Systems and methods for identifying access anomalies using network graphs

A data storage and access system associated with an enterprise system, comprising:

• a processor;
• and
• non-transitory computer-readable medium having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed, facilitate:
• obtaining access data for an entity, wherein the access data comprises a plurality of access entries associated with network elements the entity uses to access the enterprise system, wherein each of the plurality of access entries comprises a plurality of data elements;
• generating a network graph baseline profile based on the plurality of data elements, wherein the network graph baseline profile comprises a plurality of baseline network graphs, and wherein each network graph comprises a plurality of baseline nodes and a plurality of baseline edges;
• generating a network graph current profile based on the plurality of data elements, wherein the network graph current profile comprises one or more current network graphs, wherein the one or more current network graphs comprise a plurality of current nodes and a plurality of current edges, and wherein each of the plurality of baseline network graphs and the one or more current network graphs are associated with an access entry from the plurality of access entries;
• generating comparison data based on
• comparing the plurality of baseline network graphs with the one or more current network graphs, and
• comparing the plurality of baseline nodes and the plurality of baseline edges with the plurality of current nodes and the plurality of current edges;
• determining, based on the comparison data, anomaly data comprising one or more flagged network accesses to the enterprise system;
• and
• providing the anomaly data indicating the flagged network accesses to an authentication system.

A non-transitory computer-readable medium having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed, facilitate:

• obtaining access data for an entity, wherein the access data comprises a plurality of access entries associated with network elements the entity uses to access an enterprise system, wherein each of the plurality of access entries comprises a plurality of data elements;
• generating a network graph baseline profile based on the plurality of data elements, wherein the network graph baseline profile comprises a plurality of baseline network graphs, and wherein each network graph comprises a plurality of baseline nodes and a plurality of baseline edges;
• generating a network graph current profile based on the plurality of data elements, wherein the network graph current profile comprises one or more current network graphs, wherein the one or more current network graphs comprise a plurality of current nodes and a plurality of current edges, and wherein each of the plurality of baseline network graphs and the one or more current network graphs are associated with an access entry from the plurality of access entries;
• generating comparison data based on
• comparing the plurality of baseline network graphs with the one or more current network graphs, and
• comparing the plurality of baseline nodes and the plurality of baseline edges with the plurality of current nodes and the plurality of current edges;
• determining, based on the comparison data, anomaly data comprising one or more flagged network accesses to the enterprise system;
• and
• providing the anomaly data indicating the flagged network accesses to an authentication system.