Forcepoint LLC

Raffael Marty

Nicolas Christian Fischbach

Alan Ross

Margaret Cunningham

Chad Anson

Matthew P Moynahan

Clifford Charles Wright

Ofir Arkin

Ruchika Pandey

Lawrence Bruce Huston, Iii

Assaf Almaz

A system, method, and computer-readable medium for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying a security related activity, the security related activity being of analytic utility; accessing an entity behavior profile based upon the security related activity, the entity behavior profile comprising a collection of information uniquely describing an identity and behavior of the entity; identifying a risk associated with the entity using a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of a human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a motivation for enacting an entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the entity behavior; and, performing a security operation based upon the risk associated with the entity, the security operation using the human-centric risk modeling framework and the entity behavior profile, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.

Using an entity behavior profile when performing human-centric risk modeling operations

A system, method, and computer-readable medium are disclosed for performing an entity behavior cataloging operation. The entity behavior cataloging operation includes: identifying a security related activity, the security related activity being based upon an observable from an electronic data source; analyzing the security related activity, the analyzing identifying an event of analytic utility associated with the security related activity; generating entity behavior catalog data based upon the event of analytic utility associated with the security related activity; and, storing the entity behavior catalog data within an entity behavior catalog, the entity behavior catalog providing an inventory of entity behaviors for use when performing a security operation.

Generating an entity behavior profile based upon sessions

Providing an endpoint with an entity behavior profile feature pack

A system, method, and computer-readable medium are disclosed for performing a human factors risk operation. The human factors risk operation includes: monitoring an entity, the monitoring observing an electronically-observable data source; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity, the security related activity being based upon the observable from the electronic data source; analyzing the security related activity, the analyzing the security related activity using a human factors framework; and, performing a human factors risk operation in response to the analyzing the security related activity.

Using content stored in an entity behavior catalog when performing a human factor risk operation

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring the plurality of electronically-observable actions via a protected endpoint; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; generating a representation of occurrences of a particular event from the plurality of events enacted by the entity; and performing an anomaly detection operation based upon the representation of occurrences of the particular event from the plurality of events enacted by the entity, the anomaly detection operation determining when the representation of occurrences of the particular event exceeds a predetermined threshold.

Using content stored in an entity behavior catalog in combination with an entity risk score

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying a security related activity of the entity, the security related activity being of analytic utility; accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and performing a security operation via a distributed security analytics environment, the security operation using entity behavior catalog data stored within the entity behavior catalog based upon the security related activity.

Using an entity behavior catalog when performing distributed security operations

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; deriving an observable based upon the monitoring of the electronically-observable data source; associating a human factor with the entity; identifying an event of analytic utility, the event of analytic utility being derived from the observable from the electronic data source; analyzing the event of analytic utility, the analyzing the event of analytic utility taking into account the human factor associated with the entity enacting the event of analytic utility; generating a risk score in response to the analyzing, the risk score taking into account the human factor associated with the entity; and, performing the security operation when the risk score meets a security risk parameter.

Using human factors when calculating a risk score

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying a security related activity of the entity, the security related activity being of analytic utility; accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and performing a security operation via a human-centric risk modeling framework, the security operation using entity behavior catalog data stored within the entity behavior catalog based upon the security related activity.

Using an entity behavior catalog when performing human-centric risk modeling operations

Entity behavior catalog architecture

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility; converting the security related activity to entity behavior catalog data, the entity behavior catalog providing an inventory of entity behaviors; and, accessing an entity behavior catalog based upon the entity behavior catalog data; and performing a security operation via a security system, the security operation using the entity behavior catalog data stored within the entity behavior catalog based upon the security related activity.

Using an entity behavior catalog when performing security operations

Entity behavior catalog access management

A system, method, and computer-readable medium are disclosed for performing an entity behavior cataloging operation. The entity behavior cataloging operation includes: identifying a plurality of security related activities, the plurality of security related activities being based upon observables from an electronic data source; analyzing the plurality of security related activities, the analyzing identifying a set of entity behaviors associated with the plurality of security related activities; and, performing a security operation via a security system, the security operation accessing entity behavior catalog data stored within an entity behavior catalog based upon the set of entity behaviors associated with the plurality of security related activities, the entity behavior catalog providing an inventory of entity behaviors for use when performing the security operation.

Representing sets of behaviors within an entity behavior catalog

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring a data entity, the monitoring observing at least one electronically-observable data source, the data entity exhibiting a data entity behavior; deriving an observable based upon the monitoring of the electronically-observable data source, the observable comprising event information corresponding to the data entity behavior; identifying an event of analytic utility, the event of analytic utility being derived from the observable from the electronic data source and the data entity behavior; analyzing the event of analytic utility, the analyzing the event of analytic utility using the data entity behavior; and, performing the security operation in response to the analyzing the event of analytic utility.

Analyzing an event enacted by a data entity when performing a security operation

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity to identify a behavior enacted by the entity, the monitoring observing at least one electronically-observable data source; deriving an observable based upon the behavior enacted by the entity; identifying an event of analytic utility, the event of analytic utility being derived from the observable from the electronic data source, the event of analytic utility comprising a behavior enacted by the entity; identifying an indicator of behavior related to the event of analytic utility, the indicator of behavior providing an abstracted description of an inferred intent associated with the behavior enacted by the entity; analyzing the event of analytic utility, the analyzing the event of analytic utility being based upon the indicator of behavior related to the event of analytic utility; and, performing a security operation based upon the inferred intent associated with the behavior enacted by the entity.

Using indicators of behavior when performing a security operation

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity to identify a behavior enacted by the entity, the monitoring observing at least one electronically-observable data source; deriving an observable based upon the behavior enacted by the entity, the observable comprising event information corresponding to a behavior enacted by the entity; identifying an indicator of behavior from the event information corresponding to the behavior enacted by the entity, the indicator of behavior providing an abstracted description of an inferred intent associated with the behavior enacted by the entity; associating a security persona with the entity based upon the indicator of behavior, the security persona comprising a group of entity behaviors associated with a particular security risk use case; and, performing the security operation, the security operation using the security persona associated with the entity.

Growing community of inventors

Austin, TX, United States of America

Raffael Marty