Augmenting system access control perspective

1 . A computer system for database access control, said system comprising:

a hardware processor associated with a memory storing program instructions in a computer system, the hardware processor running the program instructions configuring the processor to:

monitor database usage activities of users of a database resource object, the users having an associated role;

run a machine learned model trained to predict, based on past database resource usage activities by the users having a same associated role, a user activity with respect to a database resource object for a particular role, wherein to monitor database usage activities, the hardware processor is further configured to:

obtain time-series data from past database resource object usage by the users; and

train said machine learned prediction model using said time-series data obtained;

tag, based on said predicted user activity, a user with an associated security level, and tag the database resource object with a resource action level indicating a degree of authorization required to access the database resource object by a user;

in response to a received user request to access a database resource object, grant the user access to the requested database resource object based on that user's associated security level and the resource action level associated with the requested database resource object, wherein the hardware processor is further configured to:

identify, using said machine learned prediction model, patterns of user activity with respect to database resource objects;

associate, based on identified patterns of user activities with respect to a database resource object, a database resource object action; and

modify, responsive to a predicted user activity, said resource action level associated with the database resource object action.

2 . The computer system as claimed in claim 1 , wherein the hardware processor is further configured to:

determine whether the received user request to access a database resource object is an outlier activity with respect to a database resource object usage for the associated user role; and

generate an alert when the received user request is determined as an outlier activity.

3 . The computer system as claimed in claim 2 , wherein the hardware processor is further configured to:

generate, based on said identified user activity patterns, a graph model view for visualizing the user access patterns on a display device, said graph model view having an interconnection of first nodes corresponding to users, and second nodes corresponding to database resources.

4 . The computer system as claimed in claim 3 , wherein the hardware processor is further configured to:

use said graph model view to determine, in real time, whether a current received user request for a database resource is an outlier activity.

5 . The computer system as claimed in claim 2 , wherein the hardware processor is further configured to:

produce one or more implicit sub-groups of users having similar database resource object access requirements;

store said one or more implicit sub-groups of users in a memory; and

limit the resource accesses of users in the implicit sub-group of users according to the users' prior database resource object access activity pattern.

6 . The computer system as claimed in claim 1 , wherein the hardware processor is further configured to:

associate, based on identified patterns of user activities with respect to a database resource object, a time window with database resource object action, the time window indicating a period of time a user is authorized to perform the database resource object action;

determine a time elapsed since a time a user has last performed the action with respect to the database resource object; and

automatically revoke a user's authorization to perform the database resource object action after the elapsed time has exceeded the time window period.

7 . The computer system as claimed in claim 1 , wherein to grant the user to access the requested database resource object, the hardware processor is further configured to:

compare a user's associated security level against the resource action level associated with the requested database resource object; and

grant user access to the requested database resource object when the user's associated security level exceeds the resource action level of the requested database resource object.

8 . The computer system as claimed in claim 1 , wherein the hardware processor is further configured to:

employing said machine learning prediction model and including a time-series analysis, a clustering and an anomaly detection to identify both said pattern of user activities with respect to database resource objects and access boundaries; and

recording unconventional database accesses to result in an increased granular access control and audit without affecting everyday user activities.

9 . The computer system as claimed in claim 1 , wherein the hardware processor is further configured to:

generate a cloud cluster view having nodes representing entities and associated entity attributes;

split/merge a cloud cluster view for connecting a new node representing another entity; and

one of: add/remove the new node in the cluster view instantaneously, in real time.

10 . A method for database access control comprising:

monitoring, using a hardware processor at a computer system, database usage activities of users of a database resource object, the users having an associated role;

running, using the hardware processor, a machine learned model trained to predict, based on past database resource usage activities by the users having a same associated role, a user activity with respect to a database resource object for a particular role, wherein the monitoring of database usage activities of users comprises:

obtaining, using the hardware processor, time-series data from past database resource object usage by the users;

training, using the hardware processor, said machine learned prediction model using said time-series data obtained from past database resource object usage by the users; and

tagging, using a hardware processor, based on said predicted user activity, a user with an associated security level, and tagging the database resource object with a resource action level indicating a degree of authorization required to access the database resource object by a user; and

in response to a received user request to access a database resource object, granting the user to access the requested database resource object based on that user's associated security level and the resource action level associated with the requested database resource object;

identifying, using said machine learned prediction model, patterns of user activity with respect to database resource objects;

associating, based on identified patterns of user activities with respect to a database resource object, a database resource object action; and

modifying, responsive to a predicted user activity, said resource action level associated with the database resource object action.

