Patent Description:
It is the object of the present invention to provide enhanced personalized thread detection and mitigation.

Implementations described herein disclose a system for providing personalized threat protection for users of computer applications. An implementation of a method disclosed herein includes analyzing usage patterns of an application by a client to determine various application functionalities used by the client, identifying security threats related to the various application functionalities used by the client, and changing the configuration settings of the application for the client based on the plurality of security threats.

A further understanding of the nature and advantages of the present technology may be realized by reference to the figures, which are described in the remaining portion of the specification.

Modern computer applications include many features and functionalities (referred hereinafter collectively as the "functionalities"). For example, a productivity application, such as a word processor include many functionalities such as spell check, printer setup, addition of figure, tables, etc. Some of these functionalities may be core functionalities for the productivity of the application whereas some other functionalities may be less often used by users. Furthermore, usage patterns of the functionalities of the applications also depend on the user, company or organization (referred to hereinafter as the "client") that the user works for, etc..

Security threats to computer applications often utilize various functionalities of the computer application to attack such applications and/or the computing device using such applications. For example, if a given functionality of an application has access to a resource outside on the computing device, such as certain memory locations, security threats may utilize such access to the resource to attack the computing device of the user or a network of the client.

The technology described herein disclose a system for providing personalized threat protection for users of computer applications. An implementation of the personalized threat protection system disclosed herein includes analyzing usage pattern of a computer application by various users at a client to determine various application functionalities used by the client and its users. In one implementation, usage history of application functionalities is generated, analyzed, and stored over time. Such usage history of the application functionalities may also include information about productivity information of such functionalities, whether such functionalities are core functionalities or non-core functionality, etc..

Once such application functionalities are analyzed, the personalized threat protection system identifies various security threats related to the application functionalities. For example, if a particular functionality has high security threat exposure, the threat protection system may disable that particular functionality and/or change the configuration settings of the application for the client or users based on the security threats. The threat protection system may determine the action to be taken in response to the threat exposure based on the historical data about the usage pattern, the productivity level of the functionality, the amount and type of potential damage or impairment resulting from the potential threat, whether the functionality is a core functionality or not, availability of alternative responses to the security threat, or such other appropriate criteria.

<FIG> illustrates an example implementation <NUM> including a threat protection system <NUM> for providing personalized threat protection to users of one or more computer applications. Specifically, the threat protection system <NUM> may provide threat protection to one or more users of various clients such as companies, organizations, etc., from threats to software applications. In the illustrated implementation, the threat protection system <NUM> is implemented in a cloud environment where various components of the threat protection system <NUM> may be implemented on one server or in a distributed manner on several servers. The threat protection system <NUM> is communicatively connected to various clients, such as client A <NUM>, client B <NUM>, client C <NUM> via a network <NUM>. In one implementation, the network <NUM> may be the Internet. In alternative implementation, one or more of the clients <NUM>-<NUM> may also be connected to the threat protection system <NUM> directly via a private network such as a virtual private network (VPN). For example, client B <NUM> may be connected to the threat protection system <NUM> directly via a VPN, whereas a client C <NUM> may be connected to the threat protection system <NUM> via the network <NUM>.

The clients <NUM>, <NUM>, <NUM> may use many computer applications including various software applications that may be susceptible to threats. Such threats may be, for example in the form of, viruses, worms, spyware, backdoor, botnet, phishing, cookies, etc. For example, applications may be used as back door to install cookies that may be threat to privacy of the computing device and/or the network. The implementation <NUM> shows sources of such threats such as a threat source A <NUM> and threat source B <NUM>. As shown in implementation <NUM>, these threat sources <NUM>, <NUM> may attack various applications used by the users of the clients <NUM>, <NUM>, <NUM>. In the illustrated implementation <NUM>, client A is illustrated to have users 120a, 120b, 120c that use one or more of the software applications that are available to users of client A <NUM>.

In one implementation, the software applications used by the users 120a, 120b, 120c of client A <NUM> may be hosted on an application server <NUM>. Alternatively, the software applications may be hosted onsite at client A <NUM>, or distributed over many application servers. For example, the application server <NUM> hosts applications <NUM> including different applications <NUM>, <NUM> and <NUM>. As an example, these may be a word processing application, a presentation application, and an email application. Each of these applications <NUM> may include many functionalities. For example, as shown in implementation <NUM>, application <NUM> may have application functionalities <NUM>, including functionalities 130a, 130b, 130c, 130d.

