Patent Document ID: 10015182
Application ID: 15199336
Patent Flag: 1

Claim One:
1. A computer-implemented method for protecting computing resources, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: computing a respective degree of commonality for pairs of users within a file sharing system based on which files the users accessed over a period of time; building a social graph that indicates at least one edge between members of an instance of the pairs of users based on the respective degree of commonality for the instance; computing an anomaly score for a user within the instance of the pairs of users based on a ratio between a number of neighbors of the user within the social graph and a combined edge weight between nodes within a set including the user and the neighbors of the user; detecting that the anomaly score deviates, according to a statistical measurement, from historical anomaly scores computed for the same user; and performing, in response to detecting that the anomaly score deviates from the historical anomaly scores, a protective action to protect computing resources from anomalous behavior by the user.