Patent Document ID: 9047464
Application ID: 13844274

Base Claim:
1. A method for securing a computer device, the method comprising: receiving, by a security server, interaction data for a user interfacing with the computer device while the user is authenticated for accessing at least one computer resource, the interaction data including keyboard inputs, images taken of the user during the access and screen captures taken periodically; performing optical character recognition (OCR) to identify text in the screen captures; extracting semantic data from the interaction data and from the text in the screen captures, the semantic data identifying user activities associated with the interaction data; generating a schema based on the extracted semantic data, the schema including tags that are descriptive of at least one of the identified user activity and the associated interaction data; analyzing the schema based on a model to identify security threats associated with the user activities; creating an alarm when non-conforming behavior for at least one user activity is detected, the alarm including a binding of the one or more user activities, one or more tags, keyboard inputs, and screen captures associated with the one or more user activities; and sending a command from the security server to terminate access to the at least one computer resource in response to the alarm, wherein operations of the method are executed by a processor.

---

Claim 7:
7. The method as recited in claim 1 , wherein the interaction data further includes one or more of a mouse input, an audio input, a biometric signal for the user, a geographic location of the user, a name of an active application used by the user, an operation to save data to an external device, an operation to print, a cut-and-paste of data for inclusion in an email or an attachment of a file being emailed, or computer device type including operating system, Basic Input/Output System (BIOS) version, time and date.