Insider threat detection utilizing user group to data object and/or resource group access analysis
US11146573B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jan 22, 2019 |
| Grant date | Oct 12, 2021 |
| Priority date | — |
| Expiry date | Sep 8, 2039 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L67/535
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Techniques for detecting suspicious data object access requests indicative of potential insider threats are described. A suspicious access detection module (SADM) determines, based on access data describing a access requests issued on behalf of multiple users, groups of the users having similar patterns of accesses to resource groups, a set of the resource groups accessed by each of the user groups, and ones of the user groups that are to be considered nearby others of the user groups based on having a threshold amount of resource group access similarities. The SADM causes an alert to be generated responsive to a determination that a subsequent access request is suspicious because it accesses a data object of a resource group that is not within the set of accessed resource groups of the issuing user's user group, and because the resource group is not within the sets of accessed resource groups of any nearby user groups.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.