Reducing false detection of anomalous user behavior on a computer network

A tangible non-transitory computer readable storage medium, including program instructions loaded into memory that, when executed on processors, cause the processors to implement a method of reducing false detection of anomalous user behavior on a computer network, including:

• forming groups of users from identity and access management (abbreviated IAM) properties;
• assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
• dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups;
• and
• evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.

A device for reducing false detection of anomalous user behavior on a computer network, the device including a processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to implement a process that includes:

• forming groups of users from identity and access management (abbreviated IAM) properties;
• assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
• dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups;
• and
• evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.