`1/17
`
`J
`
`Service
`Provider
`Server
`
`142
`
`100
`
`Network
`
`Risk-Adaptive
`Behavior System
`
`Network
`Port
`
`Other
`Subsystems
`
`14
`Operating System —
`
`140 11
`
`102
`
`104
`
`106
`
`Storage
`System
`
`Figure 1
`
`
`
`FPO0005
`2/17
`
`
`
`Network
`
`
`Communications/
`Cloud
`Services Architecture
`Services
`
`140
`
`204
`206
`
`
`
` Edge Device 202
`Pluggable
`Capabilities
`212
`
`
`
`
`Capability ‘n’
`Capability ‘3’
`Capability ‘2’
`Capability ‘1’
`(e.g., AS Needed)
`(Data Sanitization)
`(Web Protection)
`(Basic Firewall)
`214
`216
`218
`220
`a ]
`
`
`
`Traffic Router 210
`
` Pluggable Hosting Framework 208
`
`
`
`
`FIGURE 2
`
`Low-Level
`Hooks
`
`Network
`140
`
`Unified Agent
`306
`Cloud
`Services
`206
`
`
`
`
`
`
`Protected Endpoint
`302
`
`Pluggable
`Feature
`Packs
`308
`
`Analytics,
`Etc.
`310
`
`Thin Hypervisor
`314
`
`FIGURE 3
`
`
`
`FPO0005
`3/17
`
`Enrichment
`
`Streaming
`Analytics
`406
`
`Event
`Collector
`402
`
`Logging
`And Reporting
`Front-End
`410
`
`404
`
`
` Data
`Store ‘1!
`414
`
`Storage
`API
`412
`
`On-Demand
`Analytics
`408
` Data
`
`Store ‘n
`
`
`
`
`
`416
`
`FIGURE 4
`
`Network
`140
`
`User
`Behavior
`Information
`
`Unified
`
` Enriched
`
`Edge
`
`Cloud
`Services
`
`206
`
`
`Device
`
`
`Security
`Analytics
`312
`
`FIGURE 5
`
`
`
`FPO0005
`417
`
`ejeq
`
`sao]
`
`959
`
`SODIAIOS
`
`8S9
`
`
`KoljogJoIneyeg
`aandepy-ysiy—Alnoes
`
`coeaandepy-4st4
`—
`
`CSS
`
`ajOyJas
`
`Solploe4
`
`SHB}ES
`
`Sd9
`
`8e9
`
`uole907
`
`BIEge9
`
`
`
`vO9SUdyOL
`
`XQ809
`
`soUJaWolg
`
`909
`
`sa0JnoseyUOHHeoUSYINYoOyeJasn
`0S9sJojoe4;:
`
`
`
`
`
`
`
`SUO!ORJ9}U|SUO!JORJO}U|SUOIJORJI}U|rasp
`
`
`soinosey/Jesy)WOMISN/JESNYAN30csolAaqHesnMy,
`EulapayiunMd/dl
`YIOMIONjuaby
`
`avo-
`
`WOMION
`
`
`
`jJBW9}u|Z09
`
`siojoe4uOleoyNUap|
`
`sons|euyiS—
`Ayunoes9c9
`
`
`a5“>JasnjiesnlOYNn
`
`
`
`
`
`anydepy-1slyg,1aspsloped9029‘chJowmeuaguole907Jas
`
`
`
`Asoysoday9JUNsomesJasn
`
`
`
`Wa}sh029
`
`tolABUSEJojessiulupyofAguanbas/auul1/ayeq
`
`|999819
`
`
`
`
`SbtsuONOBJaIU]JASN
`
`
`
`slybryssaooyasp
`
`O19
`
`
`
`
`
`—veoLFOOL099
`
`
`
`
`
`
`
`
`
`
`
`FPO0005
`5/17
`
`Start Risk-Adaptive
`Behavior Policy Generation
`£02
`
`£06
`
`Determine Requirements
`For Risk-Adaptive
`Behavior Policy
`£04
`
`Identify Known
`Available Risk-Adaptive
`Behavior Factors
`
`Generate Unpopulated
`Risk-Adaptive Behavior
`Policy
`[24
`
`
`
`Select Pre-existing
`Risk-Adaptive Behavior
`Policy
`110
`
`
`
`
`Use
`
`Pre-existing
`Yes
`
`
`Policy As Basis For
`
`
`New Policy?
