Patent ID: 8392553

Claim:
A system for monitoring actions performed by a user of a user device on a network, the user accessing the user device with an individual network user identity, the system comprising: a user device including a user interface for interacting with a user, an operating system, at least one sensor, and a processor configured to: detect user interaction events created by interaction of the user with the operating system of the user device using the at least one sensor, create data structures representing the detected user interaction events, and communicate the created data structures to a system monitor; a system monitor configured to: communicate over the network with the user device, create a user profile using the communicated data structures, and associate the user profile with the individual network user identity used to log onto and access the user device or the network; wherein the user device is further configured to subsequently detect user interaction events of a subsequent user accessing the user device via the individual network user identity associated with the user profile; and wherein the system monitor is further configured to: compare the subsequently detected events to the user profile associated with the individual network user identity, determine, based on the comparing, whether the subsequently detected events conform to the user profile associated with the individual network user identity by using a similarity matrix, in response to the determining, further determine that the subsequent user is not the individual user associated with the user profile associated with the individual network user identity, and force a security action on the user device.