Method and program product for identifying behavioral anomalies and risk factors in software development

1 . A method identifying behavioral anomalies and risk factors comprising:

(A) obtaining, by a risk assessment module, first time-series data associated with activity information of a digital identity with respect to a digital development tool;

(B) identifying, by the risk assessment module, second time-series data included in the first time-series data, wherein the second time-series data is associated with an anomaly of the first time-series data;

(C) associating, by the risk assessment module, the second time-series data with a first risk tag based on a risk-anomaly matrix,

wherein the risk-anomaly matrix is generated based on attack policies and defense policies stored in a risk-anomaly library,

wherein a plurality of the attack policies and defense policies are generated by a reinforcement learning module comprising an attacking agent and a defending agent by the steps comprising, for each scenario of a plurality of scenarios:

(i) generating, by the attacking agent, an attack policy for an environment of the scenario;

(ii) generating, by the defending agent, a defense policy for the environment;

(iii) updating the state of the environment based on the attack policy and the defense policy;

(iv) providing a first reward to the attacking agent and a second reward to the defending agent based on the state of the environment;

(v) modifying the attack policy based on the first reward;

(vi) modifying the defense policy based on the second reward;

(vii) iteratively repeating steps (i) through (vi) for a plurality of states of the scenario; and

(viii) storing a highest scoring attack policy and a highest scoring defense policy in the risk-anomaly library,

wherein an attack policy score is determined by evaluating the attack policy and the environment and a defense policy score is determined by evaluating the defense policy and the environment;

(D) generating, by the risk assessment module, a first predicted anomaly based on the second time-series data and the first risk tag, using a machine learning module trained using a first training set, wherein the first training set comprises the second time-series data and the first risk tag;

(E) associating, by the risk assessment module, the first predicted anomaly with a second risk tag based on the risk-anomaly matrix; and

(F) transmitting, by the risk assessment module, a notification associated with at least one of (i) the anomaly, (ii) the predicted anomaly, or (iii) the digital identity.

2 . The method of claim 1 , wherein the reinforcement learning module comprises at least one of a multi-agent actor-critic algorithm or a proximal policy optimization algorithm.

3 . The method of claim 1 , wherein the environment is based on a generated set of individual risks, interactions between risks, and importance of risk.

4 . The method of claim 1 , wherein each scenario comprises a simulation of a development environment comprising:

(i) a plurality of digital identities,

(ii) a plurality of digital development tools; and

(iii) permissions associated with each of the digital identities and each of the digital development tools.

5 . The method of claim 1 , wherein the reinforcement learning module comprises multi-agent deep deterministic policy gradient algorithms.