Machine learning for identity access management
Inventors
Cobb, Wyatt O'Neill • Misic, Zachary Lewis Jovic
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11899808-B2
Publication Date
2024-02-13
Expiration Date
Abstract
A computer readable medium, a system, and a method for providing data security through identity access management using a transaction classifier to classify transactions according to a set of transaction data associated with the transaction and mitigate abnormal transactions. The transaction classifier is trained using a set of training data and updated after each transaction. The identity access management may also include a mitigation policy that is used to determine a mitigation technique for each transaction.
Core Innovation
The invention relates to an identity access management system that updates a mitigation policy by receiving transaction data relating to a transaction for an authorized user account. The system determines a transaction type of the transaction based on the transaction data, identifies an abnormality associated with the transaction based on the transaction data using a machine learning model trained with user data, and determines a threat level associated with the transaction based on the transaction data and the transaction type.
Responsive to identifying the abnormality, the system determines a mitigation procedure from the mitigation policy based on the transaction type of the transaction and the threat level associated with the transaction. The mitigation procedure is applied to the transaction based on the transaction type, and the system stores the transaction data, an indication of the mitigation procedure, and an indication of the threat level associated with the transaction in a transaction data store.
The mitigation policy is updated based on the transaction data and the transaction type of the transaction. The document further describes mitigation procedures being selected using threat level and transaction type, with abnormality classification producing a normality score or threat level, and the mitigation policy and classifier being updated in real time using newly received transaction data and their classifications.
The system integrates with identity governance and privileged access management databases, supports flagging and transaction tickets for administrators, and can use a CVE registry to detect common threats matching the transaction type.
Claims Coverage
The independent claims set out an end-to-end updating process for an identity access management mitigation policy using transaction-type determination, machine-learning-based abnormality identification, threat-level determination, mitigation-procedure selection and application, result storage, and mitigation policy updating. The independent claims cover both method and system implementations and include four additional inventive features.
Threat-level-driven mitigation policy updating
Receives transaction data relating to a transaction for a user account, determines a transaction type, identifies an abnormality using a machine learning model trained with user data, determines a threat level based on the transaction data and the transaction type, determines a mitigation procedure from a mitigation policy based on the transaction type and the threat level, applies the mitigation procedure based on the transaction type, stores transaction data with an indication of the mitigation procedure and threat level, and updates the mitigation policy based on the transaction data and the transaction type.
CVE-registry-based common threat identification
Accesses a CVE registry of common threats and uses it to identify a common threat matching the transaction type.
Administrative transaction ticket generation
Generates a transaction ticket from a transaction type and the associated threat level, and presents the ticket to an administrator user.
Biometric authentication as part of multifactor authentication routine
Includes a multifactor authentication routine that performs biometric authentication of the authorized user account.
The inventive coverage centers on updating an IAM mitigation policy using transaction-type determination, machine-learning-based abnormality identification, threat-level determination, and selecting and applying a mitigation procedure based on transaction type and threat level, with persistence of mitigation and threat indicators and policy updating. Dependent coverage further emphasizes CVE-registry-based threat identification, administrative transaction tickets, and biometric authentication within multifactor authentication.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?