The present disclosure relates generally to threat detection, and more particularly, to techniques for managing user access to resources in an enterprise environment. Some aspects are directed to the concept of managing access to a target resource based on a threat perception of a user that is calculated using a rule or policy based risk for the user and a behavior based risk for the user. Other aspects are directed to preventing insider attacks in a system based on a threat perception for each user logged into the system that is calculated using a rule or policy based risk for each user and a behavior based risk for each user. Yet other aspects are directed to providing a consolidated view of users, applications being accessed by users, and the threat perception, if any, generated for each of the users.

Mechanisms for anomaly detection and access management

A method, system and computer-usable medium for performing a security analysis operation within a security environment, comprising: monitoring electronically-observable user behavior about a particular entity; maintaining a state about the particular entity, the state representing a context of a particular event; converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior; generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior; and, analyzing the event using the state of the entity and the user behavior profile.

User profile definition and management

Embodiments of the invention are directed to a block chain architecture for optimized system performance and data storage. The invention provides a unique structure comprising levels of interconnected chains that allow for dynamically configurable connections to be formed between the various nodes. Connections between the different of the hierarchy create a continuum of regions allowing for data to be moved across the spiral construction over time depending on the requirements of the data. In this way, storage and management of the data is optimized through a trade-off of data requirements as data moves between different levels of the spiral architecture based on user preference and, ultimately, to permanent data retirement and long-term storage. Further, the present invention provides a method of decentralized data storage across optimized storage regions within the block chain hierarchy.

Blockchain architecture for optimizing system performance and data storage

Techniques for detecting conditions at a geographic location are described. The techniques receive plural information feeds, aggregate the information according commonality of information, and analyze information from the plural information feeds according to rules. Upon detection of a rule being triggered for a particular user, the techniques produce or spawn an instruction thread that is controlled or scheduled by an instruction thread scheduler and which filters the received information from the data feeds according to the triggered rule, (and user, user location) and produce an instruction thread that continually analyzes the filtered information from the data feeds to produce operational decisions based on the information and data feeds, detect during the continual analysis changes in risk of a threat according to the triggered rule, produce response messages based on the determined change, and send the generated response messages as an alert to a system/device of a user.

Dynamic Threat Analysis Engine for Mobile Users

A method, system and computer-usable medium for performing a psychological profile operation. The psychological profile operation includes: monitoring user interactions between a user and an information handling system; converting the user interactions into electronic information representing the user interactions; determining when the user interactions are associated with generation of an electronic communication; associating the user interactions with the electronic communication; and, generating a psychological profile of the user based upon the user interactions and the electronic communication, the psychological profile comprising information regarding a psychological state of the user.

Discerning psychological state from correlated user behavior and contextual information

Systems and methods for monitoring user authenticity according to user activities on an application server. A user-modeling process and a user-verification process are performed. In the user-modeling process, a user model is adapted session-by-session to user activities in which the user model includes a plurality of adaptive feature-specific user-behavior models. The user-verification process includes determining a plurality of feature-specific risk-score values, comparing the at least one of the adaptive feature-specific user-behavior models with a respective feature extracted from user activity in the user session on the application server, and determining a total risk-score value indicative of user authenticity by weighting and combining the plurality of feature-specific risk-score values. If the total risk-score value is greater than a given threshold, a corrective action is performed.

Joseph El Hayek

Papers

Monitoring user authenticity