Anomaly scoring using collaborative filtering

A cybersecurity method, comprising:

• forming a pair in response to an actor attempting to access a resource of a guarded computing system (GCS), the pair including:
• an actor-id identifying the actor, a resource-id identifying the resource;
• submitting the pair to a risk assessor code which in turn feeds the pair to a machine learning model which has been trained using a collection of training-tuples, each training-tuple including:
• a training-tuple actor-id identifying a training-tuple actor, a training-tuple resource-id identifying a training-tuple resource, and at least one rating based on how many times the training-tuple actor attempted to access the training-tuple resource, the machine learning model configured to perform collaborative filtering;
• receiving from the machine learning model a recommendation score of the pair computed using collaborative filtering;
• implementing an inverse relationship between the recommendation score and a risk score, whereby a high recommendation score corresponds to a low risk score and a low recommendation score corresponds to a high risk score;
• and
• performing at least one of the following cybersecurity actions based at least in part on the risk score or recommendation score or both:
• mitigating a risk by preventing or terminating access by the actor to the resource,
• mitigating a risk by alerting an administrator,
• mitigating a risk by alerting a security tool,
• mitigating a risk by flagging the actor or the resource or both as a candidate for further security investigation,
• accepting a risk by marking the pair as accepted,
• accepting a risk by logging the pair as accepted,
• accepting a risk by allowing the actor to access the resource, or
• accepting a risk by allowing the actor to continue an access to the resource which has started.

A storage medium configured with code which upon execution by a processor performs a cybersecurity method, the method comprising:

• submitting a pair to a machine learning model which has been trained using a collection of training-tuples, the pair including an actor-id and a resource-id, each training-tuple including:
• a training-tuple actor-id identifying a training-tuple actor, a training-tuple resource-id identifying a training-tuple resource, and at least one rating based on how many times the training-tuple actor attempted to access the training-tuple resource;
• the machine learning model computing a recommendation score of the pair using collaborative filtering, including performing at least one of the following:
• a singular value decomposition, a principal component analysis, a probabilistic matrix factorization, a non-negative matrix factorization, or another matrix factorization;
• and
• selecting at least one cybersecurity action for performance, based at least in part on the recommendation score.