TECHNICAL FIELD

The present disclosure relates generally to data analytics. More specifically, but not by way of limitation, this disclosure relates to database improvements that provide the ability to link data anonymously between separate data sources.

BACKGROUND

As regulations protecting privacy become increasingly common and stringent, it becomes increasingly important to find ways to anonymously and securely handle data in distributed systems. Typically, when integrating data across different databases, personally identifying information (PII) is exchanged. Some solutions to reduce transmission of PII between systems include using a shared identifier as a placeholder for such PII data. However, even when transmitting a shared identifier, sensitive information can be extracted.

As an example application, risk monitoring is common in the context of credit. Such monitoring involves analyzing a great deal of data from widely distributed computing devices, as thousands of transactions are conducted every day, and each may have an impact on credit risk. Employers, such as government agencies, use credit reports as part of the background investigation process and for periodic review of employees. Particularly for government agencies handling sensitive information, the employees must also be periodically reviewed for risk indicators such as financial strain. Traditionally, these periodic reviews are conducted by retrieving employee credit reports from a credit monitoring service every few years or several times per year. However, a credit report is out of date the day after it is pulled. Thus, current methods for identifying risk indicators in such inside-threat contexts are inefficient and ineffective. Moreover, by sharing the credit report repeatedly, a credit inquiry is recorded to the credit file. Thus, frequent credit monitoring of an individual runs the risk of revealing the identity of the individual. This is particularly problematic in the case of individuals holding security clearances, as such information may be used to infer participation in intelligence agencies or other protected groups.

SUMMARY

Various embodiments of the present disclosure provide systems and methods for continuous and anonymous risk evaluation. A monitoring system may monitor a periodically updated dataset for warnings or indicators of an insider threat. An insider threat is a threat to an organization originating within the organization, such as from employees or contractors with access to data, computer systems, and security processes. An insider threat may, for example, arise if an employee falls under financial stress and sells confidential information. By identifying preliminary indicators of such an insider threat, losses can be prevented.

In one example, a server computer of a monitoring system can receive, from a requesting entity computer (e.g., associated with an employer), a request for monitoring of a plurality of target entities. For each target entity, of the plurality of target entities, the request comprises a first identifier associated with the target entity and information about the target entity. For each target entity, of the plurality of target entities, the server computer generates a second identifier associated with the target entity based on the information about the target entity, the second identifier being prevented from being provided to the requesting entity computer. The server computer generates a third identifier associated with the monitored target entity when a rule is satisfied or threshold exceeded. The generated result is associated by the third identifier for reference as a randomly-generated, transaction ID. The server computer stores, in a secure database, a mapping of the second identifier to the first identifier and the third identifier when a result is generated through monitoring. The server computer monitors a periodically updated data set and determines a risk metric for the target entity based on monitoring the periodically updated data set. The server computer compares the risk metric of the target entity to a threshold value to identify a subset of the plurality of target entities discovering events defined as risk indicators of an insider threat and assigns corresponding third identifiers. The server computer provides the third identifiers with the risk indicators to the requesting entity computer. Responsive to providing the third identifiers, the server computer receives, from the requesting entity computer, a request for a first identifier associated with a unique third identifier. The server computer uses the third identifier and the stored mapping to identify the requested first identifier, and provides the first identifier and the third identifier to the requesting entity computer.

This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in isolation to determine the scope of the claimed subject matter. The subject matter should be understood by reference to appropriate portions of the entire specification, any or all drawings, and each claim.

