Detection of anomalous access to repositories of version control platforms

A system for detecting anomalous access to repositories of a version control platform, the system comprising:

• a version control platform comprising a plurality of repositories, each of the plurality of repositories providing a storage space for storing one or more files of a software development project;
• and
• a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to:
• receive an audit log from the version control platform;
• detect, from records of the audit log, access to the plurality of repositories of the version control platform during a sampling time period;
• create a repository network graph that comprises a plurality of nodes and a plurality of edges, each of the plurality of nodes representing a repository of the plurality of repositories, each edge of the plurality of edges connecting two nodes of the plurality of nodes and having a weight that is based on a number of times repositories represented by the two nodes connected by the edge were accessed by a same user during the sampling time period;
• detect a plurality of communities in the repository network graph based on weights of the plurality of edges;
• identify a set of outlier communities of the plurality of communities;
• monitor access to repositories that are represented by nodes in the set of outlier communities;
• detect, after the sampling time period, that a first user, for a first time, accessed a first repository that is represented by a node in an outlier community of the set of outlier communities;
• and
• raise an alert based at least on detecting that the first user accessed the first repository.

A method of detecting anomalous access to repositories of a version control platform, the method comprising:

• detecting, from records of an audit log, access to a plurality of repositories of a version control platform during a sampling time period;
• creating a repository network graph that comprises a plurality of nodes and a plurality of edges, each of the plurality of nodes representing a repository of the plurality of repositories, each edge of the plurality of edges connecting two nodes of the plurality of nodes and having a weight that is based on a number of times repositories represented by the two nodes connected by the edge were accessed by a same user during the sampling time period;
• detecting a plurality of communities in the repository network graph in accordance with a Louvain community detection algorithm;
• identifying a set of outlier communities of the plurality of communities;
• monitoring access to repositories that are represented by nodes in the set of outlier communities while ignoring access to repositories that are not represented by nodes in the set of outlier communities;
• detecting, after the sampling time period, an access by a first user, for a first time, to a first repository that is represented by a node in an outlier community of the set of outlier communities;
• detecting that the access by the first user to the first repository is an anomalous access in response to the access by the first user to the first repository satisfying a condition of a policy.