Automated access control policy generation for computer resources

An automatic access control policy generation system, the automatic access control policy generation system comprising:

• one or more processors;
• and
• at least one computer storage medium having computer executable instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to:
• collect historical access data for user accesses to a computer resource;
• separate the historical access data into a training data set and a validation data set;
• generate an access control rule for the computer resource based on one or more properties of the user accesses to the computer resource in the training data set;
• validate the access control rule against the validation data set, where the access control rule is determined to be valid if a denial rate level obtained from applying the access control rule to the validation data set is below a threshold parameter value;
• and
• if the access control rule is determined to be valid, provide the access control rule to an administrative interface.

A computer storage medium having computer executable instructions stored thereon which, when executed by one or more processors, cause the processors to execute a method for generating access control rules for controlling access to computer resources, the method comprising:

• collecting historical access data for user accesses to a computer resource;
• separating the historical access data into a training data set and a validation data set;
• generating an access control rule for the computer resource based on one or more properties of the user access to the computer resource in the training data set;
• validating the access control rule against the validation data set, where the access control rule is determined to be valid if a denial rate level obtained from applying the access control rule to the validation data set is below a threshold parameter value;
• and
• if the access control rule is determined to be valid, providing the access control rule to an administrative interface.