Behavioral modeling for dynamic security control applications

Patent metadata

Field	Value
Publication number	US-12470498-B2
Application number	US-202318374375-A
Country	US
Kind code	B2
Filing date	Sep 28, 2023
Priority date	Sep 28, 2023
Publication date	Nov 11, 2025
Grant date	Nov 11, 2025

Abstract

Baseline data characterizing actions of one or more computing resources associated with one or more entities is received. One or more functional roles performed by the one or more computing resources are identified using a machine learning model, wherein the baseline data is provided as input to the machine learning model. A security-related control to be applied to the one or more computing resources is identified based on the one or more functional roles. The security-related control is applied to the one or more computing resources.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a processing device, baseline data characterizing actions of one or more computing resources associated with one or more entities; identifying, using a machine learning model, one or more functional roles performed by the one or more computing resources, wherein the baseline data is provided as input to the machine learning model; identifying, based on the one or more functional roles, a security-related control to be applied to the one or more computing resources; applying the security-related control to the one or more computing resources; monitoring one or more actions of the one or more computing resources with the security-related control applied thereon; and responsive to detecting that an action of the one or more actions is incompatible with the one or more functional roles performed by the one or more computing resources, causing a remedial action to be performed with respect to the one or more computing resources.

2 . The method of claim 1 , wherein the machine learning model is trained to predict, based on given data associated with previous actions of the one or more computing resources, the one or more functional roles performed by the one or more computing resources.

3 . The method of claim 1 , wherein the baseline data characterizing the actions of the one or more computing resources is based on at least one of network traffic originated by the one or more computing resources, or network traffic received by the one or more computing resources.

4 . The method of claim 1 , wherein identifying, based on the one or more functional roles, the security-related control to be applied to the one or more computing resources comprises:
identifying, for the one or more functional roles, one or more associated security-related rules; and determining, according to the one or more associated security-related rules, the security-related control to be applied to the one or more computing resources.

5 . The method of claim 4 , wherein the one or more associated security-related rules is specified by a user associated with the one or more entities.

6 . The method of claim 1 , wherein identifying, based on the one or more functional roles, the security-related control to be applied to the one or more computing resources comprises:
identifying, using a second machine learning model, the security-related control to be applied to the one or more computing resources, wherein the one or more functional roles and the baseline data characterizing the actions of the one or more computing resources are provided as input to the second machine learning model.

7 . The method of claim 1 , wherein causing the remedial action to be performed with respect to the one or more computing resources further comprises:
performing the remedial action to the one or more computing resources.

8 . The method of claim 7 , wherein detecting that the action of the one or more actions is incompatible with the one or more functional roles performed by the one or more computing resources comprises determining that the action is not included in a set of actions associated with the one or more functional roles, wherein the set of actions associated with the one or more functional roles is derived from the baseline data characterizing the actions of the one or more computing resources.

9 . The method of claim 7 , wherein detecting that the action of the one or more actions is incompatible with the one or more functional roles performed by the one or more computing resources comprises determining that the action does not satisfy one or more compliance requirements associated with the one or more functional roles.

10 . A system comprising:
a memory device; and a processing device coupled to the memory device, the processing device to perform operations comprising: receiving, by a processing device, baseline data characterizing actions of one or more computing resources associated with one or more entities; identifying, using a machine learning model, one or more functional roles performed by the one or more computing resources, wherein the baseline data is provided as input to the machine learning model; identifying, based on the one or more functional roles, a security-related control to be applied to the one or more computing resources; applying the security-related control to the one or more computing resources; monitoring one or more actions of the one or more computing resources with the security-related control applied thereon; and responsive to detecting that an action of the one or more actions is incompatible with the one or more functional roles performed by the one or more computing resources, causing a remedial action to be performed with respect to the one or more computing resources.

11 . The system of claim 10 , wherein the machine learning model is trained to predict, based on given data associated with previous actions of the one or more computing resources, the one or more functional roles performed by the one or more computing resources.

12 . The system of claim 10 , wherein the baseline data characterizing the actions of the one or more computing resources is based on at least one of network traffic originated by the one or more computing resources, or network traffic received by the one or more computing resources.

13 . The system of claim 10 , wherein to identify, based on the one or more functional roles, the security-related control to be applied to the one or more computing resources, the processing device is to perform operations comprising:
identifying, for the one or more functional roles, one or more associated security-related rules; and determining, according to the one or more associated security-related rules, the security-related control to be applied to the one or more computing resources.

14 . The system of claim 10 , wherein to identify, based on the one or more functional roles, the security-related control to be applied to the one or more computing resources, the processing device is to perform operations comprising:
identifying, using a second machine learning model, the security-related control to be applied to the one or more computing resources, wherein the one or more functional roles and the baseline data characterizing the actions of the one or more computing resources are provided as input to the second machine learning model.

15 . The system of claim 10 , wherein causing the remedial action to be performed with respect to the one or more computing resources further comprises:
performing the remedial action to the one or more computing resources.

16 . A non-transitory computer-readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
receiving, by a processing device, baseline data characterizing actions of one or more computing resources associated with one or more entities; identifying, using a machine learning model, one or more functional roles performed by the one or more computing resources, wherein the baseline data is provided as input to the machine learning model; identifying, based on the one or more functional roles, a security-related control to be applied to the one or more computing resources; applying the security-related control to the one or more computing resources; monitoring one or more actions of the one or more computing resources with the security-related control applied thereon; and responsive to detecting that an action of the one or more actions is incompatible

Assignees

• Google Llc

Inventors

• Schneider Christopher
• Jiang Bessie S
• Sablotny Martin
• Watson J Nicolas

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L47/801 Primary

  Real time traffic · CPC title