Methods, systems, apparatus, and storage media for use in detecting anomalous behavior and/or in preventing data loss

Patent metadata

Field	Value
Publication number	US-10192050-B2
Application number	US-201514964829-A
Country	US
Kind code	B2
Filing date	Dec 10, 2015
Priority date	Oct 30, 2015
Publication date	Jan 29, 2019
Grant date	Jan 29, 2019

Abstract

In one aspect, a method includes: receiving information defining a plurality of different actions that may be performed by users; receiving information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receiving information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determining a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

First claim

What is claimed is:

1. A computer-implemented method comprising: receiving, in a processor, information defining a first of a plurality of different actions that may be performed by users wherein the first of the plurality of different actions and a second of a plurality of different actions each comprise copying of one or more files, moving one or more files, deleting one or more files, uploading one or more files, network transferring one or more files, or emailing one or more files that may be performed by users wherein the first action is a different action than the second action: receiving, in a processor, information indicating a relative frequency at which the first action and the second action was performed by each of a plurality of users over each of one or more periods of time; determining, by a processor, a plurality of different characteristic behaviors comprising a first characteristic that defines a relative frequency of a performance of a first action of the plurality the different actions and a second characteristic that defines a relative frequency of a performance of a second action of the plurality the different actions over each of one or more periods of time; receiving, in a processor, information indicating a relative frequency at which the first action and the second action was performed by a user over a period of time; determining, by a processor, a representation of the relative frequency at which the first action and the second action was performed by the user over the period of time as a weighted combination of the first characteristic and the second characteristic; determining, by a processor, a reconstruction error based on (i) the relative frequency at which the first action and the second action was performed by the user over the period of time and (ii) the weighted combination of the first characteristic and the second characteristic; in a case that the reconstruction error is less than a threshold, indicating normal behavior, and in case that the reconstruction error is greater than the threshold, indicating anomalous behavior.

2. The computer-implemented method of claim 1 , further comprising: determining, by a processor, a difference based at least in part on: (i) the relative frequency at which the first action and the second action was performed by a user over a period of time and (ii) the weighted combination representing the relative frequency at which the first action and the second action was performed by the user over the period of time; and comparing, by a processor, the difference to a criteria.

3. The computer-implemented method of claim 2 , further comprising: displaying, based at least in part on the comparison, a result indicating whether anomalous behavior is detected on the part of the user.

4. The computer-implemented method of claim 1 , wherein the determining, by a processor, a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which the first action and the second action was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of the first action and the second action, is performed without human supervision.

5. The computer-implemented method of claim 1 , wherein the information indicating the relative frequency at which the first action and the second action was performed by each of the plurality of users over each of one or more periods of time includes: a plurality of user-time period combinations, each one of the user-time period combinations being associated with a respective combination of one of the plurality of users and one of the one or more periods of time; the method further comprising: determining, by a processor, for each user-time period combination, a representation of the relative frequency at which the first action and the second action was performed by the associated one of the plurality of users over the associated one of the one or more periods of time, as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of the first action and the second action.

6. The computer-implemented method of claim 5 , the method further comprising: (a) defining, by a processor, a user-time period combination to be an outlier; (b) determining, by a processor, a new plurality of different characteristic behaviors, based at least in part on the information indicating the relative frequency at the first action and the second action was performed by each of the plurality of users over each of one or more periods of time with the exception of each user-time period combination defined to be an outlier, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of the first action and the second action; (c) determining, by a processor, if a termination criteria is satisfied; and (d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

7. The computer-implemented method of claim 5 , the method further comprising: defining, by a processor, a count indicating a number of different characteristic behaviors; wherein the determining, by a processor, a plurality of different characteristic behaviors comprises: determining, by a processor, a plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors, the method further comprising: (a) incrementing, by a processor, the count indicating a number of different characteristic behaviors; (b) determining, by a processor, a new plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which the first action and the second action was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of the first action and the second action: (c) determining, by a processor, if a termination criteria is satisfied; and (d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

8. The computer-implemented method of claim 1 , wherein the plurality of different actions is a first plurality of different actions; the method further comprising: determining if a change criteria is satisfied; and if it is determined that the change criteria is satisfied, determining a new plurality of different characteristic behaviors based at least in part on information indicating a relative frequency at which each of a second plurality of different actions was performed by each of a plurality of users over each of a second one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the second plurality of different actions.

9. The computer-implemented method of claim 8 , wherein the second plurality of different actions are the same as the first plurality of different actions.

10. A non-transitory computer readable storage medium having code stored thereon, the code being executable by a processor to result in a method comprising: receiving information defining a first of a plurality of different actions that may be performed by users wherein the first of the plurality of different actions comprises copying of one or more files, movin

Assignees

• Gen Electric

Inventors

• Srivastav Abhishek
• Kasiviswnathan Shiva Prasad
• Evans Scott Charles
• Beauchamp Philip Paul

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title