Security system using pseudonyms to anonymously identify entities and corresponding security risk related behaviors

Patent metadata

Field	Value
Publication number	US-11025659-B2
Application number	US-201816168302-A
Country	US
Kind code	B2
Filing date	Oct 23, 2018
Priority date	Oct 23, 2018
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

A method, system and computer-usable medium for using pseudonyms to identify entities and their corresponding security risk factors is disclosed. In certain embodiments, a computer-implemented method for identifying security risks associated with a plurality of different entities is disclosed, wherein the method comprises: receiving a stream of events, the stream of events comprising a plurality of events associated with the plurality of different entities; pseudonymizing events of the plurality of events by replacing entity names in the plurality of events with corresponding entity pseudonyms to thereby provide a plurality of pseudonymized events; executing security analytics operations on the plurality of pseudonymized events to identify user behaviors presenting security risks; and using the entity pseudonyms to anonymously identify entities engaging in security risk related behaviors.

First claim

What is claimed is:

1. A computer-implemented method for identifying security risks associated with a plurality of different entities, comprising:
receiving a plurality of resolved events, wherein the plurality of resolved events are associated with the plurality of different entities using entity names;
enriching the events of the plurality of resolved events with corresponding entity pseudonyms to thereby provide a plurality of pseudonymized events;
executing security analytics operations on the plurality of pseudonymized events to identify user security risks; and
using the entity pseudonyms to anonymously identify entities engaging in security risk related behaviors; and wherein
pseudonymizing events of the plurality of resolved events comprises:
identifying an entity name in a resolved event;
determining whether the entity name is associated with a corresponding entity pseudonym; and
if the entity name is associated with a corresponding entity pseudonym, enriching the resolved events with the corresponding entity pseudonym.

2. The computer-implemented method of claim 1 , further comprising:
storing the plurality of resolved events in persistent memory; and
pseudonymizing the resolved events stored in the persistent memory in a batch operation to provide the plurality of pseudonymized events.

3. The computer-implemented method of claim 1 , further comprising:
generating the plurality of resolved events from a stream of raw events;
pseudonymizing the plurality of resolved events in real-time as the plurality of resolved events are generated from the stream of raw events to provide the plurality of pseudonymized events.

4. The computer-implemented method of claim 1 , further comprising:
generating an entity pseudonym for an entity name through random selection of one or more words from one or more words lists, wherein multiple words in at least one of the one or more words lists are associated with a common domain; and
storing the entity pseudonym for the entity in a data structure for use in pseudonymizing events of the plurality of events.

5. The computer-implemented method of claim 4 , wherein
the common domain includes one or more of a forename domain, a city domain, a color domain, or an animal domain.

6. The computer-implemented method of claim 1 , further comprising:
extracting features from the plurality of pseudonymized events;
constructing a distribution of the features from the plurality of pseudonymized events; and
analyzing the distribution of the features of the plurality of pseudonymized events to generate security risk scores associated with an entity pseudonym for presentation on an analytics interface.

7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving a plurality of resolved events, wherein the plurality of resolved events are associated with the plurality of different entities using entity names;
enriching the events of the plurality of resolved events with corresponding entity pseudonyms to thereby provide a plurality of pseudonymized events;
executing security analytics operations on the plurality of pseudonymized events to identify user security risks; and
using the entity pseudonyms to anonymously identify entities engaging in security risk related behaviors; and wherein
pseudonymizing events of the plurality of resolved events comprises:
identifying an entity name in a resolved event;
determining whether the entity name is associated with a corresponding entity pseudonym; and
if the entity name is associated with a corresponding entity pseudonym, enriching the resolved event with the corresponding entity pseudonym.

8. The system of claim 7 , further comprising:
storing the plurality of resolved events in persistent memory; and
pseudonymizing the resolved events stored in the persistent memory in a batch operation to provide the plurality of pseudonymized events.

9. The system of claim 7 , further comprising:
generating the plurality of resolved events from a stream of raw events;
pseudonymizing events of the plurality of resolved events in real-time as the plurality of resolved events are generated from the stream of raw events to provide the plurality of pseudonymized events.

10. The system of claim 7 , further comprising:
generating an entity pseudonym for an entity name through random selection of one or more words from one or more words lists, wherein multiple words in at least one of the one or more words lists are associated with a common domain; and
storing the entity pseudonym for the entity in a data structure for use in pseudonymizing events of the plurality of events.

11. The system of claim 10 , wherein
the common domain includes one or more of a forename domain, a city domain, a color domain, or an animal domain.

12. The system of claim 7 , further comprising:
extracting features from the plurality of pseudonymized events;
constructing a distribution of the features from the plurality of pseudonymized events; and
analyzing the distribution of the features of the plurality of pseudonymized events to generate security risk scores associated with an entity pseudonym for presentation on an analytics interface.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
receiving a plurality of resolved events, wherein the plurality of resolved events are associated with the plurality of different entities using entity names;
enriching the events of the plurality of resolved events with corresponding entity pseudonyms to thereby provide a plurality of pseudonymized events;
executing security analytics operations on the plurality of pseudonymized events to identify user security risks; and
using the entity pseudonyms to anonymously identify entities engaging in security risk related behaviors; and wherein
pseudonymizing events of the plurality of resolved events comprises:
identifying an entity name in a resolved event;
determining whether the entity name is associated with a corresponding entity pseudonym; and
if the entity name is associated with a corresponding entity pseudonym, enriching the resolved events with the corresponding entity pseudonym.

14. The non-transitory, computer-readable storage medium of claim 13 , further comprising:
storing the plurality of resolved events in persistent memory; and
pseudonymizing the resolved events stored in the persistent memory in a batch operation to provide the plurality of pseudonymized events.

15. The non-transitory, computer-readable storage medium of claim 13 , further comprising:
generating the plurality of resolved events from a stream of raw events; and
pseudonymizing events of the plurality of resolved events in real-time as the plurality of resolved events are generated from the stream of raw events to provide the plurality of pseudonymized events.

16. The non-transitory, computer-readable storage medium of claim 13 , further comprising:
generating an entity pseudonym for an entity name through random selection of one or more words from one or more words lists, wherein multiple words in at least one of the one or more words lists are associated with a commo

Assignees

• Forcepoint Llc

Inventors

• Sarzynski Kenneth
• Bracikowski Phillip

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/102

  Entity profiles · CPC title