Method and system for identifying security risks using graph analysis

Patent metadata

Field	Value
Publication number	US-9819685-B1
Application number	US-201514603728-A
Country	US
Kind code	B1
Filing date	Jan 23, 2015
Priority date	Dec 10, 2014
Publication date	Nov 14, 2017
Grant date	Nov 14, 2017

Abstract

Methods, systems, apparatus, and non-transitory computer readable media are described for identifying users who are likely to have unauthorized access to secure data files in an organizational network. Various aspects may include presenting the identified users on a display for a system administrator and/or security analyst to resolve. For example, the display may include a graph data structure with users represented as nodes and connections between users represented as edges. Each connection may be a pair of users belonging to a same security group. The graph data structure display may be organized and color coded in such a manner, that a system administrator and/or security analyst may quickly and easily view the users who are most likely to have unauthorized access to secure data files. The authorized access may then be remedied or taken away.

First claim

We claim:

1. A computer-implemented method for identifying users of an information security system for determining risk of unauthorized access to secure data assets, the method executed by one or more processors programmed to perform the method, the method comprising:
identifying, by one or more processors, a plurality of users, wherein each user has a job function related to a role of the user within an organization and is associated with an organizational network which contains a plurality of secure data assets and a plurality of security groups, each security group having permission to access at least one secure data asset and corresponding to at least one of the plurality of users;
for each of the plurality of users:
causing, by the one or more processors, a node of a graph data structure representing the user to be displayed on a user interface of a computing device;
identifying, by the one or more processors, a connection between the node of the user and a node of another user of the plurality of users when the user and the other user both correspond to a same security group of the plurality of security groups;
causing, by the one or more processors, the connection between the corresponding node for the user and the other user to be displayed as an edge of the graph data structure on the user interface;
identifying, by the one or more processors, a node corresponding to a user which is connected to at least two other nodes corresponding to at least two other users who belong to a unique combination of different security groups;
determining, by the one or more processors, that the user corresponding to the identified node has access to at least two different sets of secure data assets;
determining, by the one or more processors, that the identified node has a potential security risk; and
highlighting, by the one or more processors, the identified node and respective connections to the at least two other nodes corresponding to the unique combination of different security groups to identify the user that presents a risk of having unauthorized access to secure data assets.

2. The method of claim 1 , further comprising:
determining, by the one or more processors, a clustering coefficient for a subset of the plurality of nodes; and
causing, by the one or more processors, the subset of nodes to be displayed on the user interface in a cluster based upon the determined clustering coefficient.

3. The method of claim 1 , further comprising:
determining, by the one or more processors, a shortest path between each pair of nodes of the plurality of nodes based upon the connections between the nodes, wherein the shortest path between a pair of nodes is a least number of interconnected nodes in which a first node must pass through to reach a second node; and
for each of the plurality of nodes:
determining, by the one or more processors, a betweenness centrality for the particular node, wherein the betweenness centrality is based upon a number of shortest paths which include the particular node wherein the particular node is not the first node or the second node.

4. The method of claim 3 , further comprising increasing, by the one or more processors, a size of each node in the plurality of nodes based upon the determined betweenness centrality for each node.

5. The method of claim 3 , further comprising:
ranking, by the one or more processors, each of the plurality of users based upon the betweenness centrality for the corresponding respective nodes; and
providing, by the one or more processors, the ranking of the plurality of users to the computing device.

6. The method of claim 3 , further comprising removing, by the one or more processors, a user from one or more of the corresponding security groups for the user, when the betweenness centrality for the user is greater than a predetermined threshold.

7. The method of claim 3 , wherein determining the betweenness centrality for the particular node comprises;
for each pair of nodes in the plurality of nodes not including the particular node, determining, by the one or more processors, a likelihood that the particular node is included in a shortest path between the pair of nodes; and
aggregating, by the one or more processors, the likelihoods for each pair of nodes.

8. The method of claim 1 , further comprising:
generating, by the one or more processors, a set of indicators, each indicator identifying a different job function corresponding to the plurality of users; and
for each of the plurality of nodes, causing, by the one or more processors, the indicator identifying the job function of the corresponding user to be displayed with the node on the user interface.

9. The method of claim 1 , wherein identifying a plurality of users includes obtaining, by the one or more processors, at least one of: (i) user data, (ii) job function data, or (iii) security group data from a database, and further comprising:
transforming, by the one or more processors, at least one of: (i) the user data, (ii) the job function data, or (iii) the security group data to one or more graph data structure elements to generate the graph data structure.

10. The method of claim 1 , wherein a node corresponding to a user which is connected to at least two other nodes corresponding to at least two other users who belong to different security groups is identified by:
for each of a plurality of subsets of the plurality of nodes, clustering the subset of the plurality of nodes when a clustering coefficient for the subset exceeds a predetermined threshold indicating that users in the subset belong to a same security group; and
identifying that the node is connected to at least two other nodes each belonging to a different cluster.

11. A system for identifying users of an information security system for determining risk of unauthorized access to secure data assets, the system comprising:
one or more processors; and
a non-transitory computer-readable memory coupled to the one or more processors and storing thereon instructions that, when executed by the one or more processors, cause the system to:
identify a plurality of users, wherein each user has a job function related to a role of the user within an organization and is associated with an organizational network which contains a plurality of secure data assets and a plurality of security groups, each security group having permission to access at least one secure data asset and corresponding to at least one of the plurality of users;
for each of the plurality of users:
cause a node of a graph data structure representing the user to be displayed on a user interface of a computing device,
identify a connection between the node of the user and a node of another user of the plurality of users when the user and the other user both correspond to a same security group of the plurality of security groups,
cause the connection between the corresponding node for the user and the other user to be displayed as an edge of the graph data structure on the user interface;
identify a node corresponding to a user which is connected to at least two other nodes corresponding to at least two other users who belong to a unique combination of different security groups;
determine that the user corresponding to the identified node has access to at least two different sets of secure data assets;
determine that the identified node has a potential security risk; and
highlight the identified node and respective connections to the at least two other nodes corresponding to the unique combination of different security groups to identify the user that presents a risk of having unauthorized access to secure data assets.

Assignees

• State Farm Mutual Automobile Insurance Co

Inventors

• Scott Abigail A
• Duehr Ronald R

Classifications

• H04L63/104 Primary

  Grouping of entities · CPC title