Data-driven attribute selection for user application entitlement analysis

Patent metadata

Field	Value
Publication number	US-11233796-B2
Application number	US-201816146196-A
Country	US
Kind code	B2
Filing date	Sep 28, 2018
Priority date	Sep 28, 2018
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

Techniques are provided for selecting attributes to cluster users for a user application entitlement evaluation. An exemplary method comprises obtaining enterprise reference data indicating a plurality of attributes for a plurality of enterprise users; obtaining enterprise entitlement data indicating user application entitlements for the plurality of enterprise users; selecting at least one of the plurality of attributes as a cluster attribute using predefined information content rules applied on the enterprise entitlement data; determining a probability of a user application entitlement for the one or more user application entitlements based on a number of users for a plurality of values of the cluster attribute and a number of users for a plurality of pairs of the cluster attribute and a value of the one or more user application entitlements; and identifying anomalies in the enterprise entitlement data based on the probability of the user application entitlement for at least one user application entitlement and at least one predefined anomaly threshold.

First claim

What is claimed is:

1. A method, comprising:
obtaining enterprise reference data indicating a plurality of attributes for a plurality of enterprise users;
obtaining enterprise entitlement data indicating one or more user application entitlements for the plurality of enterprise users;
selecting, using at least one processing device, at least one of the plurality of attributes as a cluster attribute, wherein said selecting comprises filtering the plurality of attributes using at least two predefined information content rules applied on the enterprise entitlement data, wherein the at least two predefined information content rules comprise: a cross correlation test that determines a cross correlation for a pair of attributes and removes a given attribute, from the plurality of attributes, having a lower cardinality from the pair of attributes when the cross correlation for the pair of attributes is above a predefined correlation threshold, and a unique values test that removes a given attribute, from the plurality of attributes, having a relative cardinality value above a predefined threshold;
clustering the plurality of enterprise users into a plurality of clusters, wherein each cluster corresponds to a different value of the cluster attribute;
determining, using the at least one processing device, a probability of a user application entitlement for the one or more user application entitlements based on (i) a number of the plurality of enterprise users in each of the plurality of clusters and (ii) a number of the plurality of enterprise users for a plurality of pairs, each pair corresponding to a given one of the clusters and a value of the one or more user application entitlements;
identifying, using the at least one processing device, one or more anomalies in the enterprise entitlement data based on the probability of the user application entitlement for at least one user application entitlement and at least one predefined anomaly threshold; and
triggering, for at least one of the identified one or more anomalies, at least one of: (i) an automated alert and (ii) an automated response describing a context of the at least one identified anomaly.

2. The method of claim 1 , wherein the at least two predefined information content rules comprise an entropy test that removes a given attribute, from the plurality of attributes, below a predefined entropy value.

3. The method of claim 1 , wherein the unique values test comprises removing a given attribute, from the plurality of attributes, that is below a predefined cardinality value.

4. The method of claim 1 , wherein the at least two predefined information content rules comprise a distribution test that removes a given attribute, from the plurality of attributes, having one or more of a percent of users in each element of the given attribute above a predefined value and having a number of users in each element of the given attribute below a predefined value.

5. The method of claim 1 , wherein the probability for a given user application entitlement is the number of users for each pair of the clusters and the given user application entitlement divided by the number of unique users for each of the clusters.

6. The method of claim 1 , further comprising the step of updating one or more of the predefined information content rules and the at least one predefined anomaly threshold based on user feedback.

7. The method of claim 1 , wherein the one or more anomalies in the enterprise entitlement data comprise one or more of an abnormal user application entitlement that is improperly present for at least one user within a same one of the plurality of the clusters that is absent for other peers in the same one of the plurality clusters and a missing user application entitlement that is present for other peers in the same one of the plurality of the clusters and should be granted to another user of the same one of the plurality clusters.

8. A system, comprising:
a memory; and
at least one processor, coupled to the memory, operative to implement the following steps:
obtaining enterprise reference data indicating a plurality of attributes for a plurality of enterprise users;
obtaining enterprise entitlement data indicating one or more user application entitlements for the plurality of enterprise users;
selecting at least one of the plurality of attributes as a cluster attribute, wherein said selecting comprises filtering the plurality of attributes using at least two predefined information content rules applied on the enterprise entitlement data, wherein the at least two predefined information content rules comprise: a cross correlation test that determines a cross correlation for a pair of attributes and removes a given attribute, from the plurality of attributes, having a lower cardinality from the pair of attributes when the cross correlation for the pair of attributes is above a predefined correlation threshold, and a unique values test that removes a given attribute, from the plurality of attributes, having a relative cardinality value above a predefined threshold;
clustering the plurality of enterprise users into a plurality of clusters, wherein each cluster corresponds to a different value of the cluster attribute;
determining a probability of a user application entitlement for the one or more user application entitlements based on (i) a number of the plurality of enterprise users in each of the plurality of clusters and (ii) a number of the plurality of enterprise users for a plurality of pairs, each pair corresponding to a given one of the clusters and a value of the one or more user application entitlements;
identifying one or more anomalies in the enterprise entitlement data based on the probability of the user application entitlement for at least one user application entitlement and at least one predefined anomaly threshold; and
triggering, for at least one of the identified one or more anomalies, at least one of: (i) an automated alert and (ii) an automated response describing a context of the at least one identified anomaly.

9. The system of claim 8 , wherein the probability for a given user application entitlement is the number of users for each pair of the clusters and the given user application entitlement divided by the number of unique users for each of the clusters.

10. The system of claim 8 , wherein the at least two predefined information content rules comprise an entropy test that removes a given attribute, from the plurality of attributes, below a predefined entropy value.

11. The system of claim 8 , wherein the unique values test comprises removing a given attribute, from the plurality of attributes, that is below a predefined cardinality value.

12. The system of claim 8 , wherein the at least two predefined information content rules comprise a distribution test that removes a given attribute, from the plurality of attributes, having one or more of a percent of users in each element of the given attribute above a predefined value and having a number of users in each element of the given attribute below a predefined value.

13. The system of claim 8 , wherein the one or more anomalies in the enterprise entitlement data comprise one or more of an abnormal user application entitlement that is improperly present for at least one user within a same one of the plurality of the clusters that is absent for other peers in the same one of the plurality clusters and a missing user application entitlement that is present for other peers in the same one of the plurality of the clusters and should be granted to another user of the same one of the plurality clusters.

14. The system of claim 8 , w

Assignees

• Emc Ip Holding Co Llc

Inventors

• Li Zhou
• Zaslavsky Alex
• Bowers Kevin

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title