BACKGROUND

The present disclosure relates generally to threat detection, and more particularly, to techniques (e.g., systems, methods, computer program products storing code or instructions executable by one or more processors) for managing user access to resources in an enterprise environment.

Computer networks have become important tools for modern business. Today a large amount of information is stored in and accessed across such networks by users throughout the world. Much of this information is, to some degree, private or confidential and protection of the information is required. Not surprisingly then, various network security monitor devices have been developed to help uncover attempts by unauthorized persons and/or devices to gain access to computer networks and the information stored therein.

In the context of enterprise systems, a user identity generally refers to information that uniquely identifies a user. By providing some of such information to a network security monitor device of the enterprise system, a user may be permitted to access various resources available within the enterprise. These resources can include, for example, software products, applications (e.g., cloud-based applications, enterprise applications, or any other applications), cloud services, various types of data (e.g., networked files, directory information, databases, or the like) and other resources. In order to effectively manage user access to resources within an enterprise, the enterprise often has to monitor and track the users' access to information stored in multiple target systems of the enterprise.

Therefore, techniques for managing user access to available resources within an enterprise environment continues to be a priority and are desired.

BRIEF SUMMARY

In various embodiments, techniques are provided (e.g., a method, a system, non-transitory computer-readable medium storing code or instructions executable by one or more processors) for monitoring user access and detecting threats in real-time by detecting anomalous access requests from users. In various embodiments, a method is provided for accessing management of a target resource. The method includes receiving, at a computing system from a client application executing at a computing device, data associated with an access request, the access request requesting access to the target resource on a target system, by a user; analyzing, by the computing system, the data associated with the access request against data collected concerning interactions between the user and one or more enforcement policies to obtain a rule or policy based risk for the user; analyzing, by the computing system, the data associated with the access request against a behavior model associated with the user to obtain a behavior based risk for the user; determining, by the computing system, a threat perception for the user based on the rule or policy based risk for the user and the behavior based risk; and transmitting, by the computing system, the threat perception score to at least one of: the target system, the target resource, a visualization server, and an access manager such that the at least one of: the target system, the target resource, the visualization server, and the access manager allow, challenge, or deny access to the target resource based on the threat perception score for the user.

In some embodiments, the method further includes selecting, by the computing system, the behavior model from a plurality of behavior models associated with the user, wherein: (i) the selection is based on the data associated with the access request, (ii) the selected behavior model includes a data cluster generated based on a parameter of data, and (iii) the data associated with the access request includes data associated with the parameter of data.

In some embodiments, the method further includes generating, by the computing system, the plurality of behavior models, where the generating the plurality of behavior models comprises: obtaining, by the computing system, a plurality of historical access requests associated with the user over a period of time; identifying, by the computing system, a set of parameters associated with data from the plurality of historical access requests to be monitored; and analyzing, by the computing system, the data from the plurality of historical access requests against the set of parameters to generate the plurality of behavior models.

Optionally, the analyzing the data from the plurality of historical access requests comprises generating, by the computing system, the behavior model by classifying the data from the plurality of historical access requests against the parameter and using a clustering algorithm on the classified data to generate the data cluster. The set of parameters to be monitored may be identified by the target application on the target system.

Optionally, the analyzing the data associated with the access request against the behavior model comprises: (i) determining, by the computing system, a deviation of the access request from one or more data clusters of the behavior model, and (ii) obtaining, by the computing system, the behavior based risk for the user based on the deviation.

Optionally, the analyzing the data associated with the access request against the data collected concerning the interactions between the user and the one or more enforcement policies comprises: (i) determining, by the computing system, a number of times that the user successfully or unsuccessfully accessed the target application on the target system, and (ii) obtaining, by the computing system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully accessed the target application.

In some embodiments, the method further includes assigning, by the computing system, a first weight to the rule or policy based risk for the user, and assigning, by the computing system, a second weight to the behavior based risk for the user.

In various embodiments a system is provided for access management of a target resource. The system includes one or more processors and non-transitory machine readable storage medium; a distributed environment that includes a user device, a plurality of agents, an access management and threat detection system, an information management system, and target system having a target resource; and program instructions configured to: receive, at the information management system from the user device, data associated with an access request, the access request requesting access to the target resource, by a user; analyze, by the information management system, the data associated with the access request against data collected concerning interactions between the user and one or more enforcement policies deployed within the access management and threat detection system to obtain a rule or policy based risk for the user; analyze, by the information management system, the data associated with the access request against a behavior model associated with the user to obtain a behavior based risk for the user; determine, by the information management system, a threat perception for the user based on the rule or policy based risk for the user and the behavior based risk; and transmit, by the information management system, the threat perception score to the access management and threat detection system such that the access management and threat detection system allows, challenges, or denies access to the target resource based on the threat perception score for the user. The program instructions are stored on the non-transitory machine readable storage medium for execution by the one or more processors.