`
`
`£08
`
`No
`
`
`
`
`Delete
`Select
`Any Risk-Adaptive
`Risk-Adaptive Behavior
`Behavior Factors?
`Factors To Delete
`712
`714
`
`
`
`Delete Selected
`Risk-Adaptive Behavior
`Factors
`
`£16
`
`FIGURE 7a
`
`
`
`FPO0005
`6/17
`
`
`
`
`Modify
`Select
`Any Risk-Adaptive
`Risk-Adaptive Behavior
`Behavior Factors?
`Factors To Modify
`18
`£20
`
`
`
`Modify Selected
`Risk-Adaptive Behavior
`Factors
`
`£22
`
`
`
`
`Add
`Use Requirements
`Define Parameters For
`A Risk-Adaptive
`To Select Risk-Adaptive
`Anomalous Risk-Adaptive
`
`
`Behavior Factor?
`A Behavior Factor
`Behavior Factor
`
`128
`730
`
`
`
`
`
`Add
`Append Parameterized
`Another
`Risk-Adaptive Behavior
`
`
`Risk-Adaptive Behavior
`Factor To Risk-Adaptive
`Factor?
`Behavior Policy
`
`£34
`£32
`
`FIGURE 7b
`
`
`
`FPO0005
`TAT
`
`
`
`Configure Parameterized
`Is
`Risk-Adaptive Behavior
`
`Policy Specific
`
`Factors In Risk-Adaptive
`To Individual Or Class
`
`
`Behavior Policy
`Of User?
`744
`
`£36
`
`Select Individual
`Or Class Of User
`
`£38
`
`Configure
`Risk-Adaptive Behavior
`Factors In Risk-Adaptive
`Behavior Policy For
`Selected Individual
`Or Class Of User
`
`£40
`
`
`
`Assign Configured
`Risk-Adaptive Behavior
`Policy To Selected
`Individual Or Class
`Of User
`
`£42
`
`Store Risk-Adaptive
`Behavior Policy For Use
`In Risk-Adaptive Behavior
`Monitoring Operations
`£46
`
`FIGURE 7c
`
`No
`
`
`
`End
`
`
`Risk-Adaptive
`
`
`Behavior Policy
`
`
`Generation?
`
`
`£48
`
`Yes
`
`End Risk-Adaptive
`Behavior Policy Generation
`
`£50
`
`
`
`Start Risk-Adaptive
`Behavior Operations
`802
`
` 804
`
`Perform
`User Authentication
`Operations
`
`FPO0005
`8/17
`
`
`
`
`Associated
`Retrieve User's
`Risk-Adaptive
`Associated Risk-Adaptive
`
`
`
`
`Behavior Policies?
`Behavior Policies
`806
`808
`
`
`
`
`
`Identify Applicable
`Monitor
`
`Risk-Adaptive Behavior
`User’s Current
`Policies
`User Behavior
`
`812
`810
`
`
`
`Process Current
`
`
`User Behavior With
`Any
`
`
`Applicable Risk-Adaptive
`Applicable
`
`
`Behavior Policies To
`Risk-Adaptive Behavior
`
`
`Determine Risk-Adaptive
`Policies?
`
`Behavior Response
`814
`
`816
`~~
`
`
`
`
`Does
`Enact Appropriate
`
`
`Response
`
`
`Risk-Adaptive Behavior
`Indicate Acceptable
`
`
`Response
`User Behavior?
`818
`
`820
`
`
`
`Determine Whether User
`Perform Unacceptable,
`Behavior Is Unacceptable,
`Anomalous, Or Malicious
`Anomalous Or Malicious
`User Behavior Notification
`Operations
`And Mark Accordingly
`824
`822
`
`End
`
`Risk-Adaptive
`
`Behavior Operations?
`
`826
`
`
`
`
`
`
`
`Yes
`
`FIGURE 8
`
`End Risk-Adaptive
`
`BehaviorCperations
`
`
`
`FPO0005
`9/17
`
`Typical Risk
`906 Assessment
`
`
`
`Low Risk 908
`
`
`
`High Risk 912
`
`Moderate 910
`
`Adaptive High
`
`
`914 Risk Assessment
`
`904
` Known
`922 Risk Assessment
`
`Bad Behavior
`
`Adaptive Low
`
`1014 Denied Request
`
`File
`Source
`
`
`
`
`
`
`_.
