Network threat detection and management system based on user behavior information

Patent metadata

Field	Value
Publication number	US-10931698-B2
Application number	US-201916531218-A
Country	US
Kind code	B2
Filing date	Aug 5, 2019
Priority date	Mar 2, 2015
Publication date	Feb 23, 2021
Grant date	Feb 23, 2021

Abstract

A device may receive behavior information that identifies a first user, of a first set of users, in association with a behavior. The behavior may relate to one or more requests, from a client device being used by the first user, to access a network resource. The device may determine, based on a model, whether the behavior is normal. The model may include a normal behavior pattern based on behavior information associated with the first set of users. The device may provide an instruction to allow the client device to proceed with the behavior or provide an instruction to disallow the client device from proceeding with the behavior based on determining whether the behavior is normal. The device may update the model based on the behavior information that identifies the first user and that identifies the behavior.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a device, behavior information that identifies a behavior associated with a user,
the behavior including one or more requests, from a client device of the user, to access one or more network resources of a network;

determining, by the device, whether a first model has been created,
the first model, when created, including a first normal behavior pattern associated with the user;

determining, by the device, whether a second model has been created,
the second model, when created, including a second normal behavior pattern associated with a user group to which the user belongs;

determining, by the device, whether the behavior is normal by selectively comparing, based on whether at least one of the first model or the second model has been created, the behavior information and at least one of the first normal behavior pattern or the second normal behavior pattern,
the behavior information being input into the first model to compare the behavior information and the first normal behavior pattern when the first model has been created, and
the behavior information being input into the second model to compare the behavior information and the second normal behavior pattern when the second model has been created;

determining, by the device, that a comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern does not provide a conclusive classification of whether the behavior is normal;
comparing, by the device and based on the comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern not being able to provide the conclusive classification of whether the behavior is normal, the behavior information and another normal behavior pattern;
providing, by the device and based on comparing the normal behavior information and another normal behavior information to determine that the behavior is normal, an instruction to allow the client device to proceed with the behavior; and
selectively:
updating, by the device, when the first model has been created and when the behavior is determined to be normal, the first model by using the behavior information to modify the first normal behavior pattern, or
updating, by the device, when the second model has been created and when the behavior is determined to be normal, the second model by using the behavior information to modify the second normal behavior pattern.

2. The method of claim 1 , wherein the behavior information identifies the behavior being performed over a particular period of time.

3. The method of claim 1 , wherein determining whether the behavior is normal comprises:
determining whether a difference between the behavior information and at least one of the first normal behavior pattern or the second normal behavior pattern satisfies a threshold.

4. The method of claim 1 , wherein determining whether the first model was created comprises:
determining that the first model was not created; and
wherein determining whether the second model was created comprises:
determining, based on determining that the first model was not created, whether the second model was created.

5. The method of claim 1 , further comprising:
comparing the behavior information and the first normal behavior pattern;
wherein determining that a comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern does not provide a conclusive classification of whether the behavior is normal includes determining that a comparison of the behavior information and the first normal behavior pattern does not provide a conclusive classification of whether the behavior is normal;
wherein comparing the behavior information and the other normal behavior pattern includes comparing, based on the comparison of the behavior information and the first normal behavior pattern not being able to provide the conclusive classification of whether the behavior is normal, the behavior information and the second normal behavior pattern; and
wherein determining whether the behavior is normal comprises:
determining whether the behavior is normal based on comparing the behavior information and the second normal behavior pattern.

6. The method of claim 5 ,
wherein determining that a comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern does not provide a conclusive classification of whether the behavior is normal includes determining that a comparison of the behavior information and the second normal behavior pattern does not provide the conclusive classification of whether the behavior is normal;
wherein comparing the behavior information and the other normal behavior pattern includes comparing, based on determining that the comparison of the behavior information and the second normal behavior pattern does not provide the conclusive classification of whether the behavior is normal, the behavior information and a third normal behavior pattern associated with all users for whom the device has received corresponding behavior information; and
wherein the method further comprises:
determining whether the behavior is normal based on comparing the behavior information and the third normal behavior pattern.

7. The method of claim 1 , wherein the behavior is first behavior;
wherein the instruction is a first instruction; and
wherein the method comprises:
determining that second behavior associated with the user is abnormal; and
providing a second instruction to deny permission to the client device to proceed with the second behavior.

8. A device, comprising:
one or more memories; and
one or more processors, implemented at least partially in hardware and communicatively coupled to the one or more memories, configured to:
receive behavior information that identifies a behavior associated with a user,
the behavior including one or more requests, from a client device of the user, to access one or more network resources of a network;

determine whether a first model has been created,
the first model, when created, including a first normal behavior pattern associated with the user;

determine whether a second model has been created,
the second model, when created, including a second normal behavior pattern associated with a user group to which the user belongs;

determine whether the behavior is normal by selectively comparing, based on whether at least one of the first model or the second model has been created, the behavior information and at least one of the first normal behavior pattern or the second normal behavior pattern,
the behavior information being input into the first model to compare the behavior information and the first normal behavior pattern when the first model has been created, and
the behavior information being input into the second model to compare the behavior information and the second normal behavior pattern when the second model has been created;

determine that a comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern does not provide a conclusive classification of whether the behavior is normal;
compare, based on the comparison of the behavior information and the at least one of the first normal behavior pattern or the second normal behavior pattern not being able to provide the conclusive classification of whether the behavior is normal, the behavior information and another normal behavior pattern;
provide, based on comparing the normal behavior information and another normal b

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Srivastava Ashok N
• Das Santanu
• Shao Hai

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/22

  Electricity · mapped topic