In some embodiments, the program instructions are further configured to select, by the information management system, the behavior model from a plurality of behavior models associated with the user, wherein: (i) the selection is based on the data associated with the access request, (ii) the selected behavior model includes a data cluster generated based on a parameter of data, and (iii) the data associated with the access request includes data associated with the parameter of data.

In some embodiments, the program instructions are further configured to generate, by the information management system, the plurality of behavior models, where the generating the plurality of behavior models comprises: obtaining, by the access management and threat detection system, a plurality of historical access requests associated with the user over a period of time; identifying, by the information management system, a set of parameters associated with data from the plurality of historical access requests to be monitored; and analyzing, by the information management system, the data from the plurality of historical access requests against the set of parameters to generate the plurality of behavior models.

Optionally, the analyzing the data from the plurality of historical access requests comprises generating, by the computing system, the behavior model by classifying the data from the plurality of historical access requests against the parameter and using a clustering algorithm on the classified data to generate the data cluster. The set of parameters to be monitored may be identified by the target application on the target system.

Optionally, the analyzing the data associated with the access request against the behavior model comprises: (i) determining, by the information management system, a deviation of the access request from one or more data clusters of the behavior model, and (ii) obtaining, by the information management system, the behavior based risk for the user based on the deviation.

Optionally, the analyzing the data associated with the access request against the data collected concerning the interactions between the user and the one or more enforcement policies comprises: (i) determining, by the information management system, a number of times that the user successfully or unsuccessfully accessed the target application on the target system, and (ii) obtaining, by the information management system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully accessed the target application.

In some embodiments, the program instructions are further configured to assign, by the information management system, a first weight to the rule or policy based risk for the user, and assigning, by the information management system, a second weight to the behavior based risk for the user.

In various embodiments, a non-transitory machine readable storage medium is provided for=access management of a target resource. The non-transitory machine readable storage medium having instructions stored thereon that when executed by one or more processors cause the one or more processors to perform a method comprising: receiving, at an information management system from a user device, data associated with an access request, the access request requesting access to a target resource on a target system, by a user; analyzing, by the information management system, the data associated with the access request against data collected concerning interactions between the user and one or more enforcement policies deployed within an access management and threat detection system to obtain a rule or policy based risk for the user; analyzing, by the information management system, the data associated with the access request against a behavior model associated with the user to obtain a behavior based risk for the user; determining, by the information management system, a threat perception for the user based on the rule or policy based risk for the user and the behavior based risk; and transmitting, by the information management system, the threat perception score to the access management and threat detection system such that the access management and threat detection system allows, challenges, or denies access to the target resource based on the threat perception score for the user.

Optionally, the analyzing the data associated with the access request against the behavior model comprises: (i) determining, by the information management system, a deviation of the access request from one or more data clusters of the behavior model, and (ii) obtaining, by the information management system, the behavior based risk for the user based on the deviation.

Optionally, the analyzing the data associated with the access request against the data collected concerning the interactions between the user and the one or more enforcement policies comprises: (i) determining, by the information management system, a number of times that the user successfully or unsuccessfully accessed the target application on the target system, and (ii) obtaining, by the information management system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully accessed the target application.

In some embodiments, the method further comprises assigning, by the information management system, a first weight to the rule or policy based risk for the user, and assigning, by the information management system, a second weight to the behavior based risk for the user.

In various embodiments, a method is provided for preventing insider attacks from within a system. The method includes monitoring, by a computing system, one or more live information flows, where the live information flows include flows of data from users within user sessions to a plurality of destinations on a system; analyzing, by the computing system, the data associated with the one or more live information flows against data collected concerning interactions between each of the users and one or more enforcement policies to obtain a rule or policy based risk for each of the users; analyzing, by the computing system, the data associated with the one or more live information flows against a behavior model associated with each of the users to obtain a behavior based risk for each of the users; determining, by the computing system, a threat perception for each of the users based on the rule or policy based risk and the behavior based risk obtained for each of the users, respectively; and transmitting, by the computing system, the threat perception score to at least one of: the target system, the target resource, a visualization server, and an access manager such that the at least one of: the target system, the target resource, the visualization server, and the access manager allow, challenge, or deny activity of each of the users based on the threat perception score determined for each of the users, respectively.

