Risk assessment for network access control through data analytics

A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for automatically evaluating and responding to network security risks, comprising:

• determining, using a machine-learning process, event clusters associated with a long-term memory and a short-term memory based on a profile for an identity;
• identifying a new event associated with the identity;
• determining a risk level for the new event based on:
• generating an event vector representing the new event, and
• determining a vector distance between the event vector and a center vector of at least one of the event clusters;
• accessing a set of security rules;
• and
• performing a security action based on the risk level and the set of security rules.

A computer-implemented method for automatically evaluating and responding to network security risks, comprising:

• determining, using a machine-learning process, event clusters associated with a long-term memory and a short-term memory based on a profile for an identity;
• identifying a new event associated with the identity;
• determining a risk level for the new event based on:
• generating an event vector representing the new event, and
• determining a vector distance between the event vector and a center vector of at least one of the event clusters;
• accessing a set of security rules;
• and
• performing a security action based on the risk level and the set of security rules.