Detection of malicious intent in privileged identity environments

1. A computer-implemented method comprising:

receiving a request to authenticate a user to remotely access a secure device;

establishing, in response to the user being granted remote access to the secure device, a remote user session for the user;

identifying a plurality of actions performed during the remote user session, wherein the plurality of actions includes at least one action performed on the secure device;

comparing a first combination of actions in the plurality of actions to a plurality of policies for malicious intent, wherein:

at least one action in the first combination of actions is authorized during the remote user session;

determining a level of risk for the first combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

generating, in response to the level of risk of the first combination of actions exceeding a given threshold level, one or more preventive actions.

2. The computer-implemented method of claim 1 , wherein generating the one or more preventive actions is based, at least in part, on:

the first combination of actions; and

the level of risk associated with the first combination of actions.

3. The computer-implemented method of claim 1 , wherein determining the level of risk for malicious intent for the first combination of actions is further based, at least in part, on analyzing historical session data corresponding to the user.

4. The computer-implemented method of claim 3 , further comprising:

increasing the level of risk for malicious intent associated with the first combination of actions based, at least in part, on the first combination of actions deviating from the historical session data.

5. The computer-implemented method of claim 1 , further comprising:

comparing a second combination of actions in the plurality of actions to the plurality of policies for malicious intent, wherein:

at least one action in the second combination of actions is authorized during the remote user session;

determining a level of risk for malicious intent for the second combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

monitoring, in response to the level of risk of the second combination of actions falling below the given threshold level, additional actions performed during the remote user session.

6. The computer-implemented method of claim 1 , further comprising:

identifying a pattern of performing the first combination of actions over a given period of time; and

modifying the one or more preventive actions based on identifying the pattern.

7. The computer-implemented method of claim 1 , wherein the plurality of policies for malicious intent include one or more policies to detect malware.

8. The computer-implemented method of claim 1 , wherein the one or more preventive actions include terminating the remote user session.

9. A computer program product, the computer program product comprising one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to:

receive a request to authenticate a user to remotely access a secure device;

establish, in response to the user being granted remote access to the secure device, a remote user session for the user;

identify a plurality of actions performed during the remote user session, wherein the plurality of actions includes at least one action performed on the secure device;

compare a first combination of actions in the plurality of actions to a plurality of policies for malicious intent, wherein:

at least one action in the first combination of actions is authorized during the remote user session;

determine a level of risk for malicious intent for the first combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

generate, in response to the level of risk of the first combination of actions exceeding a given threshold level, one or more preventive actions, wherein the one or more preventive actions include terminating the remote user session.

10. The computer program product of claim 9 , wherein the program instructions to generate the one or more preventive actions is based, at least in part, on:

the first combination of actions; and

the level of risk associated with the first combination of actions.

11. The computer program product of claim 9 , wherein the program instructions to determine the level of risk for malicious intent for the first combination of actions is further based, at least in part, on program instructions to analyze historical session data corresponding to the user.

12. The computer program product of claim 11 , further comprising program instructions to:

increase the level of risk for malicious intent associated with the first combination of actions based, at least in part, on the first combination of actions deviating from the historical session data.

13. The computer program product of claim 9 , further comprising program instructions to:

compare a second combination of actions in the plurality of actions to the plurality of policies for malicious intent, wherein:

at least one action in the second combination of actions is authorized during the remote user session;

determine a level of risk for malicious intent for the second combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

monitor, in response to the level of risk of the second combination of actions falling below the given threshold level, additional actions performed during the remote user session.

14. The computer program product of claim 9 , further comprising program instructions to:

identify a pattern of performing the first combination of actions over a given period of time; and

modify the one or more preventive actions based on identifying the pattern.

15. The computer program product of claim 9 , wherein the plurality of policies for malicious intent include one or more policies to detect malware.

16. A computer system comprising:

one or more computer processors;

one or more computer readable storage media;

computer program instructions;

the computer program instructions being stored on the one or more computer readable storage media for execution by the one or more computer processors; and

the computer program instructions comprising instructions to:

receive a request to authenticate a user to remotely access a secure device;

establish, in response to the user being granted remote access to the secure device, a remote user session for the user;

identify a plurality of actions performed during the remote user session, wherein the plurality of actions includes at least one action performed on the secure device;

compare a first combination of actions in the plurality of actions to a plurality of policies for malicious intent, wherein:

at least one action in the first combination of actions is authorized during the remote user session;

determine a level of risk for malicious intent for the first combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

generate, in response to the level of risk of the first combination of actions exceeding a given threshold level, one or more preventive actions, wherein the one or more preventive actions include terminating the remote user session.

17. The computer system of claim 16 , wherein the program instructions to generate the one or more preventive actions is based, at least in part, on:

the first combination of actions; and

the level of risk associated with the first combination of actions.

18. The computer system of claim 16 , wherein the program instructions to determine the level of risk for malicious intent for the first combination of actions is further based, at least in part, on program instructions to analyze historical session data corresponding to the user.

19. The computer system of claim 18 , further comprising program instructions to:

increase the level of risk for malicious intent associated with the first combination of actions based, at least in part, on the first combination of actions deviating from the historical session data.

20. The computer system of claim 16 , further comprising program instructions to:

compare a second combination of actions in the plurality of actions to the plurality of policies for malicious intent, wherein:

at least one action in the second combination of actions is authorized during the remote user session;

determine a level of risk for malicious intent for the second combination of actions based, at least in part, on the comparison of the first combination of actions and the plurality of policies for malicious intent; and

monitor, in response to the level of risk of the second combination of actions falling below the given threshold level, additional actions performed during the remote user session.