from corresponding types of user data may be weighted differently in the overall impact score <NUM>, for instance, by assigning different weight factors to each type of the user data. In yet further embodiments, the security analyst <NUM> or other suitable entities can manually modify the derived impact scores <NUM> and/or overall impact scores <NUM> of the users <NUM> based on security system knowledge or other suitable information. Upon determining the impact scores <NUM>, the analysis component <NUM> can be configured to instruct the interface component <NUM> to store the generated impact scores as database records in the datastore <NUM>.

In one embodiment, the analysis component <NUM> can be configured to calculate and recalculate impact scores <NUM> of users <NUM> daily, weekly, monthly, or based on other suitable time intervals using current information of the user profile <NUM>. In another embodiment, the analysis component <NUM> can be configured to calculate or recalculate the impact score <NUM> of the user <NUM> on an ad hoc basis, i.e., in response to receiving the incoming alert <NUM>. In further embodiments, the analysis component <NUM> can be configured to determine the impact score <NUM> in other suitable manners.

During operation, upon detecting an incoming alert <NUM> by the interface component <NUM>, the control component <NUM> can be configured to determine a user <NUM> associated with the incoming alert <NUM>. For example, the control component <NUM> may determine that the incoming alert <NUM> is alert associated with a user <NUM> for unauthorized access. The control component <NUM> can then be configured to determine an impact score <NUM> associated with the user <NUM>. In certain embodiments, determination of the impact score <NUM> can include instructing the interface component <NUM> to retrieve a database record containing the impact score <NUM> previously calculated for the user <NUM> by the analysis component <NUM>. In another embodiment, the control component <NUM> can be configured to instruct the analysis component <NUM> to recalculate the impact score <NUM> of the user <NUM> based on current information in the user profile <NUM>.

In certain embodiments, upon determining the impact score <NUM> for the user <NUM>, the control component <NUM> can be configured to rank the incoming alert <NUM> in relation to other alerts (not shown) based on the impact scores <NUM>. For example, alerts <NUM> with higher impact scores can be ranked higher than other alerts <NUM> with lower impact scores. In other embodiments, the control component <NUM> can also be configured to automatically perform or cause to be performed, one or more security operations based on the impact score <NUM>. For example, when the determined impact score <NUM> exceeds a preset impact threshold, the control component <NUM> can be configured to perform one or more of the following:.

In other examples, the control component <NUM> can also be configured to place a lock on data items, block incoming/outgoing network traffic, or perform other suitable computing operations.

Several embodiments of the disclosed technology can thus efficiently address alerts <NUM> from various security controls <NUM> (<FIG>) based on impact potential to the computer system <NUM> and/or the organization by a corresponding user <NUM>. By determining impact scores <NUM> based on user profile <NUM> for incoming alerts <NUM>, the alert management system <NUM> can prioritize and surface alerts <NUM> with high impact potentials to the security analyst <NUM>, thereby allowing the security analyst <NUM> to efficiently process the incoming alerts <NUM>. The alert management system <NUM> can also be configured to perform automated security actions in response to incoming alerts <NUM>. As such, potential impact to the computer system <NUM> and/or the organization caused by a compromised user <NUM> associated with the incoming alert <NUM> can be reduced, thereby improving computer security in the computer system <NUM>.

<FIG> is a schematic diagram illustrating an example scheme suitable for deriving an impact score <NUM> in <FIG> based on a user profile <NUM> in accordance with embodiments of the disclosed technology. In <FIG>, example types of user data from the user profile <NUM> are used for illustration purposes. In other embodiments, additional and/or different types of user data can also be used for deriving an impact score <NUM>.

