Continuous Monitoring of Computer User and Computer Activities

摘要

Methods, systems, and computer programs are presented for securing a computer device. One method includes an operation for capturing interaction data for a user interfacing with the computer device, the interaction data including keyboard inputs and screen captures taken periodically. Further, the method includes operations for extracting semantic meaning of the interaction data, and generating a schema, based on the extracted semantic meaning, to create meaningful tags for the interaction data. The schema is analyzed based on a model in order to identify security threats, and an alarm is created when non-conforming behavior for the model is detected.

主权项

1. A method for securing a computer device, the method comprising:
capturing interaction data for a user interfacing with the computer device, the interaction data including keyboard inputs and screen captures taken periodically; extracting semantic meaning of the interaction data; generating a schema based on the extracted semantic meaning to create meaningful tags for the interaction data; analyzing the schema based on a model to identify security threats; and creating an alarm when non-conforming behavior for the model is detected, wherein operations of the method are executed by a processor.