Patent ID: 12255885

DETAILED DESCRIPTION

A DLP with User to Group Behavior Signature Monitor (UGBSM) implements a DLP that monitors behavior of an individual user (the Monitored User). The UGMSM also monitors behavior of a group of one or more users. These groups comprise Baseline Users and may or may not include the Monitored User. The UGBSM further compares characteristics of the Monitored User to the characteristics of the Baseline Users and identifies at least one abnormality related to the Monitored User that indicates a security incident.

User activities such as communications, data transfer, use of different data types, use of different data exchange channels, authentication, use of an application, or visiting a website, gives access to user-related data. User activities are often repeated.

In an embodiment, the UBGSM monitors email attachments sent by group members. If no group member ever attached an archived, encrypted file, the UBGSM detects the event as a potential data leakage incident. The UBGSM monitors a user activity and creates one or more behavioral signatures for individual users and groups of users. A behavioral signature is an array, such as a vector, containing average values representing observed events of a period of time for one user or a group of users.

A distance or degree of variance refers to a function of any two behavioral signatures of a user or a group. In an embodiment, the degree of variance between two behavioral signatures comprises mathematical vector multiplication of two vectors representing behavioral signatures of these users or groups.

One or more thresholds are predetermined and used to decide whether two behavioral signatures are similar or not.

When a group signature is used, if a degree of variance between a group behavioral signature and a user behavior signature is less (or less or equal) than a group similarity threshold, then the user behavior is similar to the group behavior.

When a group signature is used, if a degree of variance between a group behavioral signature and a user behavior signature is greater (or greater or equal) than a group variance threshold, then the user behavior is different from the group behavior.

The group similarity threshold may equal or be different from the group variance threshold. A typical case is the comparison of user behavior signatures of two users to determine their similarity or difference.

When individual user behavioral signatures of users within a group are used, a group variance threshold for a group of individual users may be defined as a maximum value of degree of variance between any two user behavioral signatures in a group.

For example, if users within a group frequently send different types of Microsoft Office documents as attachments, some send Excel documents, a user who sends a rare, encrypted archive, such as a ZIP or a RAR file, will be detected as different from the group.

When the maximum of the degree of variance of a behavioral signature of a user A (within or outside of the group G) and all members U1, . . . , Unof the group G is less (or less or equal) than the group similarity threshold of a given group, the user's behavior is similar to the behavior of the group.

When the maximum of the degree of variance of a behavioral signature of a user A (within or outside of the group G) and all members U1, . . . , Unof the group G is greater (or greater or equal) than the group variance threshold of a given group, the user's behavior is different from the behavior of the group.

Groups of users with a similar behavior are identified when the degree of variance between user behavioral signatures is lower than a predetermined threshold. Users within groups whose behavior is different from the behavior of the group are identified when the degree of variance between group behavioral signature and user behavioral signature is greater than or equal to a predetermined threshold. Groups with similar behavior are identified when the degree of variance of group behavior signatures is lower than a predetermined threshold. Users outside of a given group with behavior similar to the given group are identified when the degree of variance between the group behavioral signature and the user behavioral signature is smaller than or equal to a predetermined threshold).

In some cases, misuse or abuse of secure information systems starts insignificantly and then grows over time. User behavior is predicted, and corrective action applied preemptively. For example, when the degree of variance between a given user behavioral signature and the group behavioral signature grows over time, but yet does not cross the group variance threshold, the invention predicts that they will cross the threshold in the future and takes an appropriate action.

Additionally, by lowering or elevating the threshold of similarity or the threshold of variance, the system adjusts its sensitivity.

In an embodiment, one set of characteristics of the Monitored User is compared to another set of characteristics of the Monitored User. For example, historic activity over a long period of time is compared to recent activity over a short period of time.

In another embodiment, the activity of the Monitored User is compared to a user group to which the Monitored User formally belongs according to one or more system settings.

Yet another embodiment is directed to comparing the activity of the Monitored User to the activity of one or more selected users according to certain criteria.

A UGBSM may indicate an incident or modify user access rights if behavior of an individual user within that group deviates or falls outside of a certain margin from certain criteria generated based on that UGBSM's observation of behavior of users within such group.

Exemplary embodiments will now be described with reference to the drawings.

FIG.1shows an exemplary procedure for an operation of a User to Group Behavior Signature Monitor (UGBSM) (100) according to an exemplary embodiment.

UGBSM (100) obtains access to the Certain Characteristics of the Monitored User (101) and Certain Characteristics of Baseline Users (102), in any order.

Using Certain Characteristics of the Monitored User, the UGBSM (100) calculates the User Behavioral Signature of the Monitored User in step (103).

Further, using Certain Characteristics of Baseline Users, the UGBSM (100) calculates Group Behavioral Signature of Baseline Users in step (104).

Furthermore, the UGBSM (100) calculates the Degree of Variance (DoV) between the User Behavioral Signature of the Monitored User and the Group Behavioral Signature of Baseline Users in step (105).

The UGBSM (100) further compares the calculated DoV to the Variance Threshold in step (106).

If the DoV is greater (or greater or equal) than the Variance Threshold, then the UGBSM (100) determines that the behavior of the Monitored User is abnormal compared to the behavior of Baseline Users in step (108).

If DoV is less or equal to the Variance Threshold, then the UGBSM (100) determines that the behavior of the Monitored User is not abnormal compared to the behavior of Baseline Users in step (107).

FIG.2shows the operation of an embodiment of UGBSM200that outputs information about the identified abnormality.

At some point, UGBSM (200) obtains access to the Certain Characteristics of the Monitored User (201) and Certain Characteristics of Baseline Users (202), in any order.

Using Certain Characteristics of the Monitored User, the UGBSM (200) calculates the User Behavioral Signature of the Monitored User in step (203).

Further, using Certain Characteristics of Baseline Users, the UGBSM (200) calculates Group Behavioral Signature of Baseline Users in step (204).

Furthermore, the UGBSM (200) calculates the Degree of Variance (DoV) between the User Behavioral Signature of the Monitored User and the Group Behavioral Signature of Baseline Users in step (205).

The UGBSM (200) further compares the calculated DoV to the Variance Threshold in step (206).

If the DoV is greater (or greater or equal) than the Variance Threshold, then the UGBSM (200) determines that the behavior of the Monitored User is abnormal compared to the behavior of Baseline Users in step (208) and generates a message about the identified abnormality in step (209).

If DoV is less or equal to the Variance Threshold, then the UGBSM (200) determines that the behavior of the Monitored User is not abnormal compared to the behavior of Baseline Users in step (207).

In an exemplary aspect, as shown inFIG.3, system (300) automatically manages assignments of users to groups.

System (300) includes a processor (301) (e.g., Central Processing Unit (CPU)) of a computer coupled to a memory (302) that stores instructions that are implemented by the processor (301).

The processor (301) is configured to implement the instructions for system (300) of monitoring a user behavior for abnormalities compared to a group behavior.

More specifically, the processor (301) is configured to implement the instructions for a user to group behavior signature monitor (UGBSM) with at least one user, as a monitored user, and a group of one or more users, as baseline users, to access to certain characteristics of the monitored user and certain characteristics of the baseline users, in step (303).

Further, the processor is configured to calculate a user behavioral signature of the monitored user, in step (304), and calculate a group behavioral signature of the baseline users, in step (305).

Furthermore, the processor is configured to calculate a degree of variance (DoV) between the user behavioral signature of the monitored user and the group behavioral signature of baseline users, in step (306).

Moreover, the processor is configured to compare the calculated DoV to a variance threshold to determine whether the user behavioral signature of the monitored user is similar or is different from the group behavioral signature of the baseline users, in step (307).

In an embodiment, such a UGBSM observes actions of applications related to the Monitored User or Baseline Users. These applications may be running on (1) individual user's computers, (2) when individual user is logged in, (3) when individual user is logged off, (4) under individual user's credentials, (5) under other credentials, but sharing access to at least one resource with individual users' context, or (6) be related to the user in some other way.

In an embodiment, such a UGBSM observes beginning, end, frequency, or duration of events related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes authentication events related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes access to a user's computer, a mobile device, or other hardware devices related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes a user activity in a web browser related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes a network traffic, such as IP addresses, port numbers, protocol types, volumes of data sent and received, or types of information sent or received (e.g., types of files sent via FTP) related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes access to cloud services including but not limited to file storage, collaboration, electronic mail, scheduling, file sharing, database, analytical, etc., related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes geolocation of computers or mobile devices related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes user access to certain individual database record or groups of database records related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM observes the communications such as email (e.g., sender, receiver, CC, BCC, size and time or the attachment(s), time sent, time received, etc.), SMS (e.g., time sent, time received, sender, receiver, read indicator), MMS, FTP related to the Monitored User or Baseline Users.

In an embodiment, such a UGBSM performs an analysis with predetermined heuristic rules, statistical analysis, neural network, or support vector machines.

In an embodiment, such a UGBSM performs an action (e.g., raises an incident) or communicates certain information about discovered abnormality to at least one destination (e.g., ticket tracking system or system administrator).

Example implementations include an apparatus for performing the operations described by virtue of computer programs with instructions for carrying out the necessary steps. Such computer programs may be stored in a computer readable medium, such as a computer-readable storage medium or a computer-readable signal medium. A computer-readable storage medium may involve tangible mediums such as, but not limited to optical disks, magnetic disks, read-only memories, random access memories, solid state devices and drives, or any other types of tangible or non-transitory media suitable for storing electronic information. A computer readable signal medium may include mediums such as carrier waves. In addition, the example implementations are not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the example implementations as described herein. The instructions of the programming language(s) may be executed by one or more processing devices, e.g., central processing units (CPUs), processors, or controllers.

As is known in the art, the operations described above can be performed by hardware, software, or some combination of software and hardware. Various aspects of the example implementations may be implemented using circuits and logic devices (hardware), while other aspects may be implemented using instructions stored on a machine-readable medium (software), which if executed by a processor, would cause the processor to perform a method to carry out implementations of the invention Further, some example embodiments are performed solely in hardware, whereas other example embodiments are performed solely in software. Moreover, the various functions described can be performed in a single unit or can be spread across a number of components in any number of ways. When performed by software, the methods may be executed by a processor, such as a general-purpose computer, based on instructions stored on a computer-readable medium. If desired, the instructions can be stored on the medium in a compressed or encrypted format.