Patent Document ID: 9798883
Application ID: 14507585
Patent Flag: 1

Claim One:
1. A method, performed by one or more computer devices, for detecting and assessing security risks in an enterprise's computer network, the method comprising: building a behavior model for a user based on the user's interactions with the network, wherein the behavior model indicates client device(s), server(s), application(s), and data used by the user and includes the user's geo-location logon patterns; comparing a plurality of user events in the network to the user's behavior model, including comparing a client device used, server(s) accessed, any application(s) accessed, and any data accessed in the user events to the user's behavior model and determining whether a geo-location from which the user logged in is consistent with the geo-location patterns in the user's behavior model, wherein building the behavior model and comparing the user events include tracking user movement across devices in the network including monitoring for a user account switch in moving from one device to another; determining, based at least in part on a comparison between the user events and the user's behavior model, whether the user events satisfy one or more of a plurality of rules that define types of anomalies that increase a risk assessment, wherein each rule is associated with points for a risk assessment score; calculating the risk assessment score for the plurality of user events; and determining whether the plurality of user events satisfies criteria for an alert, wherein the criteria includes a risk assessment score that exceeds a threshold, wherein: in response to the plurality of user events satisfying the criteria for an alert, displaying an alert in an administrative interface, and in response to the plurality of user events not satisfying the criteria for an alert, updating the user's behavior model with session data.