The threat source B <NUM> may use the functionality 130c of the application <NUM> to attack the user 120a or the client <NUM>. In the illustrated implementation, the threat protection system <NUM> monitors usage patterns of the application functionalities <NUM> over time to collect various usage pattern data. Such usage pattern data may include, for example, the frequency of use of various application functionalities <NUM>, the number of users that use various application functionalities <NUM>, a level of trust associated with one or more of the various application functionalities <NUM>, the productivity factor of various application functionalities <NUM>, the designation of the various functionalities <NUM> as being core functionality vs non-core functionality, and other characteristics of these functionalities <NUM>.

The threat protection system <NUM> may also tabulate historical data of how often one of these functionalities <NUM> is used to attack either the application <NUM> or the client A <NUM>. For example, the threat protection system <NUM> may maintain for each functionality <NUM>, a list of threats from various threat sources <NUM>, <NUM>. Furthermore, the threat protection system <NUM> also identifies security threats related to the various application functionalities <NUM> used by the client A <NUM>, and determines the configuration settings of the application <NUM> based on the security threats. For example, the threat protection system <NUM> may determine that the functionality 130c is not often used by any user of the client A <NUM> and it is often used by the threat source B <NUM> to damage the network of the client A <NUM>. In this case, the threat protection system <NUM> may determine that the configuration setting for the application <NUM> should be set to turn-off the functionality 130c.

In one implementation, the threat protection system <NUM> may turn-off the functionality <NUM> and then notify an administrator for the client A <NUM>. In an alternative implementation, the threat protection system <NUM> may recommend the administrator of the client A <NUM> to turn off the functionality 130c for all its users <NUM>. Yet alternatively, the threat protection system <NUM> may monitor various ongoing threats and turn off one or more of the functionalities <NUM> based on the current level of such ongoing threats. In this case, once the threat protection system <NUM> determines that when threat level for a threat that is more likely to use the functionality130a is above a threshold, the threat protections system <NUM> may turn-off the functionality 130a. Subsequently, once a patch is available to mitigate such a threat or when the threat level is reduced to below the threshold, the threat protection system <NUM> may activate the functionality 130a. Alternatively, even if the threat level for a threat that is likely to use functionality 130a is above a threshold, if functionality 130a is a core functionality that is used very often and when turning it off will adversely affect the productivity of the application <NUM>, the threat protection system may merely notify the user 120a or the administrator of the client a <NUM> and change one or more configuration settings of the application <NUM> so as to mitigate the risk from such a threat.

While in the implementation <NUM>, the threat protection system <NUM> is cloud based, in an alternative implementation, the threat protection system <NUM> may be located on an internal network of various clients, such as client A <NUM>. Yet alternatively, individual users that are not part of any client network may also be able to use the threat protection service of the threat protection system <NUM>. For example, a user with an application on her personal computing device may be able to sign up for the threat protection service of the threat protection system <NUM>. Alternatively, application server <NUM> may register the application <NUM> for the threat protection service of the threat protection system <NUM>.

<FIG> illustrates an example implementation <NUM> of a threat protection system <NUM>. The threat protection system <NUM> may be implemented on a single server or on in cloud environment with various components being distributed among various servers. The threat protection system <NUM> includes a telemetry module <NUM> that may interact with various applications on clients' networks, various application servers, etc., to remotely collect usage patterns of various applications and application functionalities. The telemetry module <NUM> may store the usage patterns of various application functionalities in a usage pattern database <NUM>.

A usage pattern analysis module <NUM> may analyze the usage patterns on a periodic basis to determine various characteristics of the application functionality usage for a client, for a user, or at a global level. For example, the usage pattern analysis module <NUM> may determine that a given functionality of an application is almost never used by a user. In that case, the usage pattern analysis module <NUM> may assign a low usage score to that functionality. Similarly, the usage pattern analysis module <NUM> may also determine that another functionality of an application is a core functionality for a user or a client, either based on frequency of use or based on some other usage characteristic. In this case, the usage pattern analysis module <NUM> may give a high usage score to this functionality for the given user or client.

