Insider threat detection utilizing user group data object access analysis

A non-transitory computer-readable storage medium having instructions which, when executed by one or more processors of a computer, cause the computer to implement a suspicious access detection module to perform operations to detect suspicious access requests from access requests that identify different ones of a plurality of files, the plurality of files being organized within a plurality of folders, the operations comprising:

• determining, based on a first access data describing a plurality of access requests sent on behalf of a plurality of users of an enterprise, the following:
• a set of user accessed folders, for each respective one of the plurality of users, that identifies those of the plurality of folders that include those of the files that were identified by those of the plurality of access requests sent on behalf of the respective one of the users,
• a plurality of user groups determined based on similarities between the sets of user accessed folders of the plurality of users,
• a set of group accessed folders, for each respective one of the plurality of user groups, that identifies those of the plurality of folders in the sets of user accessed folders determined for the respective ones of the users in the respective one of the user groups, and
• for each of the plurality of user groups, which of the others of the plurality of user groups are considered nearby that user group based on a level of commonality between folders in set of group accessed folders determined for that user group and the sets of group accessed folders determined for the respective ones of the others of the plurality of user groups;
• determining, based on a second access data describing at least a first access request, that the first access request is suspicious, wherein the first access request identifies a first file of the plurality of files and was issued on behalf of a first user of the plurality of users, wherein the first user is determined to belong to a first user group of the plurality of user groups, wherein the determining that the first access request is suspicious includes determining that the first file is included in a first folder of the plurality of folders and that the first folder is not within the respective sets of group accessed folders determined for the first user group and those of the user groups determined to be nearby the first user group, wherein the first folder being within the set of group accessed folders determined for the first user group would be considered regular and non-suspicious and the first folder being within the sets of group accessed folders determined for user groups determined to be nearby the first user group would be considered irregular but not suspicious;
• and
• causing an alert to be generated responsive to the first access request being determined to be suspicious.