Techniques and architectures for cross-organization threat detection
Assigneesalesforce.com, inc.
InventorsPing Yan, Huy Hang, Hui Fung Herman Kwong
Life of this patent
Estimating the term…
Abstract
Threat detection in a multi-organizational environment. Attribute data corresponding to accesses to a multi-organizational environment and entity data corresponding to accesses to the multi-organizational environment are maintained. A graph based on the attribute data and the entity data where graph edges represent a relationship between an attribute and an entity is generated. Subsequent access are compared to the graph to determine if the subsequent access corresponds to a new relationship. The subsequent access is allowed if the subsequent access does not correspond to a new relationship. The subsequent access further analyzed if the subsequent access corresponds to a new, unexpected relationship.
Claims18
A method comprising:
- maintaining, within a database, attribute data corresponding to accesses to a multi-organizational environment and entity data corresponding to accesses to the multi-organizational environment, wherein maintaining attribute data and entity data comprises at least maintaining a first database table with the attribute data corresponding to the accesses to the multi-organizational environment and maintaining a second database table with the entity data corresponding to the accesses to the multi-organizational environment;
- generating a graph based on the attribute data and the entity data where graph edges represent a relationship between an attribute and an entity;
- comparing a subsequent access to the multi-organizational environment to the graph to determine if the subsequent access corresponds to a new relationship;
- allowing the subsequent access if the subsequent access does not correspond to a new relationship;
- analyzing the subsequent access further if the subsequent access corresponds to a new, unexpected relationship.
A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to:
- maintain, within a database, attribute data corresponding to accesses to a multi-organizational environment and entity data corresponding to accesses to the multi-organizational environment, wherein maintaining attribute data and entity data comprises at least maintaining a first database table with the attribute data corresponding to the accesses to the multi-organizational environment and maintaining a second database table with the entity data corresponding to the accesses to the multi-organizational environment;
- generate a graph based on the attribute data and the entity data where graph edges represent a relationship between an attribute and an entity;
- compare a subsequent access to the multi-organizational environment to the graph to determine if the subsequent access corresponds to a new relationship;
- allow the subsequent access if the subsequent access does not correspond to a new relationship;
- analyze the subsequent access further if the subsequent access corresponds to a new, unexpected relationship.
A system comprising:
- a physical memory device;
- one or more hardware processors coupled with the physical memory device, the one or more processors configurable to maintain, within a database, attribute data corresponding to accesses to a multi-organizational environment and entity data corresponding to accesses to the multi-organizational environment, wherein maintaining attribute data and entity data comprises at least maintaining a first database table with the attribute data corresponding to the accesses to the multi-organizational environment and maintaining a second database table with the entity data corresponding to the accesses to the multi-organizational environment, to generate a graph based on the attribute data and the entity data where graph edges represent a relationship between an attribute and an entity, to compare a subsequent access to the multi-organizational environment to the graph to determine if the subsequent access corresponds to a new relationship, to allow the subsequent access if the subsequent access does not correspond to a new relationship, to analyze the subsequent access further if the subsequent access corresponds to a new, unexpected relationship.
Dependencies are inferred from the claim text.