The threat protection system <NUM> may also include a threat database <NUM>. The threat database <NUM> may store various characteristics of various threats. For example, the threat database <NUM> may store the severity of disruption caused by each threat, the frequency with which the threat is activated, applications and/or application functionalities used by the threat to attach a computing device or a network, etc. The threat database <NUM> may collect such data over time based on threats to its member clients and users or gather such data from external sources. A threat analysis module <NUM> analyzes the data from the threat database <NUM> over time to determine various characteristics of various threats, especially as they relate to the applications and application functionalities.

A threat and usage pattern linkage module <NUM> analyzes the usage database <NUM> and the threat database <NUM> to link various threats and various usage patterns. A threat mitigation and recommendation module <NUM> analyzes the results of the threat & usage pattern linkage module <NUM> to generate one or more threat mitigation schemes and to generate and communicate recommendations to users. For example, based on the usage score of an application functionality, the linkage of that functionality to various threats, and the threat score, the threat mitigation and recommendation module <NUM> may recommend configuration settings for an application which proscribes enablement, disablement, opt-in, opt-out, etc., configuration settings for various application functionalities.

The threat protection system <NUM> also includes an active threat mitigation module <NUM> that monitors active or on-going threats and generates recommendation for modification to application configurations. For example, the active threat mitigation module <NUM> may identify an ongoing threat and analyze various application and application functionalities that may be vulnerable to such active/ongoing threat. Based on such identification, the active threat mitigation module <NUM> may modify various configuration settings for the application or generate and send recommendation for such changes to user or client administrators.

<FIG> illustrates example operations <NUM> for providing personalized threat protection to users of one or more software applications. An operation <NUM> collects usage patterns for an application used by a client and its users. For example, the operation <NUM> may collect frequency of use, criticality of use, core/non-core characteristics of a functionality, over time for each user of a client organization. An operation <NUM> collects threat patterns to the application by functionality. For example, the operation <NUM> may determine that over time, a functionality of a word processor application that allows users to insert graphics is used various times to attack the word processor application, the user computing device, and the client network. Note that such threat pattern data is not merely collected from the users of the client organization, but they may also be collected globally from other clients and users that use the application.

After collecting the functionality usage pattern and the threat pattern by functionality, an operation <NUM> analyzes the collected and stored data pattern data. For example, the analyzing operation <NUM> may query such data, combine global threat data with the client specific threat data, etc. In one implementation, the analyzing operation <NUM> may rank the threat level to an application functionality by a given threat over a scale, such as between zero and one-hundred percentages. Alternatively, the analyzing operation <NUM> may also rank the application functionalities by their frequency of usage, criticality, etc..

A determining operation <NUM> determines whether the likelihood of a threat for a functionality is above a threshold. In one implementation, a cloud level threat protection system performing the operations <NUM> may determine the threshold level. Alternatively, an administrator of a client organization may be able to determine the threshold level. If the determining operation <NUM> determines that the likelihood of a threat for a functionality is above a threshold, an operation <NUM> disables the functionality and/or modifies the configuration settings of the application to reduce the threat of attack. For example, in the example of a word processor application where the threat level for an attack using a graphic insert functionality is above a threshold, the operation <NUM> may either disable the graphic insert functionality or limit the graphic insert to only trusted objects internal to the client organization network. Alternatively, the operation <NUM> may add additional warning to users before inserting any graphic object to a word processing document. An operation <NUM> also notifies the user and/or the administrator of a client organization of the modification to the application configuration and/or disablement of the application functionality.

If the determining operation <NUM> determines that the threat level is below the threshold, an operation <NUM> continues monitoring the usage patterns and the threat patterns.

An operation <NUM> may further compare the threat level to the threshold on a periodic basis and if it determines that the threat level has reduced below the threshold or if the client has requested activation of the functionality, an operation <NUM> may reactivate the functionality.