In some embodiments, the method further includes generating, by the computing system, one or more behavior models for each of the users, where the generating the one or more behavior models comprises: obtaining, by the computing system, a plurality of historical user activity associated with each of the users over a period of time; identifying, by the computing system, a set of parameters associated with data from the plurality of historical access requests to be monitored, wherein the set of parameters are identified based on multiple factors including a pattern of system usage by users or a group of users that are similar to each of the users; and analyzing, by the computing system, the data from the plurality of historical access requests against the set of parameters to generate the plurality of behavior models.

Optionally, the analyzing the data from the plurality of historical access requests comprises generating, by the computing system, the behavior model associated with each of the users by classifying the data from the plurality of historical access requests against the set of parameters and using a clustering algorithm on the classified data to generate one or more data clusters within each of the behavior models associated with each of the users.

Optionally, the analyzing the data associated with the one or more live information flows against the behavior model associated with each of the users comprises: (i) determining, by the computing system, a deviation of the activity within the live information flows from the one or more data clusters within each of the behavior models associated with each of the users, and (ii) obtaining, by the computing system, the behavior based risk for each of the users based on the deviation, respectively.

Optionally, the analyzing the data associated with the one or more live information flows against the data collected concerning the interactions between each of the users and the one or more enforcement policies comprises: (i) determining, by the computing system, a number of times that each of the users successfully or unsuccessfully performed the activity, and (ii) obtaining, by the computing system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully performed the activity.

In some embodiments, the method further includes assigning, by the computing system, a first weight to the rule or policy based risk for each of the users, and assigning, by the computing system, a second weight to the behavior based risk for each of the users, wherein the first weight and the second weight are assigned based on a frequency the activity within the system.

In some embodiments, the method further includes: providing, by the computing system, a user interface that includes a depiction of each of the live information flows from each of the users to each of the destinations on the system, wherein the user interface further includes a depiction of the threat perception determined for each of the users; determining, by the computing system, an occurrence of a security event within the one or more live information flows based on a trigger of an enforcement policy from the one or more enforcement policies, wherein the enforcement policy includes a specification of a source, a destination, and an enforcement action, and when the data within the one or more live information flows matches at least the source and the destination of the enforcement policy, the enforcement policy is triggered and the enforcement action is applied; and updating, by the computing system, the user interface to reflect the occurrence of the security event by: (i) identifying the user that is associated with the enforcement action applied by the enforcement policy, and (ii) updating the threat perception determined for the user based on the occurrence of the security event.

In various embodiments, a system is provided for preventing insider attacks from within a system. The system includes: one or more processors and non-transitory machine readable storage medium; a distributed environment that includes a plurality of user devices, a plurality of agents, an access management and threat detection system, an information management system, and a plurality of destinations on a system; and program instructions configured to: monitor, by the access management and threat detection system, one or more live information flows, where the live information flows include flows of data from the plurality of user devices to the plurality of destinations on the system; analyze, by the information management system, the data associated with the one or more live information flows against data collected concerning interactions between each user associated with each of the plurality of user devices and one or more enforcement policies deployed within the access management and threat detection system to obtain a rule or policy based risk for each of the users; analyze, by the information management system, the data associated with the one or more live information flows against a behavior model associated with each of the users to obtain a behavior based risk for each of the users; determine, by the information management system, a threat perception for each of the users based on the rule or policy based risk and the behavior based risk obtained for each of the users, respectively; and transmit, by the information management system, the threat perception score to the access management and threat detection system such that the access management and threat detection system allows, challenges, or denies activity of each of the users based on the threat perception score determined for each of the users, respectively. The program instructions are stored on the non-transitory machine readable storage medium for execution by the one or more processors.

In some embodiments, the program instructions are further configured to generate, by the information management system, one or more behavior models for each of the users, where the generating the one or more behavior models comprises: obtaining, by the access management and threat detection system, a plurality of historical user activity associated with each of the users over a period of time; identifying, by the information management system, a set of parameters associated with data from the plurality of historical access requests to be monitored, wherein the set of parameters are identified based on multiple factors including a pattern of system usage by users or a group of users that are similar to each of the users; and analyzing, by the information management system, the data from the plurality of historical access requests against the set of parameters to generate the plurality of behavior models.

Optionally, the analyzing the data from the plurality of historical access requests comprises generating, by the information management system, the behavior model associated with each of the users by classifying the data from the plurality of historical access requests against the set of parameters and using a clustering algorithm on the classified data to generate one or more data clusters within each of the behavior models associated with each of the users.

Optionally, the analyzing the data associated with the one or more live information flows against the behavior model associated with each of the users comprises: (i) determining, by the information management system, a deviation of the activity within the live information flows from the one or more data clusters within each of the behavior models associated with each of the users, and (ii) obtaining, by the information management system, the behavior based risk for each of the users based on the deviation, respectively.

