Patent AU-2019200530-B2 (AU)
Title: Identifying network security risks
Inventor: DIVALENTIN LOUIS WILLIAM
IPC: G06F21/50
Filed: 2019-01-25
Granted: 2021-03-04
Abstract: A computer-implemented method for identifying computer network security risks, 
the method including retrieving, using a data extraction processor, organization data that 
represents a plurality of individuals in an organizational hierarchy of an organization, 
wherein the organization data includes data that indicates, for each individual of the 
plurality of individuals, one or more groups to which the individual belongs, for at least one 
of the groups, determining a group score that represents a criticality of the group within the 
organization, retrieving, using the data extraction processor, access privilege data that 
indicates, for each individual of the plurality of individuals, one or more access privileges 
that have been assigned to the individual for computer network resources, for at least one 
of the access privileges, determining an access privilege score that represents an access 
privilege risk associated with potential misuse of the access privilege, generating a data 
structure using a matrix processor, wherein the data structure is an adjacency matrix that 
represents connections between the plurality of individuals and the one or more groups, 
and that represents connections between the plurality of individuals and the one or more 
access privileges, wherein a connection between an individual and the at least one of the 
groups is associated with the determined group score, and a connection between the 
individual and the at least one of the access privileges is associated with the determined 
access privilege score, storing the adjacency matrix in a computer-readable medium, 
modifying, using the matrix processor, the stored adjacency matrix by replacing values that 
indicate connections between the plurality of individuals and the one or more access 
privileges with one or more determined access privilege scores, reducing data storage 
demands by collapsing the modified adjacency matrix stored in the computer-readable 
medium, wherein the modified adjacency matrix is collapsed, using the matrix processor, 
by linking individuals, from the plurality of individuals, in the modified adjacency matrix 
using the one or more determined access privilege scores, selecting, using an analytic 
processor, an analytic technique for analyzing the collapsed adjacency matrix, based on 
applying the selected analytic technique, for each individual of the plurality of individuals, 
using the analytic processor to determine an individual score that represents a security risk 
associated with a network account of the individual, using a security control processor to 
determine, for a particular individual, that the individual score meets a predetermined
threshold, and in response to the determining that the individual score meets a 
predetermined threshold, using the security control processor to automatically apply one or 
more security controls to the computer network account of the particular individual, wherein 
applying the one or more security controls includes triggering an endpoint device to log 
activity associated with the computer network account of the particular individual.
12587-0594001 
1/5 
0 C4 
Q~001 
00 
C (n 
E3 0)v
E 
U) U 
U) CY)C _4 
t C4 C4 
I.o 0U) 
coo/ C/) 
.o 2 2 
co 
VU
00 
-)