<FIG> illustrates example operations <NUM> for determining configuration setting for personalized threat protection for users of one or more software applications. An operation <NUM> determines various functionalities of an application. For example, the operation <NUM> may tabulate the application functionalities in a database, a flat table, etc. The usage patterns of these functionalities by a client analyzed by an operation <NUM>. For example, the operation <NUM> may analyze how often a given functionality is used by various users of a client organization.

An operation <NUM> also analyzes usage patterns of the functionalities at a global level. This may be useful when a client organization has initiated use of an application or its functionalities recently and therefore a mass of usage pattern data is not available. In one implementation, the operation <NUM> analyzes the global usage patterns for specific industry verticals to determine the usage patterns per industry. For example, the operation <NUM> may analyze the global usage patterns for clients and users in the healthcare industry to determine that a certain imaging functionality of an application is more useful in the healthcare industry. In one implementation, the weight allocated to the global usage patterns may be reduced over time as more personalized usage pattern data is collected. The operation <NUM> may also generate a combined usage pattern dataset based on the personalized client specific usage patterns and global usage patterns for the application functionalities.

In various implementations, the recommended configuration setting for various applications may be determined based on usage patterns of the application functionalities at various aggregation levels. For example, the recommended configuration setting may be based on usage pattern at global level including usage patterns of substantially all users of the application globally. Alternatively, the recommended configuration setting may be based on usage pattern at industry level including usage patterns of substantially all users of the application in a given industry, such as healthcare, education, etc. In another implementation, the recommended configuration setting may be based on usage pattern at enterprise or organization level including usage patterns of substantially all users of the application in an enterprise or organization. Similarly, the recommended configuration setting may be based on usage pattern at local level including usage patterns of the user. Furthermore, a combination of the such usage patterns at various levels may also be used to determine the recommended configuration setting for various applications.

An operation <NUM> identifies various security threats to the application functionalities. Such identification may be made based on external sources of threat information available to the threat protection system. Alternatively, such identification of threats by application functionality may be based on past attacks on the client organization and the use of the application functionalities for initiating such past attacks.

An operation <NUM> determines configuration setting modifications for the application based on the usage patterns for the application functionalities and the security threats to such application functionalities. For example, if the operation <NUM> determines that there is high threat level to an email functionality that allows the users to attach previous emails from other sources the operation <NUM> may determine that only other emails from the same email application are to be allowed to be attached by changing the configuration settings of the email application. An operation <NUM> communicates with an administrator of a client organization to recommend the modifications to the application. The recommended modifications to the configuration settings of the application are stored at an operation <NUM> for future analysis and usage.

<FIG> illustrates example operations <NUM> for modifying configuration setting for personalized threat protection for users of one or more software applications. An operation <NUM> analyzes recommended configuration settings for an application for a given computing device. For example, if a user at a client organization is using a given computer application on a laptop and a tablet device, the operation <NUM> may analyze the application configuration settings for the laptop.

An operation <NUM> determines if the user is also using the same computer application on other devices, such as tablets, smartphones, etc. If so, an operation <NUM> determines if the threat protection system has approval to change the configuration settings on such other devices used by the user. Such approval may be granted, for example, by an administrator of a client organization or by the user. If it is determined that such approval is available, an operation <NUM> modifies the configuration settings for the application on other devices. If no approval is available, an operation <NUM> merely recommends such modification to the user or to an administrator. An operation <NUM> continues monitoring of the threat level to various application functionalities to determine if any updates to modification of configuration settings need to be recommended to user or administrator.

<FIG> illustrates example operations <NUM> for addressing an ongoing security incident based on security configuration settings of users. An operation <NUM> receives a notification of an ongoing threat or security incident. For example, such notification may be received from an external source such as a listserv, a blog, a computer threat monitoring service, etc. Alternatively, an administrator of a client organization may notify of an attack on one or more of its user devices.

An operation <NUM> determines if any configuration setting modification recommendations are available. Such recommendations may be stored by a threat protection system based on past analysis of application configurations. If such configuration settings recommendations are available, an operation <NUM> may modify the configuration settings and an operation <NUM> may notify the client of the modified configurations. If no such configuration settings recommendations are available, an operation <NUM> may simply notify the user and/or the client administrator of the ongoing threat so that they can take adequate precautions.

