Systems and methods for detecting anomalous behavior in shared data repositories

1. A computer-implemented method for detecting anomalous behavior in shared data repositories, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a shared data repository that comprises a plurality of files that are accessed by a plurality of users;

monitoring access to the plurality of files in the shared data repository for a predetermined time period in order to determine which files within the plurality of files are accessed by each user within the plurality of users during the predetermined time period;

creating a graph of the access to the plurality of files in the shared data repository, the graph comprising vertices connected by edges, wherein each vertex in the graph represents a separate user within the plurality of users and each edge in the graph, that connects two vertices representing two users, represents that one or more files in the plurality of files were accessed during the predetermined time period by the two users;

deriving, from the graph, a set of communities, wherein each community comprises a cluster of connected vertices within the graph that represent a set of users that collaborated on one or more files within the plurality of files during the predetermined time period;

determining that a first user within the plurality of users who belongs to a community within the set of communities has an anomalous collaboration pattern based on determining that a collaboration pattern of the first user does not match a collaboration pattern for the community observed during the predetermined time period; and

securing data within the shared data repository from access by the first user.

2. The computer-implemented method of claim 1 , wherein determining that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern comprises determining that the first user has accessed at least one file in common with users who collectively belong to an anomalous amount of communities within the set of communities, wherein the anomalous amount of communities within the set of communities do not comprise the community.

3. The computer-implemented method of claim 1 , wherein determining that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern comprises:

calculating a set of touched communities for the first user in the graph, wherein each touched community within the set of touched community comprises a vertex that shares an edge with a vertex that represents the first user;

calculating an additional set of touched communities for the first user in a more recent graph, wherein the more recent graph represents access to the plurality of files during a new predetermined time period that is more recent than the predetermined time period; and

dividing the cardinality of the intersection of the set of touched communities for the first user in the graph and the additional set of touched communities for the first user in the more recent graph by the cardinality of the union of the set of touched communities for the first user in the graph and the additional set of touched communities for the first user in the more recent graph.

4. The computer-implemented method of claim 1 , wherein determining that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern comprises:

creating, from the graph, a subgraph of the collaboration pattern for the first user; and

analyzing the subgraph of the collaboration pattern for the first user.

5. The computer-implemented method of claim 1 , further comprising:

monitoring access to the plurality of files in the shared data repository for a new predetermined time period that begins after the predetermined time period began; and

updating the graph of the access to the plurality of files in the shared data repository to reflect file access performed by each user within the plurality of users during the new predetermined time period.

6. The computer-implemented method of claim 5 , further comprising:

determining that the set of communities derived from the graph no longer accurately represents a current state of the updated graph; and

deriving, from the updated graph, a new set of communities, wherein each new community comprises a cluster of connected vertices within the updated graph that represent a set of users that collaborated on one or more files within the plurality of files during the new predetermined time period.

7. The computer-implemented method of claim 1 , wherein creating the graph of the access to the plurality of files in the shared data repository comprises:

determining a set of windows of time during the predetermined time period;

for each window of time in the set of windows of time, creating a subgraph of access to the plurality of files in the shared data repository during the window of time; and

combining the subgraphs of access to the plurality of files in the shared data repository during each window of time into the graph of the access to the plurality of files in the shared data repository.

8. The computer-implemented method of claim 7 , wherein combining the subgraphs of access to the plurality of files in the shared data repository during each window of time into the graph comprises determining that the subgraphs comprise sufficient file access data to meet a predetermined threshold for file access data required to create a graph of the access to the plurality of files in the shared data repository.

