Machine learning for identity access management

Inventors

Cobb, Wyatt O'Neill • Misic, Zachary Lewis Jovic

Assignees

Softwarfare LLC

Abstract

A computer readable medium, a system, and a method for providing data security through identity access management using a transaction classifier to classify transactions according to a set of transaction data associated with the transaction and mitigate abnormal transactions. The transaction classifier is trained using a set of training data and updated after each transaction. The identity access management may also include a mitigation policy that is used to determine a mitigation technique for each transaction.

Core Innovation

The invention provides identity access management that uses transaction classification to decide whether a pending transaction proceeds or is mitigated. Training data is received from a training database and comprises historical transaction data, and in other instances access control policy, subject attributes, and environmental attributes. A transaction classifier is trained using the training data, and pending transaction data associated with a user account is received from at least one of an authentication database, an authorization database, and an identity database.

The method classifies the pending transaction as either normal or abnormal using the transaction classifier and the received transaction data. If the pending transaction is classified as normal, the method allows the pending transaction to proceed and determines an authorization privilege of the user account according to the transaction data. If the pending transaction is classified as abnormal, the method mitigates the pending transaction according to a mitigation policy.

The invention updates both the transaction classifier and the mitigation policy in real-time based on the transaction data and the classification of the transaction. The document describes mitigation approaches that include flagging, blocking, additional authentication, locking/quarantining, and admin notification via transaction tickets. The system architecture includes bidirectionally connected identity access management database components that connect with authentication, identity, and authorization databases, and it uses training and threat-related data stores.

The document further describes that the transaction classifier can be an artificial neural network algorithm trained using training data that includes access control policy, subject attributes, and environmental attributes, with real-time updates based on transaction data and the transaction classification. Examples include using historical transactions and security scenarios with situational parameters to train the neural network-based transaction classifier, and mapping threat-level outputs to mitigation actions and storing threat information such as threat records and administrator-visible transaction tickets.

Claims Coverage

The document contains three independent claims (one for computer-readable media, one for a system, and one for a method). Collectively, they cover training a transaction classifier on historical and structured training data, classifying pending transactions tied to user accounts as normal or abnormal, allowing normal transactions and determining authorization privilege, mitigating abnormal transactions via a mitigation policy, and updating both the classifier and the mitigation policy in real-time.

Across the independent claims, the core claim coverage focuses on real-time identity access management driven by a transaction classifier trained from training data, including historical transaction data and, in the system and method claims, access control policy, subject attributes, and environmental attributes. The classifier labels pending user-account-associated transactions as normal or abnormal, with normal transactions being allowed and abnormal transactions being mitigated according to a mitigation policy. The classifier and mitigation policy are updated in real-time based on transaction data and classification.

Stated Advantages

Documented Applications