Optimizing role level identification for resource allocation
Methods, systems, and processes to optimize role level identification for computing resource allocation to perform security operations in networked computing environments. A role level classifier to process a training dataset that corresponds to a clean title is generated from a subset of entities associated with the clean title. An initial effective title determined by the role level classifier based on processing the training dataset is assigned to an entity. A new effective title based on feature differences between the initial effective title and the clean title is re-assigned to the entity. Performance of the generating, the assigning, and the re-assigning is repeated using the new effective title instead of the clean title.
1. A computer-implemented method, comprising:
generating, from a subset of one or more entities associated with a clean title, a role level classifier to process a training dataset that corresponds to the clean title;
assigning, to an entity of the one or more entities, an initial effective title determined by the role level classifier based on processing the training dataset;
re-assigning, to the entity, a new effective title based on one or more feature differences between the initial effective title and the clean title; and
repeating performance of the generating, the assigning, and the re-assigning using the new effective title instead of the clean title.
2. The computer-implemented method of claim 1 , wherein
the repeating generates one or more subsequent initial effective titles and one or more subsequent new effective titles for the entity, and
the repeating is performed until a value of a subsequent initial effective title of the one or more subsequent initial effective titles is the value of a subsequent new effective title of the one or more subsequent new effective titles.
3. The computer-implemented method of claim 2 , further comprising:
allocating or de-allocating one or more network resources, one or more storage resources, or one or more security resources to or from the entity,
respectively, if the subsequent new effective title of the entity is different than the clean title of the entity, wherein
the allocating or the de-allocating is based on a threshold, and
the entity is associated with one or more network assets.
4. The computer-implemented method of claim 1 , further comprising:
receiving a user input indicating a granularity level of the one or more entities; and
performing a data cleaning process to account for one or more variations in the one or more entities.
5. The computer-implemented method of claim 1 , wherein
the one or more feature differences comprise at least one or more behavioral characteristics, one or more managerial characteristics, or one or more organizational characteristics, and
the one or more feature differences indicate one or more outliers between the initial effective title and the clean title.
6. The computer-implemented method of claim 1 , wherein
each of the one or more entities is associated with a role identifier of a plurality of role identifiers, and
the one or more role identifiers are maintained by an active directory.
7. The computer-implemented method of claim 1 , further comprising:
maintaining independently from a directory service, a catalog of one or more modified role identifiers;
determining, by virtue of the entity being processed by the role level classifier, that at least one modified role identifier of the one or more modified role identifiers in the catalog matches the new effective title assigned to the entity that is different than the clean title of the entity provided by the directory service;
based on the determining, designating the entity and one or more network assets associated with the entity as vulnerable; and
performing one or more security actions applicable to the entity.
8. A non-transitory computer readable storage medium comprising program instructions executable to comprising program instructions executable to:
generate, from a subset of one or more entities associated with a clean title, a role level classifier to process a training dataset that corresponds to the clean title;
assign, to an entity of the one or more entities, an initial effective title determined by the role level classifier based on processing the training dataset;
re-assign, to the entity, a new effective title based on one or more feature differences between the initial effective title and the clean title; and
repeat performance of the generating, the assigning, and the re-assigning using the new effective title instead of the clean title.
9. The non-transitory computer readable storage medium of claim 8 , wherein
the repeating generates one or more subsequent initial effective titles and one or more subsequent new effective titles for the entity, and
the repeating is performed until a value of a subsequent initial effective title of the one or more subsequent initial effective titles is the value of a subsequent new effective title of the one or more subsequent new effective titles.
10. The non-transitory computer readable storage medium of claim 9 , further comprising:
allocating or de-allocating one or more network resources, one or more storage resources, or one or more security resources to or from the entity,
respectively, if the subsequent new effective title of the entity is different than the clean title of the entity, wherein
the allocating or the de-allocating is based on a threshold, and
the entity is associated with one or more network assets.
11. The non-transitory computer readable storage medium of claim 8 , further comprising:
receiving a user input indicating a granularity level of the one or more entities; and
performing a data cleaning process to account for one or more variations in the one or more entities.
12. The non-transitory computer readable storage medium of claim 8 , wherein
the one or more feature differences comprise at least one or more behavioral characteristics, one or more managerial characteristics, or one or more organizational characteristics, and
the one or more feature differences indicate one or more outliers between the initial effective title and the clean title.
13. The non-transitory computer readable storage medium of claim 8 , wherein
each of the one or more entities is associated with a role identifier of a plurality of role identifiers, and
the one or more role identifiers are maintained by an active directory.
14. The non-transitory computer readable storage medium of claim 8 , further comprising:
maintaining independently from a directory service, a catalog of one or more modified role identifiers;
determining, by virtue of the entity being processed by the role level classifier, that at least one modified role identifier of the one or more modified role identifiers in the catalog matches the new effective title assigned to the entity that is different than the clean title of the entity provided by the directory service;
based on the determining, designating the entity and one or more network assets associated with the entity as vulnerable; and
performing one or more security actions applicable to the entity.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
generate, from a subset of one or more entities associated with a clean title, a role level classifier to process a training dataset that corresponds to the clean title;
assign, to an entity of the one or more entities, an initial effective title determined by the role level classifier based on processing the training dataset;
re-assign, to the entity, a new effective title based on one or more feature differences between the initial effective title and the clean title; and
repeat performance of the generating, the assigning, and the re-assigning using the new effective title instead of the clean title.
16. The system of claim 15 , wherein
the repeating generates one or more subsequent initial effective titles and one or more subsequent new effective titles for the entity, and
the repeating is performed until a value of a subsequent initial effective title of the one or more subsequent initial effective titles is the value of a subsequent new effective title of the one or more subsequent new effective titles.
17. The system of claim 16 , further comprising:
allocating or de-allocating one or more network resources, one or more storage resources, or one or more security resources to or from the entity,
respectively, if the subsequent new effective title of the entity is different than the clean title of the entity, wherein
the allocating or the de-allocating is based on a threshold, and
the entity is associated with one or more network assets.
18. The system of claim 15 , further comprising:
receiving a user input indicating a granularity level of the one or more entities; and
performing a data cleaning process to account for one or more variations in the one or more entities.
19. The system of claim 15 , wherein
the one or more feature differences comprise at least one or more behavioral characteristics, one or more managerial characteristics, or one or more organizational characteristics, and
the one or more feature differences indicate one or more outliers between the initial effective title and the clean title.
20. The system of claim 15 , wherein
each of the one or more entities is associated with a role identifier of a plurality of role identifiers, and
the one or more role identifiers are maintained by an active directory.