System and method for assessing insider influence on enterprise assets

Patent metadata

Field	Value
Publication number	US-2022131890-A1
Application number	US-202117452186-A
Country	US
Kind code	A1
Filing date	Oct 25, 2021
Priority date	Oct 26, 2020
Publication date	Apr 28, 2022
Grant date	—

Abstract

This disclosure relates generally to system and method for assessing insider influence on enterprise assets. Existing work focuses on the detection of insider threat and does not consider the influence of an insider on their peers and subordinates. The present disclosure aggregates and preprocesses the enterprise data specific to the individuals received from various sources, and further creates an enterprise graph between entities. Weights of every edge connected between any two entities in the enterprise graph is then calculated. Community of the individuals are detected wherein, relevant insider(s) are identified, and susceptibility of the individuals for probable influence by relevant insider(s) based on the analysis scenarios(s) is calculated. Paths taken by the relevant insider(s) is calculated for estimating probability of data loss. The present disclosure identifies the assets which are under possible threat from the relevant insider(s), obtains cumulative risk associated with the enterprise and generates an analysis report accordingly.

First claim

What is claimed is:

1 . A processor-implemented method, comprising:
receiving, via one or more hardware processors, an enterprise data specific to one or more individuals associated with an enterprise from a plurality of sources, wherein the one or more individuals comprises of at least one of one or more vendors, one or more employees and one or more contractors associated with the enterprise; pre-processing, via the one or more hardware processors, the received enterprise data to obtain an intermediate common input representation; creating, via the one or more hardware processors, an enterprise graph between one or more entities from the obtained intermediate common input representation, wherein the one or more entities includes the one or more individuals and one or more assets associated with the enterprise, and wherein the enterprise graph includes a plurality of vertices consisting of the one or more entities associated with the enterprise in a present time period and a past time period, and a plurality of edges between the one or more entities and a plurality of attributes associated with the plurality of vertices and the plurality of edges; calculating, via the one or more hardware processors, a weight for each of the plurality of edges between any two connected entities based on a plurality of enterprise graph features and the plurality of attributes; detecting, via the one or more hardware processors, one or more communities of the one or more individuals by using a plurality of graph-based techniques based on the calculated weights of the plurality of edges; calculating, via the one or more hardware processors, a threshold behavior for the one or more individuals and the one or more detected communities within an observation window by applying a plurality of statistical methods based on the plurality of enterprise graph features and the plurality of attributes; performing, via the one or more hardware processors, a comparison of the threshold behavior of the one or more individuals calculated within the observation window with a current behavior of the one or more individuals to identify one or more potential insiders; performing, via the one or more hardware processors, a comparison of the current behavior of the one or more potential insiders and the current behavior of a plurality of individuals of the one or more detected communities to identify the one or more potential insiders as one or more relevant insiders; calculating, via the one or more hardware processors, a susceptibility of the plurality of individuals for probable influence by the one or more relevant insiders based on an analysis of a plurality of scenarios, wherein the plurality of scenarios includes hierarchy exploitation, relationship exploitation and mixed mode; calculating, via the one or more hardware processors, a plurality of paths taken by the one or more relevant insiders based on the calculated susceptibility of the plurality of individuals; and performing, via the one or more hardware processors, an analysis of the calculated paths to obtain a probability score indicative of a probable data loss.

2 . The processor implemented method of claim 1 , wherein the plurality of attributes comprises attributes specific to (i) the one or more assets and (ii) the one or more individuals associated with the enterprise.

3 . The processor implemented method of claim 1 , further comprising identifying at least a subset of one or more impacting assets from the one or more assets based on the probable data loss.

4 . The processor implemented method of claim 3 , further comprising estimating risk associated with the one or more impacting assets and obtaining cumulative risk associated with the enterprise based on the probable data loss.

5 . The processor implemented method of claim 1 , generating an analysis report comprising at least one of: the information of the one or more relevant insiders, the plurality of individuals affected by the one or more relevant insiders, the paths taken by the one or more relevant insiders to influence the plurality of individuals, the susceptibility of the plurality of individuals for probable influence by the one or more relevant insiders, the probability of data loss, the impacting one or more assets and the estimated risk.

6 . A system, comprising:
a memory storing instructions; one or more communication interfaces; and one or more hardware processors coupled to the memory via the one or more communication interfaces, wherein the one or more hardware processors are configured by the instructions to: receive an enterprise data specific to one or more individuals associated with an enterprise from a plurality of sources, wherein the one or more individuals comprises of at least one of one or more vendors, one or more employees and one or more contractors associated with the enterprise; pre-process the received enterprise data to obtain an intermediate common input representation; create an enterprise graph between one or more entities from the obtained intermediate common input representation, wherein the one or more entities includes the one or more individuals and one or more assets associated with the enterprise, and wherein the enterprise graph includes a plurality of vertices consisting of the one or more entities associated with the enterprise in a present time period and a past time period, and a plurality of edges between the one or more entities and a plurality of attributes associated with the plurality of vertices and the plurality of edges; calculate a weight for each of the plurality of edges between any two connected entities based on a plurality of enterprise graph features and the plurality of attributes; detect one or more communities of the one or more individuals by using a plurality of graph-based techniques based on the calculated weights of the plurality of edges; calculate a threshold behavior for the one or more individuals and the one or more detected communities within an observation window by applying a plurality of statistical methods based on the plurality of enterprise graph features and the plurality of attributes; perform a comparison of the threshold behavior of the one or more individuals calculated within the observation window with a current behavior of the one or more individuals to identify one or more potential insiders; perform a comparison of the current behavior of the one or more potential insiders and the current behavior of a plurality of individuals of the one or more detected communities to identify the one or more potential insiders as one or more relevant insiders; calculate a susceptibility of the plurality of individuals for probable influence by the one or more relevant insiders based on an analysis of a plurality of scenarios, wherein the plurality of scenarios includes hierarchy exploitation, relationship exploitation and mixed mode; calculate a plurality of paths taken by the one or more relevant insiders based on the calculated susceptibility of the plurality of individuals; and perform an analysis of the calculated paths to obtain a probability score indicative of a probable data loss.

7 . The system of claim 6 , wherein the plurality of attributes comprises attributes specific to (i) the one or more assets and (ii) the one or more individuals associated with the enterprise.

8 . The system of claim 6 , wherein the one or more hardware processors are further configured to identify at least a subset of one or more impacting assets from the one or more assets based on the probable data loss.

9 . The system of claim 8 , wherein the one or more hardware processors are further configured to estimate risk associated with the one or more impacting

Assignees

• Tata Consultancy Services Ltd

Inventors

• Shukla Manish
• Lodha Sachin Premsukh

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/102

  Entity profiles · CPC title