Patent ID: 11863576
Assignee: NETAPP, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 12:
13. A computing device comprising:
a memory containing a machine-readable medium comprising machine executable code having stored thereon instructions for performing a method of detecting anomalies; and
a processor coupled to the memory, the processor configured to execute the machine executable code to:
compute one or more access rates of a set of entities for each user of a plurality of users, wherein the one or more access rates refers to data operations for the set of entities stored by the computing device;
normalize the one or more access rates of the set of entities for a first subset of the plurality of users by dividing a respective user's access rate by a total rate of a community, the respective user being part of the first subset belonging to the community, the community being based on access to the set of entities by the first subset of the plurality of users, and the one or more normalized access rates including a first normalized access rate for a first user of the first subset;
detect a first anomaly in response to the determination that the first normalized access rate satisfies a first threshold; and
restrict access by the first user to the set of entities in response to detecting the first anomaly.