Acquiring statistical access models

摘要

One or more embodiments include collecting data associated with a first access profile, collecting data associated with a second access profile, determining whether the data associated with the first access profile has a particular number of characteristics in common with the data associated with the second access profile, assigning a statistical access model associated with the second access profile to the first access profile based on the particular number of characteristics that the data associated with first access profile has in common with the data associated with the second access profile, and detecting an anomalous access event based on the statistical access model.

主权项

1. A method for acquiring statistical access models, comprising:
collecting data associated with a first access profile for a first group of users that includes a designated user, wherein the first group of users is distinct from a second group of users; collecting data associated with a second access profile for the second group of users; comparing the data associated with the first access profile to the data associated with the second access profile, wherein the data includes a job title associated with the first access profile and a job title associated with the second access profile respectively; determining whether the data associated with the first access profile has a particular number of characteristics in common with the data associated with the second access profile; determining a first statistical access model based on the first access profile and a second statistical access model based on the second access profile; merging the first statistical access model and the second statistical access model into a merged statistical access model in response to a determination that the data associated with the first access profile has the particular number of characteristics in common with the data associated with the second access profile; assigning the merged statistical access model to the first access profile for the designated user; and detecting an anomalous access event of the designated user based on the merged statistical access model.