US 11,082,442 B1Granted

Automated setting of risk score aggregation weights for detection of access anomalies in a computer network

AssigneeEMC IP Holding Company LLC

InventorsEyal Kolman, Carmit Sahar

Life of this patent

Estimating the term…

Loading patent…

Abstract

A processing device in one embodiment comprises a processor coupled to a memory and is configured to generate access profiles for respective user identifiers, to obtain data characterizing a current access for a given one of the user identifiers, to extract a plurality of features from the data characterizing the current access for the given user identifier, and to generate feature risk scores based on the extracted features and the access profile for the given user identifier. The processing device is further configured to aggregate the feature risk scores into a composite risk score. The aggregation illustratively comprises weighting the feature risk scores utilizing automatically-set feature risk score weights. The composite risk score is compared to a threshold, and an alert is generated relating to the current access based on a result of comparing the composite risk score to the threshold.

Claims20

Dependent claims

A method for automated detection of access anomalies in at least one network, the method comprising steps of:

generating access profiles for respective user identifiers;
obtaining data characterizing a current access for a given one of the user identifiers;
extracting a plurality of features from the data characterizing the current access for the given user identifier;
generating feature risk scores for the current access based on the extracted features and the access profile for the given user identifier;
determining deviations of respective probability distributions of the generated feature risk scores from one or more corresponding predetermined probability distributions;
automatically setting feature risk score weights for the respective generated feature risk scores based at least in part on the determined deviations, the size of each automatically-set feature risk score weight corresponding to a size of the deviation of the respective probability distribution of the corresponding feature risk score from the one or more corresponding predetermined probability distributions;
aggregating the feature risk scores to form a composite risk score wherein the aggregating comprises weighting the feature risk scores utilizing the automatically-set feature risk score weights and aggregating the weighted feature risk scores together to form the composite risk score;
comparing the composite risk score to a threshold;
generating an alert relating to the current access based on a result of comparing the composite risk score to the threshold;
and
automatically taking one or more remedial actions relating to the current access based on the result of comparing the composite risk score to the threshold, the one or more remedial actions comprising one or more of:
requesting a submission of one or more additional authentication factors from a user device associated with the given user identifier;
terminating the current access;
and
suspending the current access until the one or more additional authentication factors are obtained and verified;
wherein the alert is transmitted over said at least one network to a security agent;
and
wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.

15 more elements

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:

to generate access profiles for respective user identifiers;
to obtain data characterizing a current access for a given one of the user identifiers;
to extract a plurality of features from the data characterizing the current access for the given user identifier;
to generate feature risk scores for the current access based on the extracted features and the access profile for the given user identifier;
to determine deviations of respective probability distributions of the generated feature risk scores from one or more predetermined probability distributions;
to automatically set feature risk score weights for the respective generated feature risk scores based at least in part on the determined deviations, the size of each automatically-set feature risk score weight corresponding to a size of the deviation of the respective probability distribution of the corresponding feature risk score from the one or more corresponding predetermined probability distributions;
to aggregate the feature risk scores to form a composite risk score wherein the aggregating comprises weighting the feature risk scores utilizing automatically-set feature risk score weights and aggregating the weighted feature risk scores together to form the composite risk score;
to compare the composite risk score to a threshold;
to generate an alert relating to the current access based on a result of comparing the composite risk score to the threshold;
and
to automatically take one or more remedial actions relating to the current access based on the result of comparing the composite risk score to the threshold, the one or more remedial actions comprising one or more of:
requesting a submission of one or more additional authentication factors from a user device associated with the given user identifier;
terminating the current access;
and
suspending the current access until the one or more additional authentication factors are obtained and verified;
wherein the alert is transmitted over said at least one network to a security agent.

13 more elements

An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;
said at least one processing device being configured:
to generate access profiles for respective user identifiers;
to obtain data characterizing a current access for a given one of the user identifiers;
to extract a plurality of features from the data characterizing the current access for the given user identifier;
to generate feature risk scores for the current access based on the extracted features and the access profile for the given user identifier;
to determine deviations of respective probability distributions of the generated feature risk scores from one or more predetermined probability distributions;
to automatically set feature risk score weights for the respective generated feature risk scores based at least in part on the determined deviations, the size of each automatically-set feature risk score weight corresponding to a size of the deviation of the respective probability distribution of the corresponding feature risk score from the one or more corresponding predetermined probability distributions;
to aggregate the feature risk scores to form a composite risk score wherein the aggregating comprises weighting the feature risk scores utilizing automatically-set feature risk score weights and aggregating the weighted feature risk scores together to form the composite risk score;
to compare the composite risk score to a threshold;
to generate an alert relating to the current access based on a result of comparing the composite risk score to the threshold;
and
to automatically take one or more remedial actions relating to the current access based on the result of comparing the composite risk score to the threshold, the one or more remedial actions comprising one or more of:
requesting a submission of one or more additional authentication factors from a user device associated with the given user identifier;
terminating the current access;
and
suspending the current access until the one or more additional authentication factors are obtained and verified;
wherein the alert is transmitted over said at least one network to a security agent.

15 more elements

Dependencies are inferred from the claim text.