Patent ID: 11936677
Assignee: TATA CONSULTANCY SERVICES LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 0:
1. A processor-implemented method, comprising:
receiving, via one or more hardware processors, an enterprise data specific to one or more individuals associated with an enterprise from a plurality of sources, wherein the one or more individuals comprises of at least one of one or more vendors, one or more employees and one or more contractors associated with the enterprise;
pre-processing, via the one or more hardware processors, the received enterprise data to obtain an intermediate common input representation;
creating, via the one or more hardware processors, an enterprise graph between one or more entities from the obtained intermediate common input representation, wherein the one or more entities includes the one or more individuals and one or more assets associated with the enterprise, and wherein the enterprise graph includes a plurality of vertices consisting of the one or more entities associated with the enterprise in a present time period and a past time period, and a plurality of edges between the one or more entities and a plurality of attributes associated with the plurality of vertices and the plurality of edges;
calculating, via the one or more hardware processors, a weight for each of the plurality of edges between any two connected entities based on a plurality of enterprise graph features and the plurality of attributes;
detecting, via the one or more hardware processors, one or more communities of the one or more individuals by using a plurality of graph-based techniques based on the calculated weights of the plurality of edges;
calculating, via the one or more hardware processors, a threshold behavior for the one or more individuals and the one or more detected communities within an observation window by applying a plurality of statistical methods based on the plurality of enterprise graph features and the plurality of attributes;
performing, via the one or more hardware processors, a comparison of the threshold behavior of the one or more individuals calculated within the observation window with a current behavior of the one or more individuals to identify one or more potential insiders;
performing, via the one or more hardware processors, a comparison of the current behavior of the one or more potential insiders and the current behavior of a plurality of individuals of the one or more detected communities to identify the one or more potential insiders as one or more relevant insiders;
calculating, via the one or more hardware processors, a susceptibility of the plurality of individuals for probable influence by the one or more relevant insiders based on an analysis of a plurality of scenarios, wherein the plurality of scenarios includes hierarchy exploitation, relationship exploitation and mixed mode;
calculating, via the one or more hardware processors, a plurality of paths taken by the one or more relevant insiders based on the calculated susceptibility of the plurality of individuals; and
performing, via the one or more hardware processors, an analysis of the calculated paths to obtain a probability score indicative of a probable data loss.