Patent application EP20158110A (EP), filed 2020-02-19
Publication number: EP3757843A1
Title: SECURITY MONITORING PLATFORM FOR MANAGING ACCESS RIGHTS ASSOCIATED WITH CLOUD APPLICATIONS
Abstract: A security monitoring platform may use an unsupervised machine learning technique to cluster historical data related to user access rights associated with multiple cloud applications based on various features that relate to user permissions and attributes within the multiple cloud applications. The security monitoring platform may use a supervised machine learning technique to train an access rights data model based on the clustered historical data and perform one or more actions that relate to current access rights assigned to at least one user within one or more of the multiple cloud applications based on a score representing a probability that an access level assigned to the at least one user within the one or more of the multiple cloud applications is correct. The security monitoring platform may apply a reinforcement learning technique to update the access rights data model based on feedback related to the one or more actions.
IPC codes: G06F  21/    55            A I
G06F  21/    60            A I
Claims: number: 1
text: A method, comprising:
number: 2
text: The method of claim 1, wherein the one or more actions include at least one of revoking, elevating, or maintaining the current access rights assigned to the at least one user.
number: 3
text: The method of claim 1 or 2, wherein the unsupervised machine learning technique includes a k-means clustering technique used to assign each of the features included in the historical data to one of multiple clusters with a nearest mean.
number: 4
text: The method of any one of the preceding claims, wherein the supervised machine learning technique includes a naive Bayes classification technique that approximates a mapping function from the features included in the historical data to the multiple clusters.
number: 5
text: The method of any one of the preceding claims, wherein the reinforcement learning technique is applied to update the mapping function based on one or more state changes that affect the user access rights associated with the multiple cloud applications.
number: 6
text: The method of any one of the preceding claims, wherein the unsupervised machine learning technique comprises a decision tree model;
and/or
wherein the access rights data model comprises a linear regression model.
number: 7
text: The method of any one of the preceding claims, further comprising:
receiving one or more user-defined rules,
wherein the one or more actions are performed based on the score and based on the one or more user-defined rules.
number: 8
text: A device, comprising:
number: 9
text: The device of claim 8, wherein the one or more actions include at least one of revoking or elevating the access level assigned to the at least one user;
and/or
wherein the one or more processors are further configured to:
number: 10
text: The device of claim 8 or 9, wherein the access rights data model is trained based further on a supervised machine learning technique that approximates a mapping function from the one or more feature sets to the multiple clusters.
number: 11
text: The device of any one of claims 8 to 10, wherein the historical data obtained from the at least one cloud application is encrypted using a public key associated with the device, and
wherein the one or more processors are further configured to:
decrypt the historical data using a private key associated with the device prior to transforming the historical data into the tabular format.
number: 12
text: The device of any one of claims 8 to 11, wherein the reinforcement learning technique is to be applied to update the access rights data model based on changes to one or more access control policies that affect user access rights associated with the at least one cloud application;
and/or
wherein the one or more processors, when applying the reinforcement learning technique, are configured to:
number: 13
text: A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
number: 14
text: The non-transitory computer-readable medium of claim 13, wherein the reinforcement learning technique is applied to update the mapping function based on one or more state changes that affect user access rights associated with the multiple cloud applications;
and/or
wherein the one or more instructions that cause the one or more processors to apply the reinforcement learning technique further cause the one or more processors to:
number: 15
text: The non-transitory computer-readable medium of claim 13 or 14, wherein the reinforcement learning technique applies a reward based on the feedback indicating that the modification to the current access level is approved or a penalty based on the feedback indicating that the modification to the current access level is revised or rejected;
and/or
wherein the feedback is provided by a user authorized to apply changes to user access rights associated with the multiple cloud applications
Office action: search_report, dated 2020-12-30
Prior art cited: ref_id: WO0214987A2
ref_type: patent
severity: background
ref_id: US2006277184A1
ref_type: patent
severity: background
ref_id: US2012246098A1
ref_type: patent
severity: background
ref_id: US2018248889A1
ref_type: patent
severity: background
ref_id: WO0214987
ref_type: patent
severity: background
ref_id: US2006277184
ref_type: patent
severity: background
ref_id: US2012246098
ref_type: patent
severity: background
ref_id: US2018248889
ref_type: patent
severity: background
Final disposition: pending (2020-12-30)