System and method for outlier and anomaly detection in identity management artificial intelligence systems using cluster based analysis of network identity graphs
AssigneeSailpoint Technologies, Inc.
InventorsMohamed M. Badawy, Jostine Fei Ho
Life of this patent
Estimating the term…
Abstract
Systems and methods for artificial intelligence systems for identity management systems are disclosed. Embodiments may perform outlier detection and risk assessment based on identity management data, including one or more property graphs or peer groups determined from those property graphs, to determine identity management artifacts with ‘abnormal’ patterns when compared to other related identity management artifacts.
Claims21
An identity management system for risk assessment using graphs, comprising:
- a memory;
- a processor;
- a non-transitory, computer-readable storage medium including instructions executable by the processor for:
- accessing identity management data obtained from one or more source systems of an enterprise;
- evaluating the accessed identity management data to determine a set of identity management artifacts associated with a set of identities and at least one entitlement, utilized in identity management in association with the enterprise;
- generating an identity management graph from the identity management data by:
- creating nodes of the identity management graph by creating a node of the identity management graph for each of the determined identity management artifacts associated with the determined set of identities,
- creating edges of the identity management graph between nodes of the identity management graph representing the determined identity management artifacts, the creating including pruning one or more edges, and
- generating weights for created edges of the identity management graph, based on the created nodes associated with the created edges in accordance with the associated set of identities or at least one entitlement;
- storing the identity management graph in a data store;
- analyzing the identity management graph or the identity management data to identify an anomaly;
- and
- identifying an identity management artifact associated with the identified anomaly as a high risk identity management artifact.
The system of 1, wherein the instructions are further for presenting an interface depicting a representation of the identity management graph, identity management data or anomaly to a user.
A method for risk detection using an identity management graph comprising:
- accessing identity management data obtained from one or more source systems of an enterprise;
- evaluating the accessed identity management data to determine a set of identity management artifacts associated with a set of identities and at least one entitlement, utilized in identity management in association with the enterprise;
- generating an identity management graph from the identity management data by:
- creating nodes of the identity management graph by creating a node of the identity management graph for each of the determined identity management artifacts associated with the determined set of identities,
- creating edges identity management graph between nodes of the identity management graph representing the determined identity management artifacts, the creating including pruning one or more edges, and
- generating weights for created edges of the identity management graph, based on the created nodes associated with the created edges in accordance with the associated set of identities or at least one entitlement;
- storing the identity management graph in a data store;
- analyzing the identity management graph or the identity management data to identify an anomaly;
- and
- identifying an identity management artifact associated with the identified anomaly as a high risk identity management artifact.
The method of 8, further comprising presenting an interface depicting a representation of the identity management graph, identity management data or anomaly to a user.
A non-transitory computer readable storage medium, comprising instructions for risk detection using an identity management graph executable by a processor for:
- accessing identity management data obtained from one or more source systems of an enterprise;
- evaluating the accessed identity management data to determine a set of identity management artifacts associated with a set of identities and at least one entitlement, utilized in identity management in association with the enterprise;
- generating an identity management graph from the identity management data by:
- creating nodes of the identity management graph by creating a node of the identity management graph for each of the determined identity management artifacts associated with the determined set of identities,
- creating edges of the identity management graph between nodes of the identity management graph representing the determined identity management artifacts, the creating including pruning one or more edges, and
- generating weights for created edges of the identity management graph, based on the created nodes associated with the created edges in accordance with the associated set of identities or at least one entitlement;
- storing the identity management graph in a data store;
- analyzing the identity management graph or the identity management data to identify an anomaly;
- and
- identifying an identity management artifact associated with the identified anomaly as a high risk identity management artifact.
The non-transitory computer readable storage medium of 15, wherein the instructions are further for presenting an interface depicting a representation of the identity management graph, identity management data or anomaly to a user.
Dependencies are inferred from the claim text.