US 12,267,350 B2
Systems, devices, and methods for observing and/or performing data access compliance to a computer network
Manjit Gombra Singh, Saratoga, CA (US); and Gouse Basha Mahammad, San Jose, CA (US)
Assigned to ARETE SECURITY INC., Las Vegas, NV (US)
Appl. No. 17/635,699
Filed by ARETE SECURITY INC., Las Vegas, NV (US)
PCT Filed Jan. 6, 2022, PCT No. PCT/US2022/011496
§ 371(c)(1), (2) Date Feb. 16, 2022,
PCT Pub. No. WO2022/150513, PCT Pub. Date Jul. 14, 2022.
Claims priority of provisional application 63/134,545, filed on Jan. 6, 2021.
Prior Publication US 2023/0027733 A1, Jan. 26, 2023
Int. Cl. H04L 9/40 (2022.01); G06F 21/55 (2013.01); G06F 21/57 (2013.01)
CPC H04L 63/1433 (2013.01) [G06F 21/554 (2013.01); G06F 21/577 (2013.01); H04L 63/0236 (2013.01); H04L 63/102 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01); G06F 2221/034 (2013.01)] 22 Claims
OG exemplary drawing
 
1. A computer-implemented system comprising at least one computing device comprising at least one processor and instructions executable by the at least one processor to cause the at least one processor to perform operations comprising:
a) detecting a data flow between a sequence of nodes of a computer network, the data flow associated with a user of the computer network;
b) determining a characteristic of the data flow and a characteristic of the user;
c) receiving a software application transaction log for the computer network;
d) sampling data from the software application transaction log to create a plurality of software application transaction log samples, wherein frequency of the sampling is automatically adjusted responsive to security risk associated with the data flow;
e) classifying the data flow responsive to the plurality of software application transaction log samples;
f) applying a machine learning algorithm configured to perform predictive path progress analysis in order to determine a level of security risk caused by the data flow responsive to the determined characteristic of the data flow, the determined characteristic of the user, and the classification of the data flow;
g) generating a plurality of transaction maps, each transaction map comprising icons representing the nodes of the computer network and the data flow between the nodes over a configurable time interval starting at a point in time and a visual indicator of the level of security risk;
h) comparing two or more of the transaction maps representing different time intervals, different points in time, or both to detect a change between the transaction maps; and
j) generating an alert notification of the change.