	US 11,750,631 B2
	System and method for comprehensive data loss prevention and compliance management
Jason Crabtree, Vienna, VA (US); and Andrew Sellers, Monument, CO (US)
Assigned to QOMPLX, INC., Tysons, VA (US)
Filed by QOMPLX, Inc., Tysons, VA (US)
Filed on Jan. 31, 2022, as Appl. No. 17/589,811.
Application 17/589,811 is a continuation of application No. 16/896,764, filed on Jun. 9, 2020, granted, now 11,297,088.
Application 16/896,764 is a continuation of application No. 16/191,054, filed on Nov. 14, 2018, granted, now 10,681,074, issued on Jun. 9, 2020.
Application 16/191,054 is a continuation in part of application No. 15/655,113, filed on Jul. 20, 2017, granted, now 10,735,456, issued on Aug. 4, 2020.
Application 15/655,113 is a continuation in part of application No. 15/616,427, filed on Jun. 7, 2017, abandoned.
Application 15/616,427 is a continuation in part of application No. 14/925,974, filed on Oct. 28, 2015, abandoned.
Application 15/655,113 is a continuation in part of application No. 15/237,625, filed on Aug. 15, 2016, granted, now 10,248,910, issued on Apr. 2, 2019.
Application 15/237,625 is a continuation in part of application No. 15/206,195, filed on Jul. 8, 2016, abandoned.
Application 15/206,195 is a continuation in part of application No. 15/186,453, filed on Jun. 18, 2016, abandoned.
Application 15/186,453 is a continuation in part of application No. 15/166,158, filed on May 26, 2016, abandoned.
Application 15/166,158 is a continuation in part of application No. 15/141,752, filed on Apr. 28, 2016, granted, now 10,860,962, issued on Dec. 8, 2020.
Application 15/141,752 is a continuation in part of application No. 15/091,563, filed on Apr. 5, 2016, granted, now 10,204,147, issued on Feb. 12, 2019.
Application 15/091,563 is a continuation in part of application No. 14/986,536, filed on Dec. 31, 2015, granted, now 10,210,255, issued on Feb. 19, 2019.
Application 14/986,536 is a continuation in part of application No. 14/925,974, filed on Oct. 28, 2015, abandoned.
Prior Publication US 2022/0263845 A1, Aug. 18, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 43/08 (2022.01); H04L 43/045 (2022.01); G06F 21/57 (2013.01)

CPC H04L 63/1425 (2013.01) [H04L 43/045 (2013.01); H04L 43/08 (2013.01); H04L 63/1433 (2013.01); G06F 21/577 (2013.01)]

13 Claims

1. A system for comprehensive data loss prevention and compliance management, comprising:

a computing device comprising a processor and a memory;

an observation and state estimation module comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:

monitor a plurality of connected resources on a network; and

produce a cyber-physical graph representing the plurality of connected resources, wherein:

the connected resources comprise one or more of people, devices, systems, and organizations within the network;

the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node; and

the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device;

an activity monitoring engine comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:

generate expected behavior data of the connected resources within the network by applying a behavioral model to each node of the cyber-physical graph;

generate actual behavior data of the connected resources within the network from time-series data comprising a record of network events and the respective times at which each network event occurred;

detect deviations of the actual behavior data from the expected behavior data by comparing the expected behavior data properties of each node with the actual behavior properties of that node; and

when deviations are detected, send information about the deviation to a risk analysis and scoring engine; and

the risk analysis and scoring engine comprising a third plurality of programming instructions stored in the memory and operating on the processor, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:

receive deviation information from the activity monitoring engine;

analyze the severity of a threat posed by the deviation using at least one analysis algorithm; and

generate a risk score based on a plurality of factors which indicate the severity of the threat.