User behavior anomaly detection-sensors

Patent metadata

Field	Value
Publication number	US-12450341-B2
Application number	US-202217804835-A
Country	US
Kind code	B2
Filing date	May 31, 2022
Priority date	May 31, 2022
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

A system to optimize required resources at an endpoint needed to monitor a user behavior for abnormalities with the endpoint includes a processor processing a plurality of agents running at the endpoint to intercept network traffic metrics, intercept device access metrics, intercept app-specific user-mode metrics, parse intercepted data, and submit the intercepted data to a backend component at a server to collect the intercepted data from the endpoint, predict deviation from a normal profile, in which the backend component assesses available characteristics of a particular endpoint, calculates an endpoint user profile, calculates a degree of variance (DoV) between the user profile and the normal profile, compares the calculated DoV to a predetermined Variance Threshold (VT), and predicts, based on machine learning algorithms, a movement of a trend of the DoV within the VT, creates an adjusted metrics list, and distributes adjusted metrics to a related endpoint.

First claim

The invention claimed is:

1. A method for optimizing computing resources used to monitor a user at an endpoint in a computing system for abnormal behavior, the method comprising:
installing a backend software component at a server and under microprocessor control, and an agent at the endpoint;
collecting a plurality of historical metrics from the endpoint, wherein the historical metrics are related to binary scripts executed by an application installed at the endpoint and;
building a baseline profile for the binary scripts of the application executed at the endpoint based on the plurality of historical metrics collected from the endpoint;
intercepting, by the agent at the endpoint, first data of the user, wherein the data comprises a set of first metrics comprising all binary scripts executed by the application at the endpoint during a first time period;
parsing, by the agent at the endpoint, the intercepted first data and storing the intercepted first data in a structured format;
submitting the stored intercepted first data to the backend software component at the server;
building, by the backend software component at the server, a profile for the user based on binary scripts executed by the application at the endpoint from the intercepted first data;
intercepting, by the agent, second data of the user, wherein the second intercepted data comprises the set of first metrics related to binary scripts executed by the application at the endpoint while under the user's control during a second time period;
predicting, by the backend software component at the server, a deviation trend in the second intercepted data of the user, wherein the trend is calculated as the variation in the second intercepted data from the profile for the user either toward or away from the baseline profile for the binary scripts of the application executed at the endpoint;
creating, by the backend software component at the server, second set of metrics comprising a reduced set of binary scripts of the application when the predicted deviation trend from the profile for the user is toward the baseline profile above a predetermined threshold;
distributing the second set of metrics to the agent;
intercepting, by the agent at the endpoint, third data of the user, wherein the third intercepted data comprises reduced data corresponding to the reduced set of binary scripts of the application.

2. The method of claim 1 , wherein the step of intercepting first data of the user further comprises intercepting network traffic metrics.

3. The method of claim 1 , wherein the step of intercepting first data of the user further comprises intercepting device access metrics.

4. The method of claim 1 , wherein the second set of metrics comprises an increased set of binary scripts of the application when the predicted deviation is moving away from the baseline profile above a predetermined threshold and the third intercepted data comprises increased data corresponding to the increased set of binary scripts of the application.

5. The method of claim 1 , wherein the step of intercepting first data of the user further comprises intercepting application behavior of a plurality of applications running at the endpoint.

6. The method of claim 1 , wherein the step of predicting further comprises predicting a deviation from the baseline profile by:
calculating a degree of variance (DoV) between the user profile and the baseline profile;
comparing the calculated DoV to a predetermined Variance Threshold (VT); and
predicting, based on machine learning algorithms, a movement of a trend of the DoV within the VT toward or away from the baseline profile.

7. A method for optimizing computing resources used to monitor a user at an endpoint in a computing system for abnormal behavior, the method comprising:
installing a backend software component at a server and an agent at the endpoint;
providing a baseline profile to the backend software component at the server, wherein the baseline profile comprises historical metrics related to binary scripts executed by an application installed at the endpoint;
intercepting, by the agent, data of the user, wherein the data of the user comprises a set of metrics comprising binary scripts executed by the application at the endpoint during a first period of time;
parsing, by the agent at the endpoint, the intercepted data of the user and storing the intercepted data of the user in a structured format;
submitting the stored intercepted data of the user to the backend software component at the server;
predicting, by the backend software component at the server, a deviation in the intercepted data of the user from the baseline profile;
creating, by the backend software component at the server, a reduced set of metrics comprising a reduced set of binary scripts of the application when the deviation from the intercepted data toward the baseline profile is above a predetermined threshold; and
distributing the reduced set of metrics list to the agent at the endpoint.

8. The method of claim 7 , wherein the step of intercepting further comprises intercepting network traffic metrics.

9. The method of claim 7 , wherein the step of intercepting further comprises intercepting device access metrics.

10. The method of claim 7 , further comprising creating, by the backend software component at the server, an increased set of metrics comprising an increased set of binary scripts of the application when the predicted deviation is moving away from the baseline profile above a predetermined threshold and the third intercepted data comprises increased data corresponding to the increased set of binary scripts of the application.

11. The method of claim 7 , wherein the step of intercepting further comprises intercepting application behavior.

12. The method of claim 7 , wherein the step of predicting further comprises predicting a deviation from the baseline profile by:
calculating a degree of variance (DoV) between the user profile and the baseline profile;
comparing the calculated DoV to a predetermined Variance Threshold (VT); and
predicting, based on machine learning algorithms, a movement of a trend of the DoV within the VT toward or away from the baseline profile.

13. A system for optimizing computing resources used to monitor a user at an endpoint in a computing system for abnormal behavior, the system comprising:
a processor coupled to a memory storing instructions;
a backend software component, installed at a server, under control of the processor and in communication with the endpoint;
a plurality of agents running at the endpoint configured to intercept user data, the user data comprising a set of metrics related to binary scripts executed by an application installed at the endpoint;
wherein the plurality of agents are further configured to parse the intercepted user data; and
submit the intercepted user data to the backend software component in a structured format, wherein the backend software component is configured to collect the intercepted user data from the plurality of agents; and is further configured to calculate deviation from or toward a baseline profile for the endpoint, create an adjusted set of metrics, and distribute the adjusted set of metrics comprising binary scripts executed by the application at the endpoint,
wherein the adjusted set of metrics comprises decreased metrics when the deviation toward the baseline is above a predetermined threshold.

14. The system of claim 13 , wherein the plurality of agents is further configured to intercept network traffic metrics or device access metrics.

15. The system of

Assignees

• Acronis Int Gmbh

Inventors

• Berko Nickolay
• Bell Serg
• Protasov Stanislav

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title