An operation <NUM> determines if a fix for the ongoing security incident is available and if so, an operation <NUM> recommends the fix for the security incident to the users. Furthermore, if the application configuration settings were modified, the operation <NUM> may also notify the users and administrators to make appropriate modification to reset the application configurations.

<FIG> illustrates operations <NUM> for managing configuration setting overrides and exceptions for various application functionalities. An operation <NUM> receives recommended configuration setting modifications for various application to reduce the security threat. For example, an administrator of a client organization may receive the recommended configuration setting modifications. An operation <NUM> determines if there is any request for an override of or an exemption from the changes to the configuration settings. For example, a request for exemption from any changes to application configuration settings may be sent by a user to the administrator. Similarly, a user may request an override of changes to the application configuration settings.

If no such request exists, an operation <NUM> revises the configuration settings for the application based on the recommended configuration setting modifications and notifies the user of the changes. However, if any such request exists, an operation <NUM> determines if the request is approved. For example, only an administrator of a client organization may have the right to approve such request. If the request is approved, as per an operation <NUM>, no changes are made to the application configurations. However, if the request is denied, the operation <NUM> revises the configuration settings and notifies the user of the changes.

<FIG> illustrates an example system <NUM> that may be useful in implementing the described technology for providing personalized threat protection. The example hardware and operating environment of <FIG> for implementing the described technology includes a computing device, such as a general-purpose computing device in the form of a computer <NUM>, a mobile telephone, a personal data assistant (PDA), a tablet, smart watch, gaming remote, or other type of computing device. In the implementation of <FIG>, for example, the computer <NUM> includes a processing unit <NUM>, a system memory <NUM>, and a system bus <NUM> that operatively couples various system components including the system memory to the processing unit <NUM>. There may be only one or there may be more than one processing unit <NUM>, such that the processor of computer <NUM> comprises a single central-processing unit (CPU), or a plurality of processing units, commonly referred to as a parallel processing environment. The computer <NUM> may be a conventional computer, a distributed computer, or any other type of computer; the implementations are not so limited.

The system bus <NUM> may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, a switched fabric, point-to-point connections, and a local bus using any of a variety of bus architectures. The system memory may also be referred to as simply the memory, and includes read only memory (ROM) <NUM> and random access memory (RAM) <NUM>. A basic input/output system (BIOS) <NUM>, containing the basic routines that help to transfer information between elements within the computer <NUM>, such as during start-up, is stored in ROM <NUM>. The computer <NUM> further includes a hard disk drive <NUM> for reading from and writing to a hard disk, not shown, a magnetic disk drive <NUM> for reading from or writing to a removable magnetic disk <NUM>, and an optical disk drive <NUM> for reading from or writing to a removable optical disk <NUM> such as a CD ROM, DVD, or other optical media.

The hard disk drive <NUM>, magnetic disk drive <NUM>, and optical disk drive <NUM> are connected to the system bus <NUM> by a hard disk drive interface <NUM>, a magnetic disk drive interface <NUM>, and an optical disk drive interface <NUM>, respectively. The drives and their associated tangible computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules and other data for the computer <NUM>. It should be appreciated by those skilled in the art that any type of tangible computer-readable media may be used in the example operating environment.

A number of program modules may be stored on the hard disk drive <NUM>, magnetic disk <NUM>, optical disk <NUM>, ROM <NUM>, or RAM <NUM>, including an operating system <NUM>, one or more application programs <NUM>, other program modules <NUM>, and program data <NUM>. A user may generate reminders on the personal computer <NUM> through input devices such as a keyboard <NUM> and pointing device <NUM>. Other input devices (not shown) may include a microphone (e.g., for voice input), a camera (e.g., for a natural user interface (NUI)), a joystick, a game pad, a satellite dish, a scanner, or the like. These and other input devices are often connected to the processing unit <NUM> through a serial port interface <NUM> that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port, or a universal serial bus (USB). A monitor <NUM> or other type of display device is also connected to the system bus <NUM> via an interface, such as a video adapter <NUM>. In addition to the monitor, computers typically include other peripheral output devices (not shown), such as speakers and printers.

