Supervised learning system for identity compromise risk computation
AssigneeMicrosoft Technology Licensing, LLC
InventorsSayed Hassan Abdelaziz, Maria Puertas Calvo, Laurentiu Bogdan Cristofor, Rajat Luthra
Life of this patent
Estimating the term…
Abstract
Systems are provided for improving computer security systems that are based on user risk scores. These systems can be used to improve both the accuracy and usability of the user risk scores by applying multiple tiers of machine learning to different the user risk profile components used to generate the user risk scores and in such a manner as to dynamically generate and modify the corresponding user risk scores.
Claims16
A computing system comprising:
- one or more processors;
- and
- one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to implement a method of improving precision and recall utility for user identity risk scores that are utilized in providing computer security, including instructions that are executable to configure the computer system to implement the method by performing at least the following:
- accessing stored sign-in data for each sign-in event in a set of sign-in events corresponding to a first user, the sign-in data being stored for a predetermined period of time, the set of sign-in events comprising one or more sign-in event;
- from the stored sign-in data, and based on risk profiles associated with the stored sign-in data, identifying a set of sign-in detectors for each sign-in event in the set of sign-in events corresponding to the first user, the set of sign-in detectors comprising one or more sign-in detector;
- generating a quantified risk level set of sign-in detectors by applying a first machine learning tool to the set of sign-in detectors to quantify a relative risk level associated with each sign-in detector of the set of sign-in detectors;
- generating a quantified risk level set of sign-ins by applying a second machine learning tool to the quantified risk level set of sign-in detectors to quantify a relative risk level associated with each sign-in event in the set of sign-in events;
- generating a first user identity risk score by applying a third machine learning tool to the quantified risk level set of sign-ins to quantify a relative risk level associated with the first user;
- and
- iteratively and dynamically updating the first user identity risk score or generating a new first user identity risk score by reapplying the third machine learning tool to the quantified risk level set of sign-ins.
A computer implemented method of improving precision and recall utility for user identity risk scores that are utilized in providing computer security, the method being performed by a computer system implementing at least the following:
- accessing stored sign-in data for each sign-in event in a set of sign-in events corresponding to a first user, the sign-in data being stored for a predetermined period of time, the set of sign-in events comprising one or more sign-in event;
- from the stored sign-in data, and based on risk profiles associated with the stored sign-in data, identifying a set of sign-in detectors for each sign-in event in the set of sign-in events corresponding to the first user, the set of sign-in detectors comprising one or more sign-in detector;
- generating a quantified risk level set of sign-in detectors by applying a first machine learning tool to the set of sign-in detectors to quantify a relative risk level associated with each sign-in detector of the set of sign-in detectors;
- generating a quantified risk level set of sign-ins by applying a second machine learning tool to the quantified risk level set of sign-in detectors to quantify a relative risk level associated with each sign-in event in the set of sign-in events;
- generating a first user identity risk score by applying a third machine learning tool to the quantified risk level set of sign-ins to quantify a relative risk level associated with the first user;
- and
- iteratively and dynamically updating the first user identity risk score or generating a new first user identity risk score by reapplying the third machine learning tool to the quantified risk level set of sign-ins.
One or more hardware storage device comprising stored computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to implement a method of improving precision and recall utility for user identity risk scores that are utilized in providing computer security, and for at least causing the computer system to implement the following:
- accessing stored sign-in data for each sign-in event in a set of sign-in events corresponding to a first user, the sign-in data being stored for a predetermined period of time, the set of sign-in events comprising one or more sign-in event;
- from the stored sign-in data, and based on risk profiles associated with the stored sign-in data, identifying a set of sign-in detectors for each sign-in event in the set of sign-in events corresponding to the first user, the set of sign-in detectors comprising one or more sign-in detector;
- generating a quantified risk level set of sign-in detectors by applying a first machine learning tool to the set of sign-in detectors to quantify a relative risk level associated with each sign-in detector of the set of sign-in detectors;
- generating a quantified risk level set of sign-ins by applying a second machine learning tool to the quantified risk level set of sign-in detectors to quantify a relative risk level associated with each sign-in event in the set of sign-in events;
- generating a first user identity risk score by applying a third machine learning tool to the quantified risk level set of sign-ins to quantify a relative risk level associated with the first user;
- and
- iteratively and dynamically updating the first user identity risk score or generating a new first user identity risk score by reapplying the third machine learning tool to the quantified risk level set of sign-ins.
Dependencies are inferred from the claim text.