User behavior based security in a software defined data center

Patent metadata

Field	Value
Publication number	US-11233770-B2
Application number	US-201916460823-A
Country	US
Kind code	B2
Filing date	Jul 2, 2019
Priority date	Jul 2, 2019
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

Behavior-based security in a datacenter includes monitoring user actions made by users in the datacenter. Behavior-based risk scores are computer for users based on their monitored actions. One or more firewall rules are generated for users based on their behavior-based risk scores. The firewall rules regulate the actions of the users.

First claim

The invention claimed is:

1. A method comprising:
detecting, by one or more computers, computer-related actions performed by a user;
logging, by one or more of the computers, a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
computing, by one or more of the computers, one or more behavior-based risk scores for the user based on the user's computer-related actions;
receiving, by a rule builder, the logged event;
building, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
inserting, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulating, by one or more of the computers, the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.

2. The method of claim 1 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score associated with executing processes.

3. The method of claim 1 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.

4. The method of claim 1 , wherein regulating the user's computer-related actions includes at least one of allowing or denying the user from logging onto a computer system, allowing or denying the user access to a file or a server, allowing, denying, or redirecting a destination of a network access, allowing or denying the user from installing software, and allowing or denying execution of a process.

5. A non-transitory computer-readable storage medium having stored thereon computer executable instructions, which when executed by a computer device, cause the computer device to:
detect computer-related actions performed by a user;
log the user's computer-related actions as a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
compute one or more behavior-based risk scores for the user based on the user's computer-related actions;
receive, by a rule builder, the logged event;
build, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
insert, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulate the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.

6. The non-transitory computer-readable storage medium of claim 5 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score associated with executing processes.

7. The non-transitory computer-readable storage medium of claim 5 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.

8. The non-transitory computer-readable storage medium of claim 5 , wherein regulating the user's computer-related actions includes at least one of allowing or denying the user from logging onto a computer system, allowing or denying the user access to a file or a server, allowing, denying, or redirecting a destination of a network access, allowing or denying the user from installing software, and allowing or denying execution of a process.

9. An apparatus comprising:
one or more computer processors; and
a computer-readable storage medium comprising instructions for controlling the one or more computer processors to be operable to:
detect computer-related actions performed by a user;
log the user's computer-related actions as a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
compute one or more behavior-based risk scores for the user based on the user's computer-related actions;
receive, by a rule builder, the logged event;
build, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
insert, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulate the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.

10. The apparatus of claim 9 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.

11. The apparatus of claim 9 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score asso

Assignees

• Vmware Inc

Inventors

• Myneni Sirisha
• Mordani Rajiv
• Kumar Kausum

Classifications

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title