`1016 Conditional
`
`File
`Destination
`
`1010
`
`Responses
`
`MAF
`LY 4002 Risk-Adaptive
`Behavior
`Assessment
`
`FIGURE 10
`
`
`
`FPO0005
`10/17
`
`
`
`Trending
`
`
`Incidence ‘y
`1112
`
`Incidence ‘x
`1108
`
`
`
`1102
`Suspicious
`User Behavior
`
`
`
`
`
` 1110 1114 1104
`
`Time
`Time ‘a’
`Time ‘b’
`
`FIGURE 11
`
`
`
`Operational
`1210 Overhead
`
`System
`Performance
`
`1212
`
`
`
`
`
`
`
`System
`Utilization
`
`1202
`
` 1206 1204 1208
`
`
`Normal
`Behavior
`Risk-Adaptive
`Behavior
`Monitoring
`Behavior
`Monitoring
`Method
`Monitoring
`
`FIGURE 12
`
`
`
`Ids
`o2e1POSTwajskguoneosngo
`
`
`Salol|OdIdSO/|
`cleleAndepy-ysly
`
`
`
`
`vLelLJoyeosnjqoJoya}eqJoya]0D
`
`
`juswebeuel/|(‘019‘uleyoyoo|q)
`
`JBUOIPUODjuaplAg-sedue|
`
`ssa00yIdS‘suoijeolddy
`QLELglel
`SelCScOSL
`
`AyinoasYWOMISN/ESN
`JOESIUILUPYSUONOBI9}U]
`Aynoesanndepyisd_Jspon”
`
`899JeuJS}U|
`sonsjeuyBdIAIASJOIAeUuag
`
`
`YOMION—__T~
`
`
`JojeosnigqoJoyoa1eqJOya|0D
`VIELCLELOLSL
`
`
`
`
`SOETyokedsinjeoyajqebBhnidIdS
`
`EbFUND
`
`jeusaxy
`
`swa}skS
`
`Ose!
`
`jeulayxy
`
`WOMION
`
`
`wa}sks
`
`SbtJoMeysg
`
`rAWA
`
`obpa
`
`cv"O
`
`FPO0005
`11/17
`
`poyeosnjqo
`
`IdS
`
`Ids
`
`Ajoysoday
`
`
`
`AallOdIdSpuy
`
`IdSpayeosnyqo
`
`adilAeq/Jasn
`
`SUONOBJO}U]
`
`O/l
`
`lesondjeuy
`
`
`
`O¢juabypayiun
`
`
`
`
`
`FPO0005
`12/17
`
`Start SPI
`Policy Generation
`1402
`
`Determine Requirements
`For SPI Obfuscation And
`Conditional Access Policy
`1404
`
`1426
`
`Identify Known User
`Authentication Factors,
`Identification Factors,
`And Risk-Adaptive
`Behavior Factors That
`May Represent SPI
`1406
`
`Identify Where SPI
`User Factors May Be
`Collected, And How
`
`1408
`
`Select
`Pre-existing
`SPI Policy
`1412
`
`
`
`
`Use
`
`Pre-existing
`Yes
`
`
`Policy As Basis For
`
`
`New Policy?
`
`1410
`
`
`No
`
`Generate
`Unpopulated
`SPI Policy
`
`
`
`
`Delete
`Select
`Any SPI User
`SPI User Factors
`Factors?
`To Delete
`1414
`1416
`
`
`
`Delete Selected
`SPI User Factors
`1418
`
`FIGURE 14a
`
`
`
`FPO0005
`13/17
`
`
`
`Modify
`Select SPI User
`
`Obfuscation
`Factors To Modify
`
`For Any SPI User
`Obfuscation Parameters
`Factors?
`1422
`1420
`S”
`
`
`
`Modify Obfuscation
`Parameters For Selected
`SPI User Factors
`1424
`
`
`
`
`Add
`:
`Define Obfuscation
`Use Requirements To
`Parameters For Selected
`An SPI User
`Factor?
`Select SPI User Factor
`SPI User Factor
`1428
`1430
`1432
`
`
`
`
`
`Append
`Add
`
`Another
`Parameterized SPI User
`SPI User
`Factor To SPI Polic
`
`Factor?