As shown in <FIG>, example types of user data from the user profile <NUM> include position in an organization <NUM>, asset access privilege <NUM>, network access privilege <NUM>, data access privilege <NUM>, and server access privilege <NUM>. In accordance with embodiments of the disclosed technology, the analysis component <NUM> (<FIG>) can be configured to assign a numerical value to each of the types of user data in the user profile <NUM>. For instance, n the illustrated embodiment, based on the user data in the user profile <NUM>, a value of one hundred can be assigned to the position of the user <NUM>; a value of fifty can be assigned to the asset access privilege <NUM>; a value of seventy five can be assigned to each of the network access privilege <NUM>, the data access privilege <NUM>, and the server access privilege <NUM>. The analysis component <NUM> can then derive a profile value <NUM> corresponding to the user profile <NUM> by combining the various assigned numerical values for the position <NUM>, asset access privilege <NUM>, network access privilege <NUM>, data access privilege <NUM>, and server access privilege <NUM>. In the illustrated embodiment, the combined numerical values are also normalized to a scale of zero to one hundred as the profile value <NUM>. In other embodiments, the profile value <NUM> can be a total of the combined numerical values without scaling or scaled according to other suitable ranges.

Upon obtaining the profile value <NUM> for all or at least some users <NUM> in the organization, the analysis component <NUM> can be configured to perform a statistical analysis on the profile values <NUM> in the organization to derive, for instance, a mean value <NUM>. In the illustrated example, the mean value is about twenty-five. The analysis component <NUM> can then be configured to derive an impact score <NUM> for the user profile <NUM> based on a deviation of the profile value <NUM> of the user <NUM> and the mean value <NUM> in the organization. For example, as shown in <FIG>, a difference between the profile value is equal to seventy-five subtracted by twenty-five. As such, the impact score <NUM> can be set at fifty. In other examples, the impact score <NUM> can be set based on the deviation in other suitable manners.

<FIG> are flowcharts illustrating certain processes of impact potential based security alert management in accordance with embodiments of the disclosed technology. Though the processes are described below in the context of the computer system <NUM> in <FIG>, in other embodiments, the processes can be implemented in other computer systems with additional and/or different components.

As shown in <FIG>, a process <NUM> can include receiving an alert at stage <NUM>. The alert can be generated by a security control <NUM> (<FIG>), as described in more detail above with reference to <FIG>. The process <NUM> can then include determining an impact score corresponding to the incoming alert at stage <NUM>. The impact score represents a level of potential damage a user associated with the alert can cause the computer system and/or an organization associated with the computer system. Example operations of determining the impact score are described below with reference to <FIG>. The process <NUM> can then include processing the received alert based on the determined impact score at stage <NUM>. Example operations of determining the impact score are described below with reference to <FIG>.

As shown in <FIG>, example operations for determining an impact score can include assigning numerical values to types of user data in a user profile at stage <NUM>, as described above with reference to <FIG>. The operations can then include performing a statistical analysis of assigned numerical values of all users at stage <NUM>. The operations can further include setting an impact score based on a deviation between the assigned values of the user and corresponding mean values in the organization at stage <NUM>.

As shown in <FIG>, example operations of processing an incoming alert based on an impact score can include a decision stage <NUM> to determine whether the impact score exceeds a preset security threshold. In response to determining that the impact score exceeds the preset security threshold, the operations can include performing one or more security actions in the computer system at stage <NUM>. Example security actions are described above with reference to <FIG>. In response to determining that the impact score does not exceed the preset security threshold, the operations can include logging the incoming alert at stage <NUM> and/or perform other suitable operations.

As shown in <FIG>, additional example operations of processing an incoming alert based on an impact score can include ranking the incoming alert in relation to other alerts based on corresponding impact scores at stage <NUM>. The operations can then include selectively surfacing one or more alerts based on corresponding ranking values at stage <NUM>. For instance, top five, ten, twenty, fifty, or other suitable numbers of alerts from the ranked alerts may be surfaced to a security analyst.

<FIG> is a computing device <NUM> suitable for certain components of the computer system <NUM> in <FIG>. For example, the computing device <NUM> can be suitable for the client devices <NUM>, the nodes <NUM>, or the alert management system of <FIG>. In a very basic configuration <NUM>, the computing device <NUM> can include one or more processors <NUM> and a system memory <NUM>. A memory bus <NUM> can be used for communicating between processor <NUM> and system memory <NUM>.

Depending on the desired configuration, the processor <NUM> can be of any type including but not limited to a microprocessor (µP), a microcontroller (µC), a digital signal processor (DSP), or any combination thereof. The processor <NUM> can include one more level of caching, such as a level-one cache <NUM> and a level-two cache <NUM>, a processor core <NUM>, and registers <NUM>. An example processor core <NUM> can include an arithmetic logic unit (ALU), a floating-point unit (FPU), a digital signal processing core (DSP Core), or any combination thereof. An example memory controller <NUM> can also be used with processor <NUM>, or in some implementations memory controller <NUM> can be an internal part of processor <NUM>.

