Self-learning peer group analysis for optimizing identity and access management environments

Patent metadata

Field	Value
Publication number	US-11416771-B2
Application number	US-201916679654-A
Country	US
Kind code	B2
Filing date	Nov 11, 2019
Priority date	Nov 11, 2019
Publication date	Aug 16, 2022
Grant date	Aug 16, 2022

Abstract

Mechanisms are provided for identifying risky user entitlements in an identity and access management (IAM) computing system. A self-learning peer group analysis (SLPGA) engine receives an IAM data set which specifies user attributes of users of computing resources and entitlements allocated to the users for accessing the computing resources. The SLPGA engine generates a user-entitlement matrix, performs a machine learning matrix decomposition operation on the user-entitlement matrix to identify excessive entitlement allocations, and performs a conditional entropy analysis of the user attributes and entitlements in the IAM data set to identify a set of user attributes for defining peer groups. The SLPGA engine performs a commonality analysis of user attributes and entitlements for each of one or more peer groups defined based on the set of user attributes, and identifies outlier entitlements based on the identification of the excessive entitlement allocations and results of the commonality analysis.

First claim

What is claimed is:

1. A method, in a data processing system, for identifying risky user entitlements in an identity and access management (IAM) computing system, the method comprising:
receiving, by a self-learning peer group analysis (SLPGA) engine executing in the data processing system, an IAM data set from the IAM computing system, wherein the IAM data set specifies user attributes of one or more users of computing resources and entitlements allocated to one or more users for accessing the computing resources;
generating, by the SLPGA engine, a user-entitlement matrix based on the IAM data set;
executing, by the SLPGA engine, a machine learning matrix decomposition computer model on the user-entitlement matrix to identify excessive entitlement allocations;
performing, by the SLPGA engine, a conditional entropy analysis of the user attributes and entitlements in the IAM data set to identify a set of user attributes for defining at least one peer group;
performing, by the SLPGA engine, a commonality analysis of user attributes and entitlements for each of one or more peer groups defined based on the set of user attributes to identify common and uncommon combinations of user attributes and entitlements in each peer group of the one or more peer groups; and
identifying, by the SLPGA engine, outlier entitlements based on the identification of the excessive entitlement allocations and results of the commonality analysis, wherein executing the machine learning matrix decomposition computer model on the user-entitlement matrix to identify excessive entitlement allocations comprises:
generating an approximation of the user-entitlement matrix by decomposing the user-entitlement matrix; and
generating a reconstruction error of the approximation based on a difference matrix corresponding to a difference between the approximation and the user-entitlement matrix, wherein positive values in the difference matrix indicate potential risk of unnecessary entitlements being assigned to corresponding users and negative values in the difference matrix indicate potential missing entitlements for corresponding users.

2. The method of claim 1 , further comprising:
receiving a commonality threshold parameter indicating a degree of commonality to use for identifying outlier entitlements; and
determining a commonality of entitlements for users within a peer group based on a determination that the user entitlements that do not meet or exceed the commonality threshold parameter are the outlier entitlements.

3. The method of claim 1 , wherein executing the machine learning matrix decomposition computer model generates an error measure for a matrix decomposition operation and performs a machine learning operation on the error measure to minimize the error measure at least by tuning one or more hyperparameters of the machine learning matrix decomposition computer model.

4. The method of claim 1 , wherein the machine learning matrix decomposition computer model comprises a non-negative matrix factorization matrix decomposition model.

5. The method of claim 1 , wherein executing the machine learning matrix decomposition computer model further comprises:
generating a representation of a plot of a rank hyperparameter, k, versus the reconstruction error for a plurality of matrix decompositions; and
selecting a value of k using an elbow methodology based on the representation of the plot.

6. The method of claim 1 , wherein performing the conditional entropy analysis of the user attributes and entitlements in the IAM data set to identify a set of user attributes for defining peer groups, comprises, for each combination of user attribute and entitlement, for each of a plurality of users:
calculating, for the combination of user attribute and entitlement, a corresponding entropy value;
calculating, for the combination of user attribute and entitlement, a corresponding conditional entropy value;
comparing, for the combination of user attribute and entitlement, the conditional entropy value to the entropy value;
in response to the conditional entropy value being equal to or lower than a threshold value below the entropy value, adding the user attribute to a set of user attributes for defining at least one peer group; and
in response to the conditional entropy value not being equal to or lower than a threshold value below the entropy value, not adding the user attribute to the set of user attributes for defining at least one peer group.

7. The method of claim 1 , wherein performing the commonality analysis comprises, for each peer group in the one or more peer groups, and for each combination of user attribute and for each entitlement:
calculating a commonality score based on a percentage of users in the peer group that have the user attribute and entitlement; and
determining a certainty of the entitlement as a function of the commonality score, wherein the function grows linearly for common entitlements and grows exponentially for uncommon entitlements.

8. The method of claim 1 , wherein the data processing system is a cloud computing data processing system and the SLPGA engine is executed as a cloud service in the cloud computing data processing system.

9. The method of claim 1 , wherein the data processing system in which the SLPGA engine is executed is a same data processing system as the IAM computing system.

10. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed in a data processing system, causes the data processing system to:
receive, by a self-learning peer group analysis (SLPGA) engine executing in the data processing system, an IAM data set from the IAM computing system, wherein the IAM data set specifies user attributes of one or more users of computing resources and entitlements allocated to one or more users for accessing the computing resources;
generate, by the SLPGA engine, a user-entitlement matrix based on the IAM data set;
execute, by the SLPGA engine, a machine learning matrix decomposition computer model on the user-entitlement matrix to identify excessive entitlement allocations;
perform, by the SLPGA engine, a conditional entropy analysis of the user attributes and entitlements in the IAM data set to identify a set of user attributes for defining at least one peer group;
perform, by the SLPGA engine, a commonality analysis of user attributes and entitlements for each of one or more peer groups defined based on the set of user attributes to identify common and uncommon combinations of user attributes and entitlements in each peer group of the one or more peer groups; and
identify, by the SLPGA engine, outlier entitlements based on the identification of the excessive entitlement allocations and results of the commonality analysis, wherein executing the machine learning matrix decomposition computer model on the user-entitlement matrix to identify excessive entitlement allocations comprises:
generating an approximation of the user-entitlement matrix by decomposing the user-entitlement matrix; and
generating a reconstruction error of the approximation based on a difference matrix corresponding to a difference between the approximation and the user-entitlement matrix, wherein positive values in the difference matrix indicate potential risk of unnecessary entitlements being assigned to corresponding users and negative values in the difference matrix indicate potential missing entitlements for corresponding users.

11. The computer program product of claim 10 , wherein the computer readable program further causes the data processing system to:
receive a commonality thre

Assignees

• IBM

Inventors

• Patil Priti P
• Veijay Kushaal
• Molloy Ian M

Classifications

• G06N20/00 Primary

  Machine learning · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title