Addressable smart agent data technology to detect unauthorized transaction activity

Patent metadata

Field	Value
Publication number	US-12386952-B2
Application number	US-202418437347-A
Country	US
Kind code	B2
Filing date	Feb 9, 2024
Priority date	Mar 31, 2015
Publication date	Aug 12, 2025
Grant date	Aug 12, 2025

Abstract

A computer implemented and electronic process is provided that uses artificial intelligence to detect unauthorized activity by an insider or hacker. Electronic systems that employ artificial intelligence and machine learning to detect unauthorized transaction activity by insiders or hackers for a computer network system are also provided. Hardware required for carrying out the invention typically include a plurality of networked computers. Specialized software and/or firmware is typically needed in connection with the hardware for carrying out the invention.

First claim

I claim:

1. A computer-implemented method for detecting unauthorized activities on a network, comprising:
receiving, at one or more processors, an activity report comprising data regarding one or more actions performed by a system administrator on the network;
retrieving, via the one or more processors, a plurality of task smart agents corresponding to a job of the system administrator, each of the plurality of task smart agents including a long-term profile establishing at least one normal value for an attribute of a corresponding task based on historical performance of the job by the system administrator;
determining, via the one or more processors, that the activity report data reflect one or more deviations by the system administrator from the normal values for the attributes of the plurality of task smart agents, the one or more deviations respectively being of least a corresponding threshold degree;
generating, via the one or more processors, an output flag for each of the one or more deviations;
submitting, via the one or more processors, the one or more output flags to a judging module;
issuing, via the one or more processors and based on the one or more output flags, a lockout output restricting access to the network by the system administrator.

2. The computer-implemented method of claim 1 , wherein the plurality of attributes corresponding to the plurality of long-term profiles relate to at least one of the following: whether one of the plurality of corresponding tasks is normally undertaken by the system administrator in connection with the job; how often one of the plurality of corresponding tasks is normally undertaken by the system administrator in connection with the job; and at least one proper ordering of the plurality of corresponding tasks relative to one another as normally undertaken by the system administrator in connection with the job.

3. The computer-implemented method of claim 1 , wherein determining the one or more deviations includes using a job clock to measure deviation from one or more normal values for at least one of the following age attributes: amount of time for completion of one of the plurality of corresponding tasks; number of corresponding actions by the system administrator associated with completion of one of the plurality of corresponding tasks; amount of time for beginning one of the plurality of corresponding tasks; and number of corresponding actions by the system administrator associated with beginning one of the plurality of corresponding tasks.

4. The computer-implemented method of claim 3 , wherein the job clock utilizes a state machine that measures clock cycles.

5. The computer-implemented method of claim 1 , wherein the plurality of attributes corresponding to the plurality of long-term profiles relate to at least one of the following: the normal range of typing speeds observed for the system administrator in connection with performing the job; the tools normally implemented by the system administrator in connection with performing the job; how long the system administrator typically takes to perform one or more of the plurality of corresponding tasks of the job; the typical workstations utilized by the system administrator to perform the job; and the time of day during which the system administrator typically performs the job.

6. The computer-implemented method of claim 1 , further comprising—
retrieving, via the one or more processors, a recursive task smart agent including a long-term profile establishing at least one normal value for an attribute of one of the plurality of corresponding tasks based on historical performance of the job by a plurality of peers of the system administrator;
determining, via the one or more processors, that the activity report data reflect a deviation by the system administrator from the at least one normal value for the attribute of the one of the plurality of corresponding tasks associated with the recursive task smart agent, the deviation assessed in connection with the recursive task smart agent being of at least a corresponding threshold degree;
generating, via the one or more processors, an output flag for the deviation assessed in connection with the recursive task smart agent;
submitting, via the one or more processors, the output flag assessed in connection with the recursive task smart agent to the judging module;
generating, via the one or more processors, a confidence score based on the one or more output flags assessed in connection with the corresponding ones of the plurality of task smart agents and on the output flag assessed in connection with the recursive task smart agent, the lockout output being based on the confidence score.

7. The computer-implemented method of claim 1 , wherein the one or more actions comprise issuance of at least one of the following commands: read, write, execute program, print, and display.

8. The computer-implemented method of claim 1 , further comprising—
matching, via the one or more processors, the activity report to a malicious pattern using a signature recognition processor, the signature recognition processor being configured to recognize and classify known patterns of malicious behavior, the lockout output being based on the match.

9. The computer-implemented method of claim 1 , further comprising validating, via the one or more processors, the activity report data by comparison against one or more facts obtained from a management information system.

10. The computer-implemented method of claim 1 , further comprising defining, via the one or more processors, the plurality of attributes of the plurality of corresponding tasks using case-based reasoning.

11. At least networked computer for detecting unauthorized activities on a network, comprising:
one or more processors; and
a non-transitory computer-readable storage media having computer-executable instructions stored thereon, wherein when executed by the one or more processors the computer-readable instructions cause the one or more processors to—
receive an activity report comprising data regarding one or more actions performed by a system administrator on the network;
retrieve a plurality of task smart agents corresponding to a job of the system administrator, each of the plurality of task smart agents including a long-term profile establishing at least one normal value for an attribute of a corresponding task based on historical performance of the job by the system administrator;
determine that the activity report data reflect one or more deviations by the system administrator from the normal values for the attributes of the plurality of task smart agents, the one or more deviations respectively being of least a corresponding threshold degree;
generate an output flag for each of the one or more deviations;
submit the one or more output flags to a judging module;
issue, based on the one or more output flags, a lockout output restricting access to the network by the system administrator.

12. The networked computer of claim 11 , wherein the plurality of attributes corresponding to the plurality of long-term profiles relates to at least one of the following: whether one of the plurality of corresponding tasks is normally undertaken by the system administrator in connection with the job; how often one of the plurality of corresponding tasks is normally undertaken by the system administrator in connection with the job; and at least one proper ordering of the plurality of corresponding tasks relative to one another as normally undertaken by the system administrator in connection with the job.

13. The networked computer of claim 11 , wherein determining the one

Assignees

• Brighterion Inc

Inventors

• Adjaoute Akli

Classifications

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title