# US 10,482,268 B1 · Systems and methods for access management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,482,268 B1
- Document ID: US10482268B1
- Status: Granted
- Kind: B1
- Application number: 16/058,741
- Filed: 2018-08-08
- Granted: 2019-11-19
- Earliest claimed: 2018-08-08
- Applicants: Capital One Services, LLC
- Inventors: Jon Austin Osborne; Venkat Yashwanth Gunapati; Amanda Juliene Rice
- Web page: https://patentgrep.com/patent/US10482268B1

## CPC

- H04L 63/102: {Entity profiles}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06N 20/00: Machine learning
- H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems and methods are provided for access management using machine learning. An exemplary system may include at least one processor and a storage medium storing instructions that, when executed by the processor, cause the processor to perform operations. The operations may include obtaining user access information from an access directory and generating a network comprising nodes and edges. The nodes may include a first type of nodes representing users and a second type of nodes representing access rights. The edges may include a first type of edges indicating that users have access rights, and a second type of edges indicating degrees of similarity between two users. The operations may also include determining a group of nodes of the first type representing a community of users sharing a degree of commonality higher than a degree of commonality shared by other users outside the community.

## Claims

### Claim 1

A system for access management using machine learning, the system comprising:
at least one processor; and
a storage device storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
obtaining user information and access right information from an access directory and a database;
preprocessing the obtained user information and access right information into user access information, wherein the user access information comprises at least a combination of the user information and the access right information;
generating, based on the user access information, a network for community determination comprising nodes and edges, wherein:
the nodes comprise:
a first type of nodes representing users based on the preprocessed user access information; and
a second type of nodes representing access rights based on the preprocessed user access information; the edges comprise:
a first type of edges connecting nodes of the first type and nodes of the second type, the first type of edges comprising a confidence parameter indicating a likelihood that users represented by nodes of the first type have access rights represented by nodes of the second type, wherein the confidence parameter is computed based on a ratio between a number of users within a prior result of a community determination that have that access right and a total number of users within the prior result of the community determination; and
a second type of edges connecting two nodes of the first type and indicating degrees of similarity between two users represented by the two nodes, based on a set of access rights of the two users, wherein the degrees of similarity is based on the access right information; and
determining, using an unsupervised machine learning algorithm, from the generated network for community determination, and from the user information, a group of nodes of the first type, the group representing a community of users sharing a degree of commonality higher than a degree of commonality shared by other users outside the community.

### Claim 2 (depends on 1)

The system of claim 1, wherein the operations comprise:
determining the group of nodes of the first type using a Louvain Method for community detection; and
determining the degree of commonality based on a modularity of at least a subset of the network, the modularity representing a difference between a density of edges of the second type inside the community and a density of edges of the second type outside the community.

### Claim 3 (depends on 1)

The system of claim 1, wherein the edges comprise a third type of edges, the third type of edges:
connecting first nodes of the first type and second nodes of the first type; and
indicating that first users represented by the first nodes of the first type manage second users represented by the second nodes of the first type.

### Claim 4 (depends on 1)

The system of claim 1, wherein the confidence parameter is updated.

### Claim 5 (depends on 4)

The system of claim 4, wherein the operations comprise:
generating at least one edge of the first type that has the confidence parameter higher than a predetermined value.

### Claim 6 (depends on 4)

The system of claim 4, wherein the operations comprise:
removing at least one edge of the first type that has the confidence parameter lower than a predetermined value.

### Claim 7 (depends on 1)

The system of claim 1, wherein the operations comprise:
generating, using a Min Hash LSH Ensemble algorithm, edges of the second type based on a set of access rights of users.

### Claim 8 (depends on 1)

The system of claim 1, wherein the operations comprise:
generating an edge of the second type between a first node of the first type and a second node of the first type when a containment between the first and second node is above a predetermined level, the containment representing a normalized quantity of access rights shared by both a first user represented by the first node and a second user represented by the second node, normalized by a total number of access rights of either the first or second user.

### Claim 9 (depends on 1)

The system of claim 1, wherein:
at least one edge of the first type comprises a temporal parameter representing a time period since the user represented by the node of the first type was granted the access right represented by the node of the second type; and
the operations comprise generating an edge of the second type based on the temporal parameter, wherein a shorter time period weighs heavier than a longer time period in determining the degree of similarity.

### Claim 10 (depends on 1)

The system of claim 1, wherein the operations comprise:
detecting an anomalous access right granted to a user when the anomalous access right is absent from a predetermined number of users in the community to which the user belongs.

