Detecting deviations from typical user behavior

Patent metadata

Field	Value
Publication number	US-11909752-B1
Application number	US-202217857896-A
Country	US
Kind code	B1
Filing date	Jul 5, 2022
Priority date	Nov 27, 2017
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

First claim

What is claimed is:

1. A method of detecting deviations from typical user behavior, the method comprising:
identifying a location of a device that is associated with a user;
determining device activity associated with the user;
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and
generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts.

2. The method of claim 1 further comprising, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.

3. The method of claim 1 further comprising generating the profile associated with the user.

4. The method of claim 1 wherein determining device activity associated with the user further comprises:
identifying one or more applications accessed by the device; and
identifying application behavior for the one or more applications.

5. The method of claim 1 wherein device activity associated with the user is continuously monitored for deviation from normal activity.

6. The method of claim 1 wherein the device activity associated with the user and the profile associated with the user include temporal information.

7. The method of claim 1 further comprising identifying a location of a device that is associated with a user.

8. A system for detecting deviations from typical user behavior, the system comprising at least one processor and memory storing computer program instructions that, when executed, cause the system to carry out the steps of:
identifying a location of a device that is associated with a user;
determining device activity associated with the user;
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and
generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts.

9. The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.

10. The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating the profile associated with the user.

11. The system of claim 8 wherein determining device activity associated with the user further comprises:
identifying one or more applications accessed by the device; and
identifying application behavior for the one or more applications.

12. The system of claim 8 wherein device activity associated with the user is continuously monitored for deviation from normal activity.

13. The system of claim 8 wherein the device activity associated with the user and the profile associated with the user include temporal information.

14. A computer program product for detecting deviations from typical user behavior, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:
identifying a location of a device that is associated with a user;
determining device activity associated with the user;
detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user; and
generating a user-specific visualization for the user, the user-specific visualization including a first visual representation of the location of the device, and one or more second visual representations of the device activity associated with the user linked to the first visual representation of the location of the device indicating that the device activity occurred at the location, wherein the user-specific visualization further includes one or more alerts.

15. The computer program product of claim 14 further comprising computer program instructions that, when executed, carry out the step of, responsive to detecting that the device activity associated with the user deviates from normal activity for the user, generating an alert.

16. The computer program product of claim 14 wherein determining device activity associated with the user further comprises:
identifying one or more applications accessed by the device; and
identifying application behavior for the one or more applications.

17. The computer program product of claim 14 wherein device activity associated with the user is continuously monitored for deviation from normal activity.

18. The computer program product of claim 14 wherein the device activity associated with the user and the profile associated with the user include temporal information.

Assignees

• Lacework Inc

Inventors

• Kapoor Vikram
• Singh Harish Kumar Bharat
• Zeng Weifei
• Jeyakumar Vimalkumar
• Tock Theron
• Xie Ying
• Chen Yijou

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F16/9038

  Presentation of query results · CPC title