Detection of fraudulent user access based on context analysis

A system for detecting potential fraudulent privileged user accesses, comprising:

• a program store storing a code;
• and
• at least one processor coupled to the program store for executing the stored code, the code comprising:
• code instructions to collect a plurality of access attributes identified during at least one privileged access conducted by at least one user using at least one client device, the plurality of access attributes relate to at least some of:
• a location of the at least one user, the at least one client device, a network environment, interaction of the at least one user with at least one user input interface of the at least one client device,
• code instructions to create a feature vector for the at least one privileged access based on a combination of at least some of the plurality of access attributes,
• code instructions to compute, in real-time, an access score indicative of deviation of the feature vector from at least one typical feature vector created for the at least one user based on a plurality of previous privileged accesses conducted by the at least one user, and
• code instructions to initiate at least one fraudulent privileged access mitigation action responsive to determining that the access score exceeds a certain threshold indicative of potential fraudulent privileged accesses.