System and method of business role mining

A computer-implemented method of approving access permissions, the method comprising:

• transforming, by at least one processor, access data into data structures comprising a binary matrix representation, wherein the transforming comprises:
• parsing the access data into a plurality of access sets comprising a user, an access point, and an electronic access permission and computing, by the at least processor, binary matrix factorization on the plurality of access sets to determine one or more binary values representative of electronic access permissions to one or more computer applications for a plurality of permission packages;
• detecting application usage patterns of a plurality of users based on the access data, wherein the application usage patterns are based on accessing one or more computer applications by the plurality of users;
• reducing an attestation complexity of the binary matric representation by:
• generating a plurality of feature vectors based on the binary matrix representation;
• wherein generating the plurality of feature vectors comprises encoding categorical variables associated with user profiles into numerical representations to produce Boolean and categorical feature vectors;
• clustering the plurality of feature vectors into a plurality of clustered feature vectors based on a distance metric applied pairwise to the plurality of feature vectors, wherein a total number of the plurality of clusters is determined based on a predefined threshold value;
• generating, by the at least one processor, user roles based on common patterns of the access data, the user roles comprising at least one access point associated with the access data, wherein the at least one access point comprises an electronic access to an electronic data set through at least one of the one or more computer applications, wherein the electronic data set comprises at least one of a computer application, a trading book, a database, infrastructure data, human resources data, and transits data;
• identifying outliers of the access data;
• performing a function role factorization on the access data based on the detected application usage patterns to generate the plurality of permission packages, each of the plurality of permission packages associated with at least one user role and at least one access point associated with the access data, wherein the identified outliers of the access data are not associated with a permission package of the plurality of permission packages;
• generating, by the at least one processor based on the data structures, a directed graph representing the relationship between user roles, the plurality of permission packages and the at least one access point, wherein the directed graph is a tripartite graph structure wherein the user roles, the plurality of permission packages and the at least one access point are represented as nodes, and each relationship between a user role of the user roles and a corresponding permission package of the plurality of permission packages is represented as an edge between a node representing the user role and a node representing the corresponding permission package, and each relationship between a permission package of the plurality of permission packages and a corresponding access point of the at least one access point is represented as an edge between a node representing the permission package and a node representing the corresponding access point, wherein generating the tripartite graph structure comprises:
• rendering the graph structure using forced directed graphing to apply force to the nodes;
• and
• clustering the nodes based on the plurality of permission packages to facilitate identification of the relationship between the user role and the at least one access point, wherein the clustering is tuned to increase coverage to improve efficiency of automatic approvals and configuration of electronic access permissions, wherein the coverage represents a proportion of access points and user roles that are associated with at least one of the permission packages;
• storing the directed graph tripartite graph structure with the reduced attestation complexity;
• and
• generating a user interface element, by the at least one processor, to present the directed graph and a user role assignable to a user profile to an access manager, wherein the directed graph comprises a node representing the user role, wherein the directed graph comprises nodes representing at least one permission package and at least one associated access point connected to the node representing the user role;
• receiving, by the at least one processor, an approval indication input associated with the access manager assigning the user role to the user profile;
• and
• responsive to receiving the approval, automatically configuring a plurality of electronic access permissions associated with the at least one permission package and the at least one associated access point enabling the user profile to access one or more computational functions using one or more computer applications associated with the assigned user role for the at least one access point associated with the assigned user role.

A non-transitory computer-readable medium having instructions thereon which, when executed by a processor, perform:

• transforming access data into data structures comprising a binary matrix representation by parsing the access data into a plurality of access sets comprising a user, an access point, and an electronic access permission and computing binary matrix factorization on the plurality of access sets to determine one or more binary values representative of electronic access permissions to one or more computer applications for a plurality of permission packages;
• detecting application usage patterns of a plurality of users based on the access data, wherein the application usage patterns are based on accessing one or more computer applications by the plurality of users;
• reducing an attestation complexity of the binary matric representation by:
• generating a plurality of feature vectors based on the binary matrix representation;
• wherein generating the plurality of feature vectors comprises encoding categorical variables associated with user profiles into numerical representations to produce Boolean and categorical feature vectors;
• clustering the plurality of feature vectors into a plurality of clustered feature vectors based on a distance metric applied pairwise to the plurality of feature vectors, wherein a total number of the plurality of clusters is determined based on a predefined threshold value;
• generating user roles based on common patterns of the access data, the user roles comprising at least one access point associated with the access data, wherein the at least one access point comprises an electronic access to an electronic data set through at least one of the one or more computer applications, wherein the electronic data set comprises at least one of a computer application, a trading book, a database, infrastructure data, human resources data, and transits data;
• identifying outliers of the access data;
• performing a function role factorization of the access data based on the detected application usage patterns to generate the plurality of permission packages, each of the plurality of permission packages associated with at least one user role and at least one access point associated with the access data, wherein the identified outliers of the access data are not associated with a permission package of the plurality of permission packages;
• generating, by the processor based on the data structures, a directed graph representing the relationship between user roles, the plurality of permission packages and the at least one access point, wherein the directed graph is a tripartite graph structure wherein the user roles, the plurality of permission packages and the at least one access point are represented as nodes, and each relationship between a user role of the user roles and a corresponding permission package of the plurality of permission packages is represented as an edge between a node representing the user role and a node representing the corresponding permission package, and each relationship between a permission package of the plurality of permission packages and a corresponding access point of the at least one access point is represented as an edge between a node representing the permission package and a node representing the corresponding access point, wherein generating the tripartite graph structure comprises:
• rendering the graph structure using forced directed graphing to apply force to the nodes;
• and
• clustering the nodes based on the plurality of permission packages to facilitate identification of the relationship between the user role and the at least one access point, wherein the clustering is tuned to increase coverage to improve efficiency of automatic approvals and configuration of electronic access permissions, wherein the coverage represents a proportion of access points and user roles that are associated with at least one of the permission packages;
• storing the directed graph tripartite graph structure with the reduced attestation complexity;
• and
• generating a user interface element to present the directed graph and a user role assignable to a user profile to an access manager, wherein the directed graph comprises a node representing the user role, wherein the directed graph comprises nodes representing at least one permission package and at least one associated access point connected to the node representing the user role;
• and
• receiving an approval indication input associated with the access manager assigning the user role to the user profile;
• and
• responsive to receiving the approval, automatically configuring a plurality of electronic access permissions associated with the at least one permission package and the at least one associated access point enabling the user profile to access one or more computational functions using one or more computer applications associated with the assigned user role for the at least one access point associated with the assigned user role.