US 8,850,517 Runtime risk detection based on user, application, and system action sequence correlation
3 defendants · 3 suits · updated October 6, 2026
Also cited as U.S. Patent No. 8,850,517 · US8850517B2 · US 8,850,517 B2 · 8850517 · the '517 patent
Taasera Licensing LLC has filed 3 patent-infringement suits on US 8,850,517, "Runtime risk detection based on user, application, and system action sequence correlation" since May 11, 2026, 2 of them in the E.D. Tex., against 3 distinct defendants including Bitdefender Holding B.V., Arctic Wolf Networks, Inc. and Zoho Corporation Private Limited. The patent is held by TAASERA Inc and was granted September 30, 2014 on a priority date of January 15, 2013. Its abstract opens: "A method for assessing runtime risk for an application or device includes: storing, in a rules database, a plurality of rules, wherein each rule identifies an action sequence; storing, in a policy database, a plurality of assessment policies, wherein each…" The examiner cited 4 references during prosecution.
- Assignee
- TAASERA Inc
- Priority date
- January 15, 2013
- Granted
- September 30, 2014
- Expires
- January 15, 2033
- Status
- Active
- Claims
- 24 (2 independent)
- Inventors
- Srinivas Kumar
- Full text
- Google Patents
The suits
3 cases · E.D. Tex. (2) · W.D. Tex. (1)
| Filed | Defendant | Plaintiff | Court | Docket |
|---|---|---|---|---|
| 2026-05-11 | Bitdefender Holding B.V. | Taasera Licensing LLC | E.D. Tex. | 2:26-cv-00391 |
| 2026-08-19 | Arctic Wolf Networks, Inc. | Taasera Licensing LLC | W.D. Tex. | 7:26-cv-00330 |
| 2026-09-15 | Zoho Corporation Private Limited | Taasera Licensing LLC | E.D. Tex. | 2:26-cv-00824 |
Docket links open the public record on CourtListener. Filing dates are the complaint's.
Independent claims
What is actually asserted, verbatim.
1. A method for assessing runtime risk for an application program that executes on a device, comprising: storing, in a rules database, a plurality of rules, wherein each rule identifies an action sequence; storing, in a policy database, a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; identifying, using at least one assessment policy, a runtime risk for an application program that executes on a device, wherein the identified runtime risk indicates a risk or threat of the identified action sequence of the application; and identifying, by a runtime monitor including a processing device, a behavior score for the application program that executes on the device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action.
13. A system for assessing runtime risk for an application program that executes on a device, comprising: a rules database storing a plurality of rules, wherein each rule identifies an action sequence; a policy database storing a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; and a runtime monitor including a processing device identifying, using at least one assessment policy, a runtime risk for an application program that executes on a device, wherein the identified runtime risk indicates a risk or threat of the identified action sequence of the application, and identifying a behavior score for the application program that executes on the device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action.
Art before the examiner
9 references of record, 4 cited by the examiner.
Everything listed here was before the Office and is what a challenge must go beyond. Art the examiner never saw is where an invalidity search starts.
Examiner-cited
- US20110179477A1 — System including property-based weighted trust score application tokens for access control and related methods (Harris Corporation)
- US8091065B2 — Threat analysis and modeling during a software development lifecycle of a software application (Microsoft Corporation)
- US20120216244A1 — System and method for application attestation (Taasera, Inc.)
- US20130096980A1 — User-defined countermeasures (Mcafee, Inc.)
Applicant-cited and other (5)
- US20080288330A1 — System and method for user access risk scoring
- US20090292743A1 — Modeling user access to computer resources
- US20100125911A1 — Risk Scoring Based On Endpoint User Activities
- US20110131658A1 — Dynamic risk management
- US20110321175A1 — Monitoring and reporting of data access behavior of authorized database users
Classification
- G06F21/552primary — Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
- G06F21/577primary — Assessing vulnerabilities and evaluating computer system security
- G06F21/566 — Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
- H04L63/1416 — Event detection, e.g. attack signature detection
- H04L63/20 — Network architectures or network communication protocols for network security for managing network security; network security policies in general
Family
- US8850517B2 — B2 (2014)
- US20140201806A1 — A1 (2014)
- 7 foreign family members: IL238324A, JP2016503219A, WO2014113367A1, EP2946328A4, EP2946328A1, KR20150106889A, IL238324A0
Abstract
A method for assessing runtime risk for an application or device includes: storing, in a rules database, a plurality of rules, wherein each rule identifies an action sequence; storing, in a policy database, a plurality of assessment policies, wherein each assessment policy includes at least one rule of the plurality of rules; identifying, using at least one assessment policy, a runtime risk for an application or device, wherein the identified runtime risk identifies and predicts a specific type of threat; and identifying, by a processing device, a behavior score for the application or device based on the identified runtime risk, wherein the action sequence is a sequence of at least two performed actions, and each performed action is at least one of: a user action, an application action, and a system action.
Also asserted by Taasera Licensing LLC
- US 7,673,137 — System and method for the managed security control of processes on a computer system (3 defendants)
Named in one of these suits? A prior-art search is commissioned once and serves every defendant who shares it. The examiner's own search record is free on the tools page, and your first preliminary search is free — one claim, back within 24 hours — so you know whether there is art the Office never saw before anyone pays for more. Flat fees: $2,500$899 for the independent claims, $5,000$1,500 for every asserted claim.
This page is assembled from public records — federal court dockets and the patent's own file — and is updated as the case list changes. It states what the record shows and is not an opinion on the validity or infringement of any claim. Patent data via Google Patents; docket data via CourtListener.