Depending on the desired configuration, the system memory <NUM> can be of any type including but not limited to volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. The system memory <NUM> can include an operating system <NUM>, one or more applications <NUM>, and program data <NUM>. This described basic configuration <NUM> is illustrated in Figure <NUM> by those components within the inner dashed line.

The computing device <NUM> can have additional features or functionality, and additional interfaces to facilitate communications between basic configuration <NUM> and any other devices and interfaces. For example, a bus/interface controller <NUM> can be used to facilitate communications between the basic configuration <NUM> and one or more data storage devices <NUM> via a storage interface bus <NUM>. The data storage devices <NUM> can be removable storage devices <NUM>, non-removable storage devices <NUM>, or a combination thereof. Examples of removable storage and non-removable storage devices include magnetic disk devices such as flexible disk drives and hard-disk drives (HDD), optical disk drives such as compact disk (CD) drives or digital versatile disk (DVD) drives, solid state drives (SSD), and tape drives to name a few. Example computer storage media can include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. The term "computer readable storage media" or "computer readable storage device" excludes propagated signals and communication media.

The system memory <NUM>, removable storage devices <NUM>, and non-removable storage devices <NUM> are examples of computer readable storage media. Computer readable storage media include, but not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other media which can be used to store the desired information and which can be accessed by computing device <NUM>. Any such computer readable storage media can be a part of computing device <NUM>. The term "computer readable storage medium" excludes propagated signals and communication media.

The computing device <NUM> can also include an interface bus <NUM> for facilitating communication from various interface devices (e.g., output devices <NUM>, peripheral interfaces <NUM>, and communication devices <NUM>) to the basic configuration <NUM> via bus/interface controller <NUM>. Example output devices <NUM> include a graphics processing unit <NUM> and an audio processing unit <NUM>, which can be configured to communicate to various external devices such as a display or speakers via one or more A/V ports <NUM>. Example peripheral interfaces <NUM> include a serial interface controller <NUM> or a parallel interface controller <NUM>, which can be configured to communicate with external devices such as input devices (e.g., keyboard, mouse, pen, voice input device, touch input device, etc.) or other peripheral devices (e.g., printer, scanner, etc.) via one or more I/O ports <NUM>. An example communication device <NUM> includes a network controller <NUM>, which can be arranged to facilitate communications with one or more other computing devices <NUM> over a network communication link via one or more communication ports <NUM>.

The network communication link can be one example of a communication media. Communication media can typically be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. A "modulated data signal" can be a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media can include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), microwave, infrared (IR) and other wireless media. The term computer readable media as used herein can include both storage media and communication media.

Claim 1:
A method of impact potential based alert management in a computer system (<NUM>) associated with an organization, the method comprising:
receiving, via the computer network (<NUM>), data representing an alert (<NUM>) from a security control (<NUM>) in the computer system, the alert indicating that a security rule has been violated by a user (<NUM>) of the organization; and
in response to receiving the data representing the alert,
determining an impact score associated with the user who has violated the security rule, the impact score representing a level of potential damage the user can cause the organization based on a profile of the user in relation to other users in the organization; and
upon establishing the impact score of the user,
determining whether the established impact score of the user exceeds an impact threshold; and
in response to determining that the established impact score of the user exceeds the impact threshold, executing, in the computer system, an automatic security action to limit access of the user to one or more hardware or software components of the computer system,
wherein the profile of the user (<NUM>) includes user data representing an organization position of the user in the organization or user data representing an access privilege to assets in the organization; and
wherein determining the impact score associated with the user includes:
assigning a numerical value to the organization position of the user and additional numerical values to organization positions of other users in the organization, or assigning a numerical value to the access privilege to assets of the user and additional numerical values to access privileges to assets of other users in the organization;
calculating a mean value of the assigned numerical value and the assigned additional numerical values; and
setting the impact score based on a deviation between the assigned numerical value and the mean value.