| CPC H04L 63/1425 (2013.01) [H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] | 14 Claims |

|
1. A computing system comprising:
at least one processor; and
at least one memory communicatively coupled to the at least one processor comprising computer-readable instructions that when executed by the at least one processor cause the computing system to implement a method of predicting a security risk by a user, the method comprising:
(i) receiving by the system a plurality of security policy rules, each rule comprising a condition indicative of a security violation and a corresponding remedial action to be applied to a user violating said condition;
(ii) receiving by the system a plurality of security events, each event comprising user profile data and event-related data;
(iii) applying a machine learning model trained on the user security events data to generate, for each user, a user specific profile associating that user with one or more risk probability for violating a security policy rule;
(iv) receiving a user profile and a security policy rule and based on the model determining a risk probability that the user will violate said security policy rule; and
(v) if said risk probability is above a predetermined value, recommending taking a preventive action with the user.
|