Patent ID: 12244602

DETAILED DESCRIPTION

AUGM is a system that monitors activities and characteristics of users of a managed computer system and creates a log of user activities and characteristics.

The AUGM system uses the log to identify similarities or dissimilarities of such characteristics of one or more users associated with one or more user groups. and compares identified similarities or dissimilarities in observed user activities and characteristics to current user-to-user group assignments.

The AUGM system monitors user activities, such as user authentication, use of an application, or website visits. The AUGM system also accesses user-related data, such as position, department, or years of employment.

The AUGM system, therefore, is directed to a user-activity monitor that collects and logs user data. The system then creates a plurality of behavioral signatures for users or groups of users. A typical behavioral signature is an array, such as a vector, containing average values representing monitored events over a period of time for one user or a group of users.

In this context, a distance or degree of variance (“DoV”) is a function of any two behavioral signatures of a user or a group. An example of such a degree of variance between two behavioral signatures is a mathematical distance between two vectors representing behavioral signatures of these users or groups.

DoV between an individual user and a group is determined by calculating a certain average signature for the group and then calculate the DoV between the user signature and the average group signature. Alternatively, DoV is determined by calculating the DoV between the user signature and all other users within that group. The maximum, average, mean or other certain other statistical function of all calculated DoVs is used as the DoV between the user and the group.

The AUGM uses one or more thresholds to make decisions of whether two behavioral signatures are similar. Examples are a similarity threshold (“ST”) and a distinction threshold (“DT”). In some cases, ST may equal DT.

When the DoV between a user signature and a group signature is less than (or less than or equal to) the ST, a decision is made that user and group signatures are similar.

When the DoV between a user signature and a group signature is more than (or more than or equal to) the DT, a decision is made that user and group signatures are different.

If ST and DT are different, there may be some intermediate zone where the relationship of a user to a group is not determined because there are not enough similarities to determine that the user is similar to that group. There are also not enough distinctions to tell that the user is different from the group.

Implementation of this approach generally comprises the identifying groups of users with a similar behavior. This is done by comparing the DoV between user behavioral signatures lower (or lower or equal) than a predetermined threshold. identify users within groups whose behavior is different from the behavior of the group, e.g., the DoV between a group behavioral signature and a user behavioral signature is greater (or greater or equal) than a certain threshold; identify groups with a similar behavior, e.g., the DoV of group behavior signatures lower (or lower or equal) than a certain threshold; and identify users outside of a given group with a behavior similar to the given group, e.g., the DoV between the group behavioral signature and the user behavioral signature is less (or less or equal) than a certain threshold.

Often the difference in behavior of two subgroups of users within a given group of users of a networked computer system, such as a corporate information system, starts small and grows over time. The AUGM system collects user data and forecasts a user's behavior and preemptively applies corrective actions. For example, when the degree of variance between a given user behavioral signature and the group behavioral signature grows over time, but yet does not cross the group variance threshold, the system forecasts that the variance will in the future cross that threshold and take an appropriate, predetermined action.

The same result is obtained when the degree of variance between two users, a user and a group, or two groups is steadily decreasing, but does not yet cross the threshold of similarity.

Lowering or elevating the threshold of similarity or the threshold of variance of the AUGM changes its sensitivity.

Exemplary embodiments of the invention will now be described with reference to the drawings.

FIG.1shows an exemplary operation of an AUGM (100) that compares the Behavioral Signature of User U (101) to the Group Behavioral Signature of Group G (102).

AUGM (100) obtains access to Certain Characteristics of User U (101) and Certain Characteristics of Group G (102).

The AUGM (100) calculates the User Behavioral Signature of User U using Certain Characteristics of User U in step (103).

Further, the AUGM (100) calculates the Group Behavioral Signature of Group G using Certain Characteristics of Group Gin step (104)

After accessing Certain Characteristics of Users (101), the AUGM (100) calculates the Degree of Variance (DoV) of the two signatures in step (105).

After calculating the DoV, the AUGM (100) compares the calculated DoV to the Group Variance Threshold in step (106).

If the calculated DoV is greater than the Group Variance Threshold, in step (107), the AUGM (100) makes the decision that the User Behavioral Signature of User U is different from the Group Behavioral Signature of Group G.

If the calculated DoV is less or equal to the Group Variance Threshold, in step (108), the AUGM (100) makes the decision that the User Behavioral Signature of User U is similar to the Group Behavioral Signature of Group G.

FIG.2shows another exemplary operation of an AUGM (200) that compares the Behavioral Signature of User U (201) to the Group Behavioral Signature of Group G (202).

At some point, the AUGM (200) obtains access to Certain Characteristics of User U (201) and Certain Characteristics of Group G (202), in any order.

The AUGM (200) calculates the User Behavioral Signature of User U using Certain Characteristics of User U in step (203).

Further, the AUGM (200) calculates the Group Behavioral Signature of Group G using Certain Characteristics of Group G in step (204)

After accessing Certain Characteristics of Users (201), the AUGM (200) calculates the Degree of Variance (DoV) of the two signatures in step (205).

After calculating the DoV, the AUGM (200) compares the calculated DoV to the Group Variance Threshold in step (206).

If the calculated DoV is greater than the Group Variance Threshold, in step (207), the AUGM (200) makes the decision that the User Behavioral Signature of User U is different from the Group Behavioral Signature of Group G, and in step (209), outputs the User-to-Group Assignment Recommendation A.

If the calculated DoV is less or equal to the Group Variance Threshold, in step (208), the AUGM (200) makes the decision that the User Behavioral Signature of User U is similar to the Group Behavioral Signature of Group G, and in step (210), outputs the User-to-Group Assignment Recommendation B.

In an exemplary aspect, as shown inFIG.3, system (300) automatically manages assignments of users to groups.

System (300) comprises a processor (301) (e.g., Central Processing Unit (CPU)) of a computer coupled to a memory (302) that stores instructions that are implemented by the processor (301).

The processor (301) is configured to implement the instructions for an automatic user group manager (AUGM) to access (303) to two or more users and the assignments of the users to the user groups, observe (304) characteristics of the users, calculate (305) user behavior signatures for one of at least two users of the users, at least one user of the users and one group of the user groups, or at least two groups of the user groups, calculate (306) a numeric degree of variance between at least two of the user behavior signatures, compare the calculated degree of variance to at least one threshold to determine (307) if a behavior of one of the at least two users, the at least one user and the one group, or the at least two groups are similar or different based on results of the comparison of the calculated degree of variance to the at least one threshold, and compare identified similarities or differences between the users or the user groups to allocate (308) the assignments of users to the user groups.

In an embodiment, such an AUGM observes actions of applications related to the user. These applications may be running, for example, on (1) user's computer or other devices, (2) when user is logged in, (3) when user is logged off, (4) under user credentials, (5) under other credentials than the user credentials but sharing access to at least one resource with user context, or (6) can otherwise be related to the user.

In an embodiment, such an AUGM observes beginning, end, frequency, and/or duration of events.

In an embodiment, such an AUGM observes user authentication events.

In an embodiment, such an AUGM observes user access to a user's computer, a mobile device, or other hardware devices.

In an embodiment, such an AUGM observes a user activity in a web browser.

In an embodiment, such an AUGM observes a user network traffic, such as IP addresses, port numbers, protocol types, communication with peripheral devices, volumes of data sent and received, and/or types of information sent and/or received (e.g., MIME types of files sent via FTP or high-level data category, e.g., Business data, Invoices, RnD, Architecture, etc.).

In an embodiment, such an AUGM observes user access to cloud services including but not limited to file storage, collaboration, electronic mail, scheduling, file sharing, database, analytical, social networks, etc.

In an embodiment, such an AUGM observes geolocation of a user's computer or a mobile device or IP-based geolocation of a user's device.

In an embodiment, such an AUGM observes user access to certain individual database records or groups of database records.

In an embodiment, such an AUGM observes the data related to user's communications such as email (e.g., sender, receiver, CC, BCC, size and time or the attachment(s), time sent, time received, etc.), SMS, MMS, or instant messaging (e.g., time sent, time received, sender, receiver, read indicator), MMS, and FTP.

In an embodiment, such an AUGM performs an analysis to identify a similar user behavior.

In an embodiment, such an AUGM performs an analysis to identify a dissimilar user behavior.

In an embodiment, such an AUGM performs an analysis to suggest removal of at least one user from at least one user group.

In an embodiment, such an AUGM performs an analysis to suggest addition of at least one user to at least one user group.

In an embodiment, such an AUGM performs an analysis with pre-programmed heuristic rules, statistical analysis, neural network, or support vector machines.

In an embodiment, such an AUGM performs suggested action and re-assigns a user to or from a group or communicates such assignment to at least one destination.

Moreover, other implementations of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the teachings of the present application. Various aspects or components of the described example implementations may be used singly or in any combination. It is intended that the specification and example implementations be considered as examples only, with the true scope and spirit of the present application being indicated by the following claims.