Predicting suspiciousness of access between entities and resources
AssigneeSplunk Inc.
InventorsGeorge Apostolopoulos, Ignacio Nicolas Bermudez Corrales
Life of this patent
Estimating the term…
Abstract
Embodiments of the present invention are directed to facilitating detection of suspicious access to resources. In accordance with aspects of the present disclosure, an access graph is generated. The access graph contains access data that includes observed accesses between entities and resources. Access scores can be determined for entity-resource pairs in the access graph by applying a set of access rules to the entity-resource pairs in the access graph. The access scores indicate an extent of relatedness between the corresponding entity and resource. Thereafter, the access scores can be used to train a probabilistic prediction model that predicts suspiciousness of accesses between entities and resources.
Claims20
A computer-implemented method comprising:
- receiving an entity-resource pair for which suspiciousness is to be predicted, wherein the entity-resource pair indicates an entity and a resource associated with an access between the entity and the resource;
- predicting, using a probabilistic prediction model, suspiciousness of the entity-resource pair, wherein the probabilistic prediction model is trained using observed accesses between entities and resources, a set of access rules indicating appropriateness levels for accesses between the entities and the resources, and artificial access data randomly generated to include unobserved associations of entity-resource pairs;
- and
- outputting an indication of whether the access is suspicious.
A non-transitory computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by a computing device, cause the computing device to:
- receive an entity-resource pair for which suspiciousness is to be predicted, wherein the entity-resource pair indicates an entity and a resource associated with an access between the entity and the resource;
- predict, using a probabilistic prediction model, suspiciousness of the entity-resource pair, wherein the probabilistic prediction model is trained using observed accesses between entities and resources, a set of access rules indicating appropriateness levels for accesses between the entities and the resources, and artificial access data randomly generated to include unobserved associations of entity-resource pairs;
- and
- output an indication of whether the access is suspicious.
A computing device comprising:
- one or more processors;
- and
- a memory coupled with the one or more processors, the memory having instructions stored thereon, wherein the instructions, when executed by the one or more processors, cause the computing device to:
- receive an entity-resource pair for which suspiciousness is to be predicted, wherein the entity-resource pair indicates an entity and a resource associated with an access between the entity and the resource;
- predict, using a probabilistic prediction model, suspiciousness of the entity-resource pair, wherein the probabilistic prediction model is trained using observed accesses between entities and resources, a set of access rules indicating appropriateness levels for accesses between the entities and the resources, and artificial access data randomly generated to include unobserved associations of entity-resource pairs;
- and
- output an indication of whether the access is suspicious.
Dependencies are inferred from the claim text.