Detecting shadow information technology (IT) using network activity logs

A non-transitory computer readable medium having stored thereon a computer program product for detecting shadow information technology (IT) using network activity logs, the computer program product including computer program instructions configurable to:

• gather, from a client device, first information describing network activity by the client device and second information describing application activity by the client device;
• identify, based on the first information and the second information, user-initiated network activity;
• and
• identify, from the user-initiated network activity, shadow information technology (IT) activity comprising access of an unauthorized software-as-a-service (SaaS) application, wherein identifying the shadow IT activity further comprises:
• generating, for a user associated with the client device, a plurality of behavior models from historical access requests associated with the user, wherein generating the plurality of behavior models comprises:
• classifying historical access request data according to one or more parameters, and
• applying a clustering algorithm to the classified historical access request data to generate one or more data clusters for each behavioral model;
• selecting, based on a parameter of a current access request, one of the plurality of behavior models associated with the user;
• determining a deviation of the current access request from one or more data clusters of the selected behavior model;
• and
• identifying the shadow IT activity based at least in part on the determined deviation.