Methods and systems for identifying anomalous users exhibiting overreaching access permissions to data objects

A server system, the system comprising:

• a memory configured to store instructions;
• a communication interface;
• and
• a processor in communication with the memory and the communication interface, the processor configured to execute the instructions stored in the memory and thereby cause the system to perform at least in part to:
• determine access permission data for each of a plurality of users, the access permission data for each user indicating a set of data objects, among a plurality of data objects, accessible to the corresponding user, wherein each of the plurality of data objects corresponds to one of aplurality of categories;
• determine first score data for each user of the plurality of users based on the access permission data associated with each of the plurality of users, the first score data indicating a degree of closeness between the access permission data of the corresponding user and an expected access permission data of the corresponding user, wherein to determine the first score data, the server system is caused to:
• determine second score data for the corresponding user for each of the plurality of categories based on the access permission data, and
• determine the first score data for the corresponding user based at least on the determined second score data for each of the plurality of categories;
• computea threshold value of the first score data defining a boundary value of the first score datafor identification of the anomalous users;
• and
• identify a subset of users, among the plurality of users, as the anomalous users exhibiting overreaching access permission, wherein the first score data for each of the subset of usersis equal to or below the computed threshold value.

A non-transitory computer-readable storage medium comprising computer-executable instructions that, when executed by at least a processor of a system, cause the system to perform a method comprising:

• determining, by a server system, accesspermission data for each of a plurality of users, the access permission data for each user indicating a set of data objects, among a plurality of data objects, accessible to the corresponding user, wherein each of the plurality of data objects corresponds to one of a plurality of categories;
• determining, by the server system, first score data for each user of the plurality of users based on the access permission data associated with each of the plurality of users, the first score data indicating a degree of closeness between the access permission data of the corresponding user and an expected access permission data of the corresponding user, wherein determining the first score data comprises:
• determining, by the server system, second score data for the corresponding user for each of the plurality of categories based on the access permission data, and
• determining, by the server system, the first score data for the corresponding user based at least on the determined second score data for each of the plurality of categories;
• computing, by the server system, a threshold value of the first score data defining a boundary value of first score datafor identification of the anomalous users;
• and
• identifying, by the server system, a subset of users, among the plurality of users, as the anomalous users exhibiting overreaching access permission, wherein the first score data for each of the subset of usersis equal to or below the computed threshold value.