System and method for outