Patent ID: 8745759

Claim:
A method for determining anomalous user behavior associated with application use in a computing network, the method comprising: validating, via a computing device processor, authentication credentials from an application requesting to deliver first data related to accessing sensitive information via predetermined applications and second data related to performing predetermined actions via predetermined applications, wherein validating the authentication credentials comprises determining the application is a validated source based at least partially on the authentication credentials, and wherein the authentication credentials are registered with a system prior to validating; receiving, at a computing device, the first and second data from the application via the computing network, wherein the first data comprises a job responsibility of a user and second data comprises one or more actions performed by the user, and collecting the first and second data based on determining that the application is a validated source; storing, in computing device memory, the first and second data in a database, wherein the database is configured to store the first and second data in a specified table based on a predetermined period of time associated with the receipt of the data; comparing, via a computing device processor, the first data to anomalous access criteria and the second data to anomalous action criteria, wherein the anomalous access criteria comprises a job responsibility of the user, wherein the anomalous action criteria comprises one or more actions performed by the user considered to be normal based on at least the job responsibility of the user; and determining, via a computing device processor, a normal behavior or anomalous behavior based on at least the comparison of the first data to anomalous access criteria and the second data to anomalous action criteria.