`ny
`
`1436
`1434
`
`
`FIGURE 14b
`
`
`
`FPO0005
`14/17
`
`
`Configure
`
`
`iis
`™
`Parameterized
`
`Policy Specific
`SPI User Factors And
`
`
`To Individual Or Class
`
`
`Conditional Access Rights
`eee
`In SPI Policy
`1438
`1446
`
`Select Individual
`Or Class Of User
`1440
`
`Configure
`Parameterized
`SPI User Factors And
`Conditional Access Rights
`For Selected Individual
`Or Class Of User
`1442
`
`
`
`Assign Configured
`SPI Policy To Selected
`Individual Or Class
`Of User
`1444
`
`Store SPI Policy
`For Use In Risk-Adaptive
`Behavior SPI Obfuscation
`And Conditional Access
`Operations
`1448
`
`No
`
`
`
`
` End
`SPI Policy
`Generation?
`
`1450
`
`Yes
`
`End SPI
`Policy Generation
`
`1452
`
`FIGURE 14c
`
`
`
`Start SPI
`Obfuscation Operations
`1502
`
`
`
`Perform
`User Authentication
`Operations
`1504
`
`FPO0005
`15/17
`
`
`Retrieve
`
`
`Associated
`User's Associated SPI
`SPI Policies?
`Policies
`
`1506
`1508
`
`
` Monitor
`Identify Applicable
`User’s Current
`
`
`SPI Policies
`User Behavior
`1512
`1510
`
`
`
`
`
`Process Current User
`
`
`Behavior With Applicable
`Any
`SPI Policies To Determine
`Applicable
`
`
`Applicable Risk-Adaptive
`SPI Policies?
`SPI Obfuscation Response
`1514
`1516
`
`Enact Appropriate
`
`
`Risk-Adaptive Behavior
`SPI InRepository Or
`
`
`SPI Obfuscation Response
`Obfuscated SPI?
`1518
`1520
`
`Store Obfuscated
`SPI In Repository Of
`Obfuscated SPI
`1522
` End
`
`SPI Obfuscation
`
`
`
`Operations?
`1524
`
`
`Yes
`
`FIGURE 15
`
`End SPI
`
`Opuses
`
`
`
`Process Request And
`Associated Policies To
`Determine Required
`Authorization
`
`1608
`
`
`
`Does
`
`Requestor
`
`
`Have Required
`
`
`Authorization?
`
`
`
`1610
`NU”
`Yes
`
`No
`
`FPO0005
`16/17
`
`Start Conditional
`SPI Access Operations
`1602
`
`
`
`Receive Request For
`Conditional SPI Access
`1604
`
`Retrieve SPI
`Policies Associated With
`Requested SPI
`1606
`
`
` Request
`
`
`
`
`
`Additional
`Authorization?
`1612
`
`Yes
`
`No
`
`Process Request
`And SPI Policies To
`Determine Required
`Additional Authorization
`1614
`
`
`
`Request
`Additional Authorization
`1616
`
`FIGURE 16a
`
`
`
`FPO0005
`17/17
`
`
`
` Additional
`SPI To Recover SPI In
`Authorization
`
`Its Original Form
`Granted?
`1622
`1620
`
`Provide Converted
`SPI To Requestor
`1624
`
`Perform Risk-Adaptive
`Behavior Operations
`To Decline Conditional
`SPI Access Request
`1618
`
`Perform
`Risk-Adaptive Behavior
`Operations Related To
`Provision Of Recovered
`SPI To Requestor
`1626
`
` Process Obfuscated
`
`Generate Record Of
`Conditional SPI Access
`Request And Associated
`Risk-Adaptive Behavior
`Operations
`1628
`
`Store Record Of
`Conditional SPI Access
`Request And Associated
`Risk-Adaptive Behavior
`Operations
`1630
`
`No
`
`
`End
`Conditional SPI
`
`
`Access Operations?
`
`
`
`1632
`
`Yes
`
`End Conditional
`SPI Access Operations
`
`1634
`
`FIGURE 16b
`
`
![](/site_media/img/document_icon.png)
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ ChargeStill Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
![](/site_media/img/error_icon.png)
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
![](/site_media/img/error_icon.png)
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
![](/site_media/img/error_icon.png)
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
![](/site_media/img/document_icon.png)
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
![](/site_media/img/document_icon.png)
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
![](/site_media/img/error_icon.png)
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site