Back to results
US 11,537,736 B2Granted
System for detecting anomalous access to tables
AssigneePaypal, Inc.
InventorsLiron Florens Ben Kimon, Yotam Perkal, Yuri Shafet
Life of this patent
Estimating the term…
Abstract
A system and method for detecting anomalous access to tables is described. A query for accessing a table from a requesting user is received. A set of users similar to the requesting user is determined. The probability that the requesting user should access the table is calculated. Whether the user should be accessing the table based on the calculated probability is determined.
Claims20
A system for detecting anomalous data access, comprising:
- a non-transitory memory storing instructions;
- and
- one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
- receiving, from a requesting user, a query for accessing a set of data from a data storage;
- determining that the requesting user has no history of accessing the set of data from the data storage;
- in response to the determining that the requesting user has no history of accessing the set of data from the data storage, determining a likelihood of the requesting user requesting access to the set of data by:
- determining a set of users that shares one or more common organizational attributes with the requesting user within an organization;
- comparing a first data access pattern associated with the requesting user against data access patterns associated with the set of users;
- identifying, from the set of users, a subset of users based on the comparing, wherein the subset of users is associated with a subset of the data access patterns that matches the first data access pattern within a threshold;
- obtaining a data access history associated with the subset of users, wherein the data access history comprises data accesses of different data in the data storage by the subset of users;
- and
- calculating the likelihood of the requesting user requesting access to the set of data based on the data accesses by the subset of users;
- and
- determining whether to restrict the requesting user from accessing the set of data based on the calculated likelihood.
11 more elements
A method for detecting anomalous data access, the method comprising:
- receiving, by one or more hardware processors from a requesting user, a query for accessing a set of data;
- determining, by the one or more hardware processors, that the requesting user lacks a history of accessing the set of data;
- in response to the determining that the requesting user lacks a history of accessing the set of data, determining, by the one or more hardware processors, a likelihood of the requesting user requesting access to the set of data by:
- identifying, by the one or more hardware processors, a set of users that shares one or more organizational attributes with the requesting user within an organization;
- comparing, by the one or more hardware processors, a first data access pattern associated with the requesting user against data access patterns associated with the set of users;
- identifying, by the one or more hardware processors from the set of users, a subset of users based on the comparing, wherein the subset of users is associated with a subset of the data access patterns that matches the first data access pattern within a threshold;
- obtaining, by the one or more hardware processors, a data access history associated with the subset of users, wherein the data access history comprises data accesses of different data by the subset of users;
- and
- calculating, by the one or more hardware processors, the likelihood of the requesting user accessing the set of data based on the data accesses by the subset of users;
- and
- determining whether to grant the requesting user access to the set of data based on the calculated likelihood.
8 more elements
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- receiving, from a requesting user, a query for accessing a set of data;
- determining that the requesting user has no history of accessing the set of data;
- in response to the determining that the requesting user has no history of accessing the set of data, determining a likelihood of the requesting user requesting access to the set of data by:
- determining a set of users that shares one or more common organizational attributes with the requesting user within an organization;
- comparing a first data access pattern associated with the requesting user against data access patterns associated with the set of users;
- identifying, from the set of users, a subset of users based on the comparing, wherein the subset of users is associated with a subset of the data access patterns that matches the first data access pattern within a threshold;
- obtaining a data access history associated with the subset of users, wherein the data access history comprises data accesses of different data by the subset of users;
- and
- calculating a likelihood of the requesting user accessing the set of data based on the data accesses by the subset of users;
- and
- determining whether to restrict the user from accessing the set of data based on the calculated likelihood.
8 more elements
Dependencies are inferred from the claim text.