Cybersecurity detection and mitigation system using machine learning and advanced data correlation

Patent metadata

Field	Value
Publication number	US-11297078-B2
Application number	US-201916289299-A
Country	US
Kind code	B2
Filing date	Feb 28, 2019
Priority date	Feb 28, 2019
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Computer system security is often implemented using rules-based systems (e.g., allow traffic to this network port, deny it for those network ports; user A is allowed access to these files, but not those files). In enterprises, multiple such systems may be deployed, but fail to be able to intelligently handle anomalies that may technically be permissible but in reality represents a high possibility that there is an underlying threat or problem. The present disclosure describes the ability to build adaptive models using machine learning techniques that integrate data from multiple different domains (e.g. user identity domain, system device domain) and allow for automated decision making and mitigation actions that can provide greater effectiveness than previous systems allowed.

First claim

What is claimed is:

1. A method comprising:
receiving, by a security computer system, an access indication of a particular access attempt to access a particular electronic resource by a particular user;
accessing, by the security computer system:
a user behavior model generated based on user behavior patterns derived from previously-received indications of previous access attempts by a plurality of different users for accessing a plurality of different electronic resources, wherein the plurality of different users have different user attributes, and
a system access model generated based on access patterns derived from access records associated with the plurality of different electronic resources, wherein the plurality of different electronic resources have different system characteristics;

processing, by the security computer system, the access indication using the user behavior model and the system access model, wherein the processing comprises determining that the particular access attempt corresponds to a first user behavior pattern associated with one or more users having common user attributes with the particular user and determining that the particular access attempt corresponds to a first access pattern associated with one or more electronic resources having common system characteristics with the particular electronic resource;
identifying, by the security computer system, one or more access anomalies related to the particular electronic resource based on analyzing the first user behavior pattern and the first access pattern; and
implementing, by the security system using a mitigation model, one or more mitigation actions based on the one or more access anomalies.

2. The method of claim 1 ,
wherein the previously-received indications include, for each previous access attempt in the previous access attempts:
a user identifier corresponding to a user account associated with the previous access attempt,
a user level of access identifier associated with the user account,
a device identifier corresponding to a particular device used in the previous access attempt,
a time period associated with the previous access attempt,
an access location associated with the previous access attempt, and
a result of the previous access attempt;

wherein the user behavior model includes expected user access profiles for the plurality of users based on the previously-received indications; and
wherein the identifying the one or more access anomalies is further based on a comparison between the particular access indication and the expected user access profiles.

3. The method of claim 1 ,
wherein each of the plurality of different electronic resources includes a plurality of components;
wherein the access records include, for each component in the plurality of components:
one or more indications of when the component was previously accessed,
one or more indications of user accounts used to access the component, and
one or more indications of access locations;

wherein the system access model includes expected system access profiles for the plurality of components based on the access records; and
wherein the identifying the one or more access anomalies is further based on a comparison between the particular access indication and the expected system access profiles.

4. The method of claim 1 ,
wherein the user behavior model indicates that user accounts associated with the one or more users are expected to be used to access the particular electronic resource from a particular location during a particular time period;
wherein the system access model indicates that particular components of the electronic resource are expected to be accessed by the one or more users; and
wherein the identifying the one or more access anomalies includes:
identifying a first anomaly when the particular user account is used to access the particular electronic resource at a location different than the particular location; and
identifying a second anomaly when the particular user account is used to access components of the particular electronic resource different than the particular components.

5. The method of claim 1 , wherein the one or more mitigation actions include one or more of granting the particular user partial access to the particular electronic resource, denying the particular user access to the particular electronic resource, requiring additional verification from the particular user, or transmitting an alert to an entity other than the particular user.

6. The method of claim 1 , further comprising:
subsequent to the implementing the one or more mitigation actions, evaluating one or more results of the one or more mitigation actions; and
based on the one or more results of the evaluating, updating the mitigation model.

7. The method of claim 6 , wherein the evaluating the one or more results of the one or more mitigation actions and the updating the mitigation model are performed automatically by the security computer system without human intervention.

8. The method of claim 1 , wherein the user behavior model and the system access model are based on one or more machine learning algorithms, and wherein the method further comprises:
updating at least one of the user behavior model or the system access model based on additional access attempt data for one or more of the plurality of different electronic resources.

9. The method of claim 1 , wherein the security computer system comprises one or more computing devices of an entity, wherein the particular electronic resource is a resource connected to an intranet of the entity, and wherein the particular user is an employee or a contractor of the entity.

10. A non-transitory computer-readable medium storing instructions that when executed by a security computer system cause the security computer system to perform operations comprising:
receiving a particular access indication of a particular access attempt to access a particular electronic resource by a particular user;
processing the particular access indication using a user behavior model and a system access model, wherein the user behavior model is generated based on user behavior patterns derived from previously-received indications of previous access attempts by a plurality of different users for accessing a plurality of different electronic resources, wherein the plurality of different users have different user attributes, wherein the system access model is generated based on access patterns derived from access records associated with the plurality of different electronic resources, and wherein the plurality of different electronic resources have different system characteristics;
based on the processing, determining that the particular access attempt corresponds to a first user behavior pattern associated with one or more users having common user attributes with the particular user and determining that the particular access attempt corresponds to a first access pattern associated with one or more electronic resources having common system characteristics with the particular electronic resource;
identifying one or more access anomalies related to the particular electronic resource based on analyzing the first user behavior pattern and the first access pattern; and
implementing, using a mitigation model, one or more mitigation actions based on the one or more access anomalies.

11. The computer-readable medium of claim 10 , wherein the operations further comprise:
electronically receiving human feedback regarding a result of the implemented one or more mitigation actions, wherein the human feedback is not from the particular user; and
updating the mitigation model based on the human

Assignees

• Paypal Inc

Inventors

• Johnson Brian
• Wardman Bradley
• Pratt Nathan

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title

• G06N3/088

  Non-supervised learning, e.g. competitive learning · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title