### Claim 11

A computer-implemented method for access management using machine learning, the method comprising:
obtaining user information and access right information from an access directory and a database;
preprocessing the obtained user information and access right information into user access information, wherein the user access information comprises at least a combination of the user information and the access right information;
generating, based on the user access information, a network for community determination comprising nodes and edges, wherein:
the nodes comprise:
a first type of nodes representing users based on the preprocessed user access information; and
a second type of nodes representing access rights based on the preprocessed user access information; the edges comprise:
a first type of edges connecting nodes of the first type and nodes of the second type, the first type of edges comprising a confidence parameter indicating a likelihood that users represented by nodes of the first type have access rights represented by nodes of the second type, wherein the confidence parameter is computed based on a ratio between a number of users within a prior result of a community determination that have that access right and a total number of users within the prior result of the community determination; and
a second type of edges connecting two nodes of the first type and indicating degrees of similarity between two users represented by the two nodes, based on a set of access rights of the two users, wherein the degrees of similarity is based on the access right information; and
determining, using an unsupervised machine learning algorithm, from the generated network for community determination, and from the user information, a group of nodes of the first type, the group representing a community of users sharing a degree of commonality higher than a degree of commonality shared by other users outside the community.

### Claim 12 (depends on 11)

The method of claim 11, comprising:
determining the group of nodes of the first type using a Louvain Method for community detection; and
determining the degree of commonality based on a modularity of at least a subset of the network, the modularity representing a difference between a density of edges of the second type inside the community and a density of edges of the second type outside the community.

### Claim 13 (depends on 11)

The method of claim 11, wherein the edges comprise a third type of edges, the third type of edges:
connecting first nodes of the first type and second nodes of the first type; and
indicating that first users represented by the first nodes of the first type manage second users represented by the second nodes of the first type.

### Claim 14 (depends on 11)

The method of claim 11, wherein the confidence parameter is updated.

### Claim 15 (depends on 14)

The method of claim 14, comprising:
generating at least one edge of the first type that has the confidence parameter higher than a predetermined value.

### Claim 16 (depends on 14)

The method of claim 14, comprising:
removing at least one edge of the first type that has the confidence parameter lower than a predetermined value.

### Claim 17 (depends on 11)

The method of claim 11, comprising:
generating an edge of the second type between a first node of the first type and a second node of the first type when a containment between the first and second node is above a predetermined level, the containment representing a normalized quantity of access rights shared by both a first user represented by the first node and a second user represented by the second node, normalized by a total number of access rights of either the first or second user.

### Claim 18 (depends on 11)

The method of claim 11, wherein:
at least one edge of the first type comprises a temporal parameter representing a time period since the user represented by the node of the first type was granted the access right represented by the node of the second type; and
the method comprises generating an edge of the second type based on the temporal parameter, wherein a shorter time period weighs heavier than a longer time period in determining the degree of similarity.

### Claim 19 (depends on 11)

The method of claim 11, comprising:
detecting an anomalous access right granted to a user when the anomalous access right is absent from a predetermined number of users in the community to which the user belongs.

### Claim 20

A non-transitory computer-readable medium storing instructions executable by at least one processor to cause the at least one processor to perform operations for access management using machine learning, the operations comprising:
obtaining user information and access right information from an access directory and a database;
preprocessing the obtained user information and access right information into user access information, wherein the user access information comprises at least a combination of the user information and the access right information;
generating, based on the user access information, a network for community determination comprising nodes and edges, wherein:
the nodes comprise:
a first type of nodes representing users based on the preprocessed user access information; and
a second type of nodes representing access rights based on the preprocessed user access information; the edges comprise:
a first type of edges connecting nodes of the first type and nodes of the second type, the first type of edges comprising a confidence parameter indicating a likelihood that users represented by nodes of the first type have access rights represented by nodes of the second type, wherein the confidence parameter is computed based on a ratio between a number of users within a prior result of a community determination that have that access right and a total number of users within the prior result of the community determination; and
a second type of edges connecting two nodes of the first type and indicating degrees of similarity between two users represented by the two nodes, based on a set of access rights of the two users, wherein the degrees of similarity is based on the access right information; and
determining, using an unsupervised machine learning algorithm, from the generated network for community determination, and from the user information, a group of nodes of the first type, the group representing a community of users sharing a degree of commonality higher than a degree of commonality shared by other users outside the community.