Patent ID: 8793790

Claim:
A method comprising: obtaining, from a storage device, data related to accessing cyber assets and accessing physical assets from a combined cyber access and physical access control system that protects cyber and physical assets of an organization from both authorized and unauthorized access with malicious intent; applying machine learning algorithms to data from the cyber and physical access control system to build expected behavior models representative of expected behavior, the expected behavior models based on a context and a relationship of the data related to accessing cyber assets and accessing physical assets; comparing, via a programmed computer, newly obtained data to known patterns of expected behavior as represented in the expected behavior models, the comparing including abstracting the newly obtained data to reduce a searching element of the comparing to a subset of a semantic graph representing the known patterns of expected behavior; identifying, via the programmed computer, patterns of suspicious behavior as a function of comparing the data to the known patterns of expected behavior; and utilizing the comparison to identify, via the programmed computer, potentially malicious insider behavior toward the cyber and physical assets.