Access control policy management

A method of access rights management, comprising:

• factorizing a user access co-occurrence data element to generate two data sub-elements, wherein:
• the user access co-occurrence data element represents co-occurrences between users of a system and resources of the system,
• a product of the two data sub-elements approximates the user access co-occurrence data element,
• each of the two data sub-elements has reduced dimensionality compared to the user access co-occurrence data element, and
• one of the two data sub-elements comprises user access embeddings associated with the users of the system;
• clustering the user access embeddings associated with the users of the system into one or more first clusters;
• creating, for each respective user of the system, a user attribute embedding based on a plurality of attributes of the respective user;
• clustering the user attribute embedding created for each respective user of the system into one or more second clusters;
• for at least one of the user access embeddings:
• determining a first cluster of the one or more first clusters comprising a first user access embedding;
• determining a second cluster of the one or more first clusters comprising a second user attribute embedding associated with a user corresponding to the respective user access embedding;
• determining a similarity between the first cluster and the second cluster;
• determining the similarity is below a threshold;
• and
• flagging the user based on the similarity being below the threshold.

A processing system, comprising:

• a memory comprising computer-executable instructions;
• and
• a processor configured to execute the computer-executable instructions and cause the processing system to:
• factorize a user access co-occurrence data element comprising a non-negative matrix to generate two data sub-elements by performing a non-negative matrix factorization, wherein:
• the user access co-occurrence data element represents co-occurrences between users of a system and resources of the system,
• a product of the two data sub-elements approximates the user access co-occurrence data element,
• each of the two data sub-elements has reduced dimensionality compared to the user access co-occurrence data element,
• the non-negative matrix comprises a two-dimensional array of cells,
• each respective cell in the non-negative matrix corresponds to a respective user of the system and a respective resource of the system, and
• each respective cell in the non-negative matrix comprises a value indicating whether the respective user corresponding to the respective cell is denied or granted access to the resource corresponding to the respective cell;
• generate an approximated user access co-occurrence data element based on the product of the two data sub-elements, each of the two data sub-elements being factors of the user access co-occurrence data element;
• compare the user access co-occurrence data element and the approximated user access co-occurrence data element to determine one or more anomalies, wherein each of the one or more anomalies relates to access for a select user to a select resource of the system;
• and
• take one or more actions to rectify the one or more anomalies.