Patent Document ID: 8375452
Application ID: 12344229

Base Claim:
1. A method for user profiling for detecting insider threats, the method comprising the steps of: (a) upon a client application sending a request for a URI (Uniform Resource Identifier) web link, extracting at least one search keyword from a search session associated with said request; (b) classifying said URI web link into at least one classification; (c) determining whether said at least one classification is a monitored classification; (d) capturing search elements of search sessions associated with said monitored classification; (e) acquiring usage data from said search elements to create a user profile associated with a user's search behavior; (f) monitoring a level of sophistication of software used by said user; and (g) performing a statistical analysis, on a search frequency for said monitored classification and on said level of sophistication, on user profiles associated with many users, to yield a respective grade in knowledge/skill.

---

Claim 3:
3. The method of claim 1 , the method further comprising the step of (h) designating a user profile as suspicious based on said statistical analysis exceeding a pre-determined threshold value, wherein said pre-determined threshold value is based on an expected search frequency for said user profile and each said respective grade for said at least one risk-assessment dimension.