Reduction of data transmissions based on end-user context

Abstract

A computer-based method of reducing or limiting data transmissions from a computer to a remote network destination includes receiving an indication, at an agent on a computer, that a recent user activity has occurred at the computer. The indication typically includes data relevant to user context when the user activity occurred. The method further includes determining, with the agent, whether the data relevant to the user's context when the user activity occurred indicates that a change in user context relative to a user activity at the computer immediately prior to the recent user activity and conditioning a transmission of data relevant to the recent user activity from the computer to a remote network destination based on an outcome of the determination.

Description

FIELD OF THE INVENTION[0001]This disclosure relates to the field of reducing data transmissions, more particularly, relates to reducing data transmissions based on end-user context (e.g., at a network endpoint device).BACKGROUND[0002]Various computer-based systems exist that collect large amounts of data from multiple network-connected devices (e.g., network endpoint devices), with the collected data being transmitted across a network to some central location (e.g., a server) to be stored and / or analyzed. One example of this kind of system is an insider threat management system, such as the ObservelT ITM (insider threat management) system, available from Proofpoint, Inc., the applicant of this patent application. In general terms, an insider threat occurs when someone with authorized access to critical information or systems misuses that access—either purposefully or accidentally—resulting in data loss, legal liability, financial consequences, reputational damage, and / or other forms...

AI Technical Summary

Benefits of technology

[0006]In some implementations, one or more of the following advantages are present.

[0007]In the context of an insider threat management (ITM) system for example, where users' activities at endpoint devices are being monitored and tracked, the systems and techniques disclosed herein can reduce the amount of data transmitted from the endpoint devices to a central server for storage and / or processing considerably without impacting the efficacy of the ITM system in any meaningful manner. This enables the ITM system to perform in a highly effective manner without requiring large amounts of transmission bandwidth, processing capabilities, storage capabilities, etc. Moreover, these benefits can be achieved by implementing relatively simple algorithms that rely on relatively simple infrastructure, which are disclosed in detail herein. Additionally, given the relative simplicity involved, the cost associated with implementing these systems and techniques is low as well.

[0008]Moreover, certain cloud computing services, such as Amazon Web Services (AWS), provide on-demand cloud computing platforms and APIs to individuals, companies, and governments, on a metered pay-as-you-go basis. In implementations that utilize such services (e.g., as the remote processing server), implementations of the techniques and systems disclosed herein can provide significant cost savings in terms of payments due to the cloud computing service.

[0009]Additionally, in a typical implementation, the systems and techniques disclosed herein provide speed as data that is not needed may be simply dropped, which is much faster than systems that include extensive buffering and / or compression, which can take a long time to process and also can consume more resources.

Problems solved by technology

In general terms, an insider threat occurs when someone with authorized access to critical information or systems misuses that access—either purposefully or accidentally—resulting in data loss, legal liability, financial consequences, reputational damage, and / or other forms of harm to the person's employer.

Insider threats are on the rise and incidents thereof can be extremely costly, both in terms of reputation and finances, to the employer.

The cost and complexity of operating an effective ITM system (or other system where potentially large amounts of collected may be transmitted a network to some centralized storage or processing facility) can be high due, for example, to the infrastructure and functional demands associated with transmitting, storing and processing large amounts of data.

Images