9. A system for detecting anomalous behavior in shared data repositories, the system comprising:

an identification module, stored in memory, that identifies a shared data repository that comprises a plurality of files that are accessed by a plurality of users;

a monitoring module, stored in memory, that monitors access to the plurality of files in the shared data repository for a predetermined time period in order to determine which files within the plurality of files are accessed by each user within the plurality of users during the predetermined time period;

a creation module, stored in memory, that creates a graph of the access to the plurality of files in the shared data repository, the graph comprising vertices connected by edges, wherein each vertex in the graph represents a separate user within the plurality of users and each edge in the graph, that connects two vertices representing two users, represents that one or more files in the plurality of files were accessed during the predetermined time period by the two users;

a deriving module, stored in memory, that derives, from the graph, a set of communities, wherein each community comprises a cluster of connected vertices within the graph that represent a set of users that collaborated on one or more files within the plurality of files during the predetermined time period;

a determination module, stored in memory, that determines that a first user within the plurality of users who belongs to a community within the set of communities has an anomalous collaboration pattern based on determining that a collaboration pattern of the first user does not match a collaboration pattern for the community observed during the predetermined time period and secures data within the shared data repository from access by the first user; and

at least one physical processor configured to execute the identification module, the monitoring module, the creation module, the deriving module, and the determination module.

10. The system of claim 9 , wherein the determination module determines that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern by determining that the first user has accessed at least one file in common with users who collectively belong to an anomalous amount of communities within the set of communities, wherein the anomalous amount of communities within the set of communities do not comprise the community.

11. The system of claim 9 , wherein the determination module determines that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern comprises:

calculating a set of touched communities for the first user in the graph, wherein each touched community within the set of touched community comprises a vertex that shares an edge with a vertex that represents the first user;

calculating an additional set of touched communities for the first user in a more recent graph, wherein the more recent graph represents access to the plurality of files during a new predetermined time period that is more recent than the predetermined time period; and

dividing the cardinality of the intersection of the set of touched communities for the first user in the graph and the additional set of touched communities for the first user in the more recent graph by the cardinality of the union of the set of touched communities for the first user in the graph and the additional set of touched communities for the first user in the more recent graph.

12. The system of claim 9 , wherein the determination module determines that the first user who belongs to the community within the set of communities has the anomalous collaboration pattern comprises:

creating, from the graph, a subgraph of the collaboration pattern for the first user; and

analyzing the subgraph of the collaboration pattern for the first user.

13. The system of claim 9 , wherein:

the monitoring module monitors access to the plurality of files in the shared data repository for a new predetermined time period that begins after the predetermined time period began; and

the creation module updates the graph of the access to the plurality of files in the shared data repository to reflect file access performed by each user within the plurality of users during the new predetermined time period.

14. The system of claim 13 wherein the deriving module:

determines that the set of communities derived from the graph no longer accurately represents a current state of the updated graph; and

derives, from the updated graph, a new set of communities, wherein each new community comprises a cluster of connected vertices within the updated graph that represent a set of users that collaborated on one or more files within the plurality of files during the new predetermined time period.

15. The system of claim 9 , wherein the creation module creates the graph of the access to the plurality of files in the shared data repository by:

determining a set of windows of time during the predetermined time period;

for each window of time in the set of windows of time, creating a subgraph of access to the plurality of files in the shared data repository during the window of time; and

combining the subgraphs of access to the plurality of files in the shared data repository during each window of time into the graph of the access to the plurality of files in the shared data repository.

16. The system of claim 15 , wherein the creation module combines the subgraphs of access to the plurality of files in the shared data repository during each window of time into the graph by determining that the subgraphs comprise sufficient file access data to meet a predetermined threshold for file access data required to create a graph of the access to the plurality of files in the shared data repository.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a shared data repository that comprises a plurality of files that are accessed by a plurality of users;

monitor access to the plurality of files in the shared data repository for a predetermined time period in order to determine which files within the plurality of files are accessed by each user within the plurality of users during the predetermined time period;

create a graph of the access to the plurality of files in the shared data repository, the graph comprising vertices connected by edges, wherein each vertex in the graph represents a separate user within the plurality of users and each edge in the graph, that connects two vertices representing two users, represents that one or more files in the plurality of files were accessed during the predetermined time period by the two users;

derive, from the graph, a set of communities, wherein each community comprises a cluster of connected vertices within the graph that represent a set of users that collaborated on one or more files within the plurality of files during the predetermined time period;

determine that a first user within the plurality of users who belongs to a community within the set of communities has an anomalous collaboration pattern based on determining that a collaboration pattern of the first user does not match a collaboration pattern for the community observed during the predetermined time period; and

secure data within the shared data repository from access by the first user.