2_use_case_name: Compliance Data Warehouse Data Access Log Monitoring
3_agency: Department of the Treasury
3_abr: TREAS
4_bureau: Internal Revenue Service
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: The purpose of this AI project is to provide insights into access and usage patterns improving understanding of Compliance Data Warehouse (CDW) data usage and Personally Identifiable Information (PII) exposure risks. It does so by comparing a user's activity to a distribution of similar users, based on access groups, and provides a score based on how far from expected normal behavior that user's activity performed. This model is only used to inform humans rather than automating a decision. This model automates the manual analysis of log data to identify and rank anomalous user activity for further investigation. Humans review the AI output prior to taking action on the result. They do so by reviewing AI outputs (i.e., model scores, feature ranking, user's historic log data) in a Tableau Dashboard and automated emailed reports. The benefits of this project are the automated multivariate analysis of CDW usage data in order to flag anomalous user activity that may otherwise go unnoticed via manual univariate analysis. The direct impact of this decision is the ability to routinely identify and evaluate high-risk events to avoid future security risks. No population is directly impacted by this AI as it is only used to inform the RAAS Infrastructure Security Team in order to conduct further outreach and investigation of anomalous user activity.
12_outputs: The AI model outputs a table of scored query activity per user per day where a higher score is interpreted as more anomalous activity, as well as feature ranking and score for each given output row where the score of a feature is the distance from the normal value for the population for that feature. The output of the broader system also includes supplemental score data such as flagging reoccurring anomalous behavior and the user's activity score percentile compared to the group they were modeled against. The model scores in addition to contextual information (i.e., discovery directory information and entitlement information) and supplemental statistics are displayed in a dashboard for the intended users.
16_dev_stage: Acquisition and/or Development
17_impact_type: Neither
18_date_initiated: 2/8/2024
19_date_acq_dev_began: 2/8/2024
22_dev_method: Developed with contracting resources.
23_contract_piids: 2032H5-22-F-00432
24_hisp_support: No
31_data_catalog: Other
31_question_type: Our team produces an aggregated set of metrics from the raw CDW production log data.
33_agency_data: Our team produces an aggregated set of metrics from the raw CDW production log data. This is merged with internally available employee information for identifying users by business unit, and entitlement information to identify Common and Special Access Groups (CAGs/SAGs).
34_data_docs: Documentation is complete: Documentation exists regarding the maintenance, composition, quality, and intended use of the training and evaluation data, as well as any statistical bias across model features and protected groups.
40_has_ato: Yes
41_system_name: RAS-1
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: Yes
45_compute_request: Yes
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Documentation has been developed: Complete documentation detailing model performance across a range of benchmarks, architecture, relevant features and information regarding the appropriate use of the model for predictive tasks has been created.