Abstract: A computer method detect internal user behavior threats by recording user activity data at endpoints on a computer network associated with a tenant, generating a sampled activity matrix for each user, grouping users from the tenant into clusters based on similarity, assigning a user activity weight to each activity-set, creating a ranked list of the user activity-sets for all users within the tenant, computing a user behavior vector for each respective one of the users in the tenant, and comparing the user behavior vector for a particular one of the users in the tenant to other users in the tenant to determine whether the user behavior vector indicates that the user behavior deviates beyond a threshold amount from the other users in the tenant, and, if so, creating an internal user behavior threat notification that may, for example, prompt a real world response.

Abstract: A computer method includes recording user activity data at endpoints on a computer network, generating a sampled activity matrix representing occurrences of activity-sets performed by the user over multiple time windows, computing a user activity weight for each activity-set based on a variance over the time windows, computing a historical user activity score and a contextual user activity score, computing a user behavior vector and user behavior score, using the user behavior scores to detect a deviation beyond a threshold amount from a baseline behavior for the user; creating an internal user behavior threat notification in response to detecting a deviation beyond the threshold amount and, optionally, taking real world steps, as a human, to react to the threat notification.