Optionally, the analyzing the data associated with the one or more live information flows against the data collected concerning the interactions between each of the users and the one or more enforcement policies comprises: (i) determining, by the information management system, a number of times that each of the users successfully or unsuccessfully performed the activity, and (ii) obtaining, by the information management system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully performed the activity.

In some embodiments, the program instructions are further configured to assign, by the information management system, a first weight to the rule or policy based risk for each of the users, and assign, by the computing system, a second weight to the behavior based risk for each of the users, wherein the first weight and the second weight are assigned based on a frequency the activity within the system.

In some embodiments, the program instructions are further configured to: provide, by the information management system, a user interface that includes a depiction of each of the live information flows from each of the users to each of the destinations on the system, wherein the user interface further includes a depiction of the threat perception determined for each of the users; determine, by the information management system, an occurrence of a security event within the one or more live information flows based on a trigger of an enforcement policy from the one or more enforcement policies, wherein the enforcement policy includes a specification of a source, a destination, and an enforcement action, and when the data within the one or more live information flows matches at least the source and the destination of the enforcement policy, the enforcement policy is triggered and the enforcement action is applied; and update, by the information management system, the user interface to reflect the occurrence of the security event by: (i) identifying the user that is associated with the enforcement action applied by the enforcement policy, and (ii) updating the threat perception determined for the user based on the occurrence of the security event.

In various embodiments, a non-transitory machine readable storage medium is provided for preventing insider attacks from within a system. The non-transitory machine readable storage medium having instructions stored thereon that when executed by one or more processors cause the one or more processors to perform a method comprising: monitoring, by an access management and threat detection system, one or more live information flows, where the live information flows include flows of data from users within user sessions to a plurality of destinations on a system; analyzing, by the information management system, the data associated with the one or more live information flows against data collected concerning interactions between each of the users and one or more enforcement policies deployed within the access management and threat detection system to obtain a rule or policy based risk for each of the users; analyzing, by the information management system, the data associated with the one or more live information flows against a behavior model associated with each of the users to obtain a behavior based risk for each of the users; determining, by the information management system, a threat perception for each of the users based on the rule or policy based risk and the behavior based risk obtained for each of the users, respectively; and transmitting, by the information management system, the threat perception score to at least one of: the target system, the target resource, a visualization server, and an access manager such that the at least one of: the target system, the target resource, the visualization server, and the access manager allow, challenge, or deny activity of each of the users based on the threat perception score determined for each of the users, respectively.

Optionally, the analyzing the data from the plurality of historical access requests comprises generating, by the information management system, the behavior model associated with each of the users by classifying the data from the plurality of historical access requests against the set of parameters and using a clustering algorithm on the classified data to generate one or more data clusters within each of the behavior models associated with each of the users.

Optionally, the analyzing the data associated with the one or more live information flows against the behavior model associated with each of the users comprises: (i) determining, by the information management system, a deviation of the activity within the live information flows from the one or more data clusters within each of the behavior models associated with each of the users, and (ii) obtaining, by the information management system, the behavior based risk for each of the users based on the deviation, respectively.

Optionally, the analyzing the data associated with the one or more live information flows against the data collected concerning the interactions between each of the users and the one or more enforcement policies comprises: (i) determining, by the information management system, a number of times that each of the users successfully or unsuccessfully performed the activity, and (ii) obtaining, by the information management system, the rule or policy based risk for the user based on the number of times that the user successfully or unsuccessfully performed the activity.

In some embodiments, the method further comprises assigning, by the information management system, a first weight to the rule or policy based risk for each of the users, and assign, by the computing system, a second weight to the behavior based risk for each of the users, wherein the first weight and the second weight are assigned based on a frequency the activity within the system.

In some embodiments, the method further comprises: providing, by the information management system, a user interface that includes a depiction of each of the live information flows from each of the users to each of the destinations on the system, wherein the user interface further includes a depiction of the threat perception determined for each of the users; determining, by the information management system, an occurrence of a security event within the one or more live information flows based on a trigger of an enforcement policy from the one or more enforcement policies, wherein the enforcement policy includes a specification of a source, a destination, and an enforcement action, and when the data within the one or more live information flows matches at least the source and the destination of the enforcement policy, the enforcement policy is triggered and the enforcement action is applied; and updating, by the information management system, the user interface to reflect the occurrence of the security event by: (i) identifying the user that is associated with the enforcement action applied by the enforcement policy, and (ii) updating the threat perception determined for the user based on the occurrence of the security event.

The techniques described above and below may be implemented in a number of ways and in a number of contexts. Several example implementations and contexts are provided with reference to the following figures, as described below in more detail. However, the following implementations and contexts are but a few of many.

