Anomaly detection associated with communities

A system for detecting unauthorized access to a plurality of network assets, the system comprising:

• an anomaly detection server including a processor and a memory;
• a first network asset feed received by the anomaly detection server from a plurality of data sources, wherein the first network asset feed is communicated to an anomaly detection module;
• at least one social graph generated by the anomaly detection server with the first network asset feed, wherein the social graph is generated at the anomaly detection module;
• a plurality of user communities that are identified with the social graph, in which each user community is associated with a work group;
• a plurality of user community communications, wherein each communication of the plurality of user community communications associated with at least one of the plurality of user communities;
• one or more user accounts associated with the plurality of user communities at the anomaly detection module;
• a plurality of other network asset feeds that are accessed by the one or more user accounts from at least one of a firewall log and a router log, wherein the plurality of other network asset feeds include,
• a firewall and an associated firewall feed, and
• a firewall social graph with the firewall feed;
• one or more derived communities are associated with a commonly accessed network asset, wherein the one or more derived communities is determined by using one or more traffic patterns corresponding to at least one user community accessing a shared network asset;
• an anomalous communication reported when one of the plurality of user community communications does not correspond to the one or more derived communities;
• and
• wherein the anomaly detection module is configured to monitor communications of the user community so that the communications correspond to the derived community.

A method for detecting unauthorized access to a plurality of network assets, the method comprising:

• receiving a first network asset feed from a plurality of data sources, wherein the first network asset feed is communicated to an anomaly detection module;
• generating, at the anomaly detection module, at least one social graph with the first network asset feed;
• identifying, at the anomaly detection module, a plurality of user communities with the social graph, in which each user community is associated with a work group wherein each user community of the plurality of user communities includes at least one user community communication of a plurality of user community communications;
• associating, at the anomaly detection module, one or more user accounts with the plurality of user communities;
• receiving a plurality of other network asset feeds that are accessed by the one or more user accounts from at least one of a firewall log and a router log, wherein at least one of the plurality of other network asset feeds includes,
• accessing a firewall and an associated firewall feed, and
• generating a firewall social graph with the firewall feed;
• determining one or more derived communities, in which each derived community is associated with a commonly accessed network asset;
• monitoring, at the anomaly detection module, the plurality of user community communications for user community communications corresponding to the one or more derived communities;
• and
• reporting an anomalous communication when one of the monitored user community communications does not correspond to the derived community.