11 . The method as claimed in claim 10 , further comprising:

determining, using the hardware processor, whether the received user request to access a database resource object is an outlier activity with respect to a database resource object usage for the associated user role; and

generating an alert when the received user request is determined as an outlier activity.

12 . The method as claimed in claim 11 , further comprising:

generating, based on said identified user activity patterns, a graph model view for visualizing the user access patterns on a display device, said graph model view having an interconnection of first nodes corresponding to users, and second nodes corresponding to database resources, and

using said generated graph model view to determine, in real time, whether a current received user request for a database resource is an outlier activity.

13 . The method as claimed in claim 11 , further comprising:

producing, using the hardware processor, one or more implicit sub-groups of users having similar database resource object access requirements;

storing said one or more implicit sub-groups of users in a memory; and

limiting the resource accesses of users in the implicit sub-group of users according to the users' prior database resource object access activity pattern.

14 . The method as claimed in claim 10 , further comprising:

associating, based on identified patterns of user activities with respect to a database resource object, a time window with database resource object action, the time window indicating a period of time a user is authorized to perform the database resource object action;

determining a time elapsed since a time a user has last performed the action with respect to the database resource object; and

automatically revoking a user's authorization to perform the database resource object action after the elapsed time has exceeded the time window period.

15 . The method as claimed in claim 10 , wherein the granting the user to access the requested database resource object comprises:

comparing, using the hardware processor, a user's associated security level against the resource action level associated with the requested database resource object; and

granting user access to the requested database resource object when the user's associated security level exceeds the resource action level of the requested database resource object.

16 . The method as claimed in claim 10 , further comprising:

employing, using the hardware processor, said machine learning prediction model and including a time-series analysis, a clustering and an anomaly detection to identify both said pattern of user activities with respect to database resource objects and access boundaries; and

recording unconventional database accesses to result in an increased granular access control and audit without affecting everyday user activities.

17 . The method as claimed in claim 10 , further comprising:

generating, using the hardware processor, a cloud cluster view having nodes representing entities and associated entity attributes;

splitting/merging a cloud cluster view for connecting a new node representing another entity; and

one of: adding/removing the new node in the cluster view instantaneously, in real time.

18 . A computer program product for database access control, the computer program product comprising:

one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:

program instructions to monitor database usage activities of users of a database resource object, the users having an associated role;

program instructions to run a machine learned model trained to predict, based on past database resource usage activities by the users having a same associated role, a user activity with respect to a database resource object for a particular role, wherein to monitor database usage activities of users, the program instructions further comprise:

program instructions to obtain time-series data from past database resource object usage by the users;

program instructions to train said machine learned prediction model using said time-series data obtained from past database resource object usage by the users;

program instructions to tag, based on said predicted user activity, a user with an associated security level, and tag the database resource object with a resource action level indicating a degree of authorization required to access the database resource object by a user; and

in response to a received user request to access a database resource object, program instructions to grant the user to access the requested database resource object based on that user's associated security level and the resource action level associated with the requested database resource object;

program instructions to identify, using said machine learned prediction model, patterns of user activity with respect to database resource objects;

program instructions to associate, based on identified patterns of user activities with respect to a database resource object, a database resource object action; and

program instructions to modify, responsive to a predicted user activity, said resource action level associated with the database resource object action.

19 . The computer system product as claimed in claim 18 , further comprising:

program instructions to determine whether the received user request to access a database resource object is an outlier activity with respect to a database resource object usage for the associated user role; and

program instructions to generate an alert when the received user request is determined as an outlier activity.