Methods and systems for determining anomalous user access to data objects

A method for determining an anomalous behavior of a user, the method comprising:

• determining, by a server system, baseline access data comprising a plurality of access elements, each access element corresponding to a respective peer user from a plurality of peer users, each access element indicating a count of data objects accessed by the respective peer user within each of a plurality of semantic categories;
• generating, by the server system, target access data for the user, the target access data indicating a count of data objects accessed by the user within each of the plurality of semantic categories during a target time interval;
• computing, by the server system, an anomalous factor for the user based, at least in part, on the baseline access data and the target access data, the anomalous factor for the user indicating a degree of the anomalous behavior of the user during the target time interval;
• determining, by the server system, whether the user is an anomalous user based, at least in part, on the computed anomalous factor for the user;
• and
• triggering, by the server system, a customized action upon the determination of the anomalous user, wherein the customized action comprises transmitting an alert signal to a third-party system or blocking access permission associated with the user for a set of data objects.

A server system, the system comprising:

• a memory configured to store instructions;
• a communication interface;
• and
• a processor in communication with the memory and the communication interface, the processor configured to execute the instructions stored in the memory and thereby cause the system to perform at least in part to:
• determine baseline access data comprising a plurality of access elements, each access element corresponding to a respective historical time interval from a plurality of historical time intervals, each access element indicating a count of data objects accessed by the user within each of a plurality of semantic categories during a respective historical time interval;
• generate target access data for the user, the target access data indicating a count of data objects accessed by the user within each of the plurality of semantic categories during a target time interval;
• compute an anomalous factor for the user based, at least in part, on the baseline access data and the target access data, the anomalous factor for the user indicating a degree of the anomalous behavior of the user during the target time interval;
• determine whether the user is an anomalous user based, at least in part, on the computed anomalous factor for the user;
• and
• trigger a customized action upon the determination of the anomalous user, wherein the customized action comprises transmitting an alert signal to a third-party system or blocking access permission associated with the user for a set of data objects.

A server system, the system comprising:

• a memory configured to store instructions;
• a communication interface;
• and
• a processor in communication with the memory and the communication interface, the processor configured to execute the instructions stored in the memory and thereby cause the system to perform at least in part to:
• determine baseline access data comprising a plurality of access elements, each access element corresponding to a respective peer user from a plurality of peer users, each access element indicating a count of data objects accessed by the respective peer user within each of a plurality of semantic categories;
• generate target access data for the user, the target access data indicating a count of data objects accessed by the user within each of the plurality of semantic categories during a target time interval;
• compute an anomalous factor for the user based, at least in part, on the baseline access data and the target access data, the anomalous factor for the user indicating a degree of the anomalous behavior of the user during the target time interval;
• determine whether the user is an anomalous user based, at least in part, on the computed anomalous factor for the user;
• and
• trigger a customized action upon the determination of the anomalous user, wherein the customized action comprises transmitting an alert signal to a third-party system or blocking access permission associated with the user for a set of data objects.