The computer <NUM> may operate in a networked environment using logical connections to one or more remote computers, such as remote computer <NUM>. These logical connections are achieved by a communication device coupled to or a part of the computer <NUM>; the implementations are not limited to a particular type of communications device. The remote computer <NUM> may be another computer, a server, a router, a network PC, a client, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer <NUM>. The logical connections depicted in <FIG> include a local-area network (LAN) <NUM> and a wide-area network (WAN) <NUM>. Such networking environments are commonplace in office networks, enterprise-wide computer networks, intranets and the Internet, which are all types of networks.

When used in a LAN-networking environment, the computer <NUM> is connected to the local network <NUM> through a network interface or adapter <NUM>, which is one type of communications device. When used in a WAN-networking environment, the computer <NUM> typically includes a modem <NUM>, a network adapter, a type of communications device, or any other type of communications device for establishing communications over the wide area network <NUM>. The modem <NUM>, which may be internal or external, is connected to the system bus <NUM> via the serial port interface <NUM>. In a networked environment, program engines depicted relative to the personal computer <NUM>, or portions thereof, may be stored in the remote memory storage device. It is appreciated that the network connections shown are examples and other means of communications devices for establishing a communications link between the computers may be used.

In an example implementation, software or firmware instructions for providing personalized threat protection may be stored in memory <NUM> and/or storage devices <NUM> or <NUM> and processed by the processing unit <NUM>. Rules for providing personalized threat protection may be stored in memory <NUM> and/or storage devices <NUM> or <NUM> as persistent datastores. For example, a threat protection module <NUM> may be implemented on the personal computer <NUM> (alternatively, the threat protection module <NUM> may be implemented on a server or in a cloud environment). The threat protection module <NUM> may utilize one of more of the processing unit <NUM>, the memory <NUM>, the system bus <NUM>, and other components of the personal computer <NUM>.

In contrast to tangible computer-readable storage media, intangible computer-readable communication signals may embody computer readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. By way of example, and not limitation, intangible communication signals include wired media such as a wired network or direct- wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.

Some embodiments may comprise an article of manufacture. An article of manufacture may comprise a tangible storage medium to store logic. Examples of a storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of the logic may include various software elements, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. In one embodiment, for example, an article of manufacture may store executable computer program instructions that, when executed by a computer, cause the computer to perform methods and/or operations in accordance with the described embodiments. The executable computer program instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. The executable computer program instructions may be implemented according to a predefined computer language, manner or syntax, for instructing a computer to perform a certain function. The instructions may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and/or interpreted programming language.

The system for providing personalized threat protection may include a variety of tangible computer-readable storage media and intangible computer-readable communication signals. Tangible computer-readable storage can be embodied by any available media that can be accessed by the threat protection system <NUM> (as disclosed in <FIG>) and includes both volatile and nonvolatile storage media, removable and non-removable storage media. Tangible computer-readable storage media excludes intangible and transitory communications signals and includes volatile and nonvolatile, removable and non-removable storage media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Tangible computer-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information and which can be accessed by the threat protection system <NUM> (as disclosed in <FIG>). In contrast to tangible computer-readable storage media, intangible computer-readable communication signals may embody computer readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. By way of example, and not limitation, intangible communication signals include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.

The personalized threat protection system disclosed herein provides solution to a technological problem necessitated by security threats to software applications. Specifically, the personalized threat protection system disclosed herein provides an unconventional technical solution to this technological problem by analyzing usage pattern of the software application by a client to determine a plurality of software application functionalities used by the client, identifying a plurality of security threats related to one or more of the plurality of software application functionalities used by the client, and change the configuration settings of the software application for the client based on the plurality of security threats.

An implementations of a method of providing a personalized threat protection for a software application includes a analyzing usage pattern of the software application by a client to determine a plurality of software application functionalities used by the client, identifying a plurality of security threats related to one or more of the plurality of software application functionalities used by the client, and determining recommended configuration settings modifications for the software application based on the usage pattern of the software application and the plurality of security threats. In one implementation, the method further includes modifying the configuration settings of the software application for the client based on the recommended configuration settings modifications.

In another implementation, the client has a plurality of users. In yet another implementation, analyzing usage patterns of the software application further comprises analyzing frequency of the usage patterns of one or more of the plurality of software application functionalities by the plurality of users. Altnernatively, the method further includes receiving a notification of an ongoing threat to the software application and automatically modifying the configuration settings of the software application using the recommended configuration settings modifications. In an alternative implementation, the method further includes determining if the application is used by a client user on a plurality of devices and in response to determining that the application is used by a client user on a plurality of devices, propagating the recommended configuration settings modifications for the software application to one or more of the other devices used by the client user. Alternatively, determining recommended configuration settings modifications for the software application further comprises determining recommended configuration settings modifications for the software application based on the software application functionality being a core functionality.

Implementations of threat protection system disclosed herein includes a memory, one or more processor units, and a a threat protection system stored in the memory and executable by the one or more processor units, the threat protection system including a usage pattern analysis module configured to analyze usage patterns of one or more functionalities of an application, a threat analysis module configured to analyze threat patterns to the one or more functionalities of the application, and a threat mitigation and recommendation module configured to determine recommended configuration settings modifications for the application based on the usage patterns of the one or more functionalities of an application and the threat patterns to the one or more functionalities of the application.

In an alternative implementation, the threat protection system further includes a telemetry module to remotely collect the usage patterns of the one or more functionalities of an application by a plurality of client users. Alternatively, the threat protection system further includes an active threat mitigation module configured to determine an ongoing threat to one or more functionalities of an application and to automatically modify the configuration settings of the application using the recommended configuration settings modifications. In another implementation, the threat protection system further including a threat and usage pattern linkage module configured to link threats by one or more of the application functionalities with usage pattern of the one or more of the application functionalitie.

A physical article of manufacture disclosed herein includes one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system a computer process to provide personalized threat protection for an application, the computer process including analyzing usage pattern of the application by a client to determine a plurality of application functionalities used by the client, identifying a plurality of security threats related to one or more of the plurality of application functionalities used by the client, and modifying the configuration settings of the application for the client based on the plurality of security threats. In one implementation, analyzing usage patterns of the application further comprises analyzing frequency of the usage patterns of one or more of the plurality of application functionalities.

In an alternative implementation, analyzing usage patterns of the application further comprises analyzing criticality of one or more of the plurality of application functionalities. Yet alternatively, the computer process further comprises receiving a notification of an ongoing threat to the application, determining if recommended modifications to the configuration settings of the application are available, and automatically modifying the configuration settings of the application using the recommended modifications to the configuration settings. In yet another implementation, the computer process further comprises identifying a plurality of security threats related to one or more of the plurality of application functionalities used by the global users and determining recommended modifications to the configuration settings of the application based on usage pattern of one or more of the plurality of application functionalities by the global users and usage pattern of one or more of the plurality of application functionalities by the client.

In one implementation, determining recommended modifications to the configuration settings of the application further comprises determining recommended modifications to the configuration settings of the application based on usage pattern of one or more of the plurality of application functionalities used by global users within an industry vertical of the client and usage pattern of one or more of the plurality of application functionalities used by the client. In an alternative implementation, the computer process further comprises determining if the application is used by a client user on a plurality of devices and in response to determining that the application is used by a client user on a plurality of devices, propagating the configuration settings of the application to one or more of the other devices used by the client user. Alternatively, the computer process further comprises determining a characteristic of one of the plurality of application functionalities used by the client identifying the one of the plurality of application functionalities as a core functionality and determining recommended configuration settings of the application based on the characteristic.

Claim 1:
A physical article of manufacture including one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system (<NUM>) a computer process to provide personalized threat protection to users of a computer application (<NUM>, <NUM>, <NUM>), the computer process comprising:
determining (<NUM>) a plurality of functionalities of the computer application;
analyzing (<NUM>) usage patterns of the plurality of functionalities (<NUM>) of the computer application by users at a client organization (<NUM>, <NUM>, <NUM>) including analyzing how often a given functionality of the application is used by users of the client organization;
identifying (<NUM>) a plurality of security threats to one or more of the plurality of computer application functionalities used by the client organization; and
modifying the configuration settings of the computer application for the client organization based on the usage patterns of the plurality of functionalities and the plurality of security threats to the plurality of functionalities.