System for detecting anomalous access to tables

Patent metadata

Field	Value
Publication number	US-2021073409-A1
Application number	US-201916563877-A
Country	US
Kind code	A1
Filing date	Sep 8, 2019
Priority date	Sep 8, 2019
Publication date	Mar 11, 2021
Grant date	—

Abstract

A system and method for detecting anomalous access to tables is described. A query for accessing a table from a requesting user is received. A set of users similar to the requesting user is determined. The probability that the requesting user should access the table is calculated. Whether the user should be accessing the table based on the calculated probability is determined.

First claim

What is claimed is:

1 . A system for detecting anomalous access to tables comprising:
a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving a query for accessing a table from a requesting user;
determining a set of users similar to the requesting user;
calculating the probability that the requesting user should access the table;
determining whether the user should be accessing the table based on the calculated probability.

2 . The system of claim 1 , wherein the table comprises at least one of personal identifiable information of customers or unique identifiers of financial instruments.

3 . The system of claim 1 , wherein determining the set of users similar to the request user is based on a company's organization chart.

4 . The system of claim 3 , wherein determining the set of users similar to the requesting user is further based on the requesting user and the set of users similar to the requesting user being assigned to a common project.

5 . The system of claim 1 , wherein determining the set of users similar to the requesting user is further based on historical data on table access.

6 . The system of claim 1 , wherein the probability is calculated using collaborative filtering.

7 . The system of claim 1 , wherein the determining whether the user should be accessing the table is based on whether the calculated probability exceeded a predetermined threshold.

8 . A method for detecting anomalous access to tables comprising:
receiving a query for accessing a table from a requesting user; determining that the requesting user does not have table access history; identifying a set of users closest to the requesting user; calculating the probability that the requesting user should access the table; and determining whether the user should be accessing the table based on the calculated probability.

9 . The method of claim 8 , wherein the requesting user is a new employee at a company.

10 . The method of claim 8 , wherein identifying the set of users closest to the requesting user is based on a company's organization chart.

11 . The method of claim 10 , wherein the set of user closest to the requesting user includes k closest users, wherein k is a predefined number.

12 . The method of claim 10 , wherein the set of user closest to the requesting user is identified based on at least one of users reporting to a same manager, users having a same title, or users working in a same department.

13 . The method of claim 10 , wherein the probability is calculated using collaborative filtering.

14 . The method of claim 8 , wherein the table comprises sensitive information including at least one of personal identifiable information of customers or unique identifiers of financial instruments.

15 . A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause performance of operations comprising:
receiving a query for accessing a table from a requesting user; determining a set of users similar to the requesting user; calculating the probability that the requesting user should access the table; determining whether the user should be accessing the table based on the calculated probability.

16 . The non-transitory machine-readable medium of claim 15 , wherein the table comprises at least one of personal identifiable information of customers or unique identifiers of financial instruments.

17 . The non-transitory machine-readable medium of claim 15 , wherein determining the set of users similar to the request user is based on a company's organization chart.

18 . The non-transitory machine-readable medium of claim 17 , wherein determining the set of users similar to the requesting user is further based on the requesting user and the set of users similar to the requesting user being assigned to a common project.

19 . The non-transitory machine-readable medium of claim 15 , wherein determining the set of users similar to the requesting user is further based on historical data on table access.

20 . The non-transitory machine-readable medium of claim 15 , wherein the probability is calculated using collaborative filtering.

Assignees

• Paypal Inc

Inventors

• Kimon Liron Florens Ben
• Perkal Yotam
• Shafet Yuri

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F18/23213

  with fixed number of clusters, e.g. K-means clustering · CPC title

• G06F16/9035

  Filtering based on additional data, e.g. user or group profiles · CPC title

• G06F17/18

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title