Reduction of data transmissions based on end-user context

Abstract

A computer-based method of reducing or limiting data transmissions from a computer to a remote network destination includes receiving an indication, at an agent on a computer, that a recent user activity has occurred at the computer. The indication typically includes data relevant to user context when the user activity occurred. The method further includes determining, with the agent, whether the data relevant to the user's context when the user activity occurred indicates that a change in user context relative to a user activity at the computer immediately prior to the recent user activity and conditioning a transmission of data relevant to the recent user activity from the computer to a remote network destination based on an outcome of the determination.

Description

FIELD OF THE INVENTION[0001]This disclosure relates to the field of reducing data transmissions, more particularly, relates to reducing data transmissions based on end-user context (e.g., at a network endpoint device).BACKGROUND[0002]Various computer-based systems exist that collect large amounts of data from multiple network-connected devices (e.g., network endpoint devices), with the collected data being transmitted across a network to some central location (e.g., a server) to be stored and / or analyzed. One example of this kind of system is an insider threat management system, such as the ObservelT ITM (insider threat management) system, available from Proofpoint, Inc., the applicant of this patent application. In general terms, an insider threat occurs when someone with authorized access to critical information or systems misuses that access—either purposefully or accidentally—resulting in data loss, legal liability, financial consequences, reputational damage, and / or other forms...

AI Technical Summary

Benefits of technology

The patent text describes a system and technique for monitoring and managing user activities on endpoint devices to prevent insider threats. The system reduces the amount of data transmitted from endpoint devices to a central server, which helps the system perform effectively without needing large amounts of resources. The technique involves implementing relatively simple algorithms and infrastructure, which results in low cost and fast processing. Additionally, the system utilizes cloud computing services, which can provide significant cost savings. The technique also allows for faster data processing by simply dropping unnecessary data, which consumes fewer resources.

Problems solved by technology

In general terms, an insider threat occurs when someone with authorized access to critical information or systems misuses that access—either purposefully or accidentally—resulting in data loss, legal liability, financial consequences, reputational damage, and / or other forms of harm to the person's employer.

Insider threats are on the rise and incidents thereof can be extremely costly, both in terms of reputation and finances, to the employer.

The cost and complexity of operating an effective ITM system (or other system where potentially large amounts of collected may be transmitted a network to some centralized storage or processing facility) can be high due, for example, to the infrastructure and functional demands associated with transmitting, storing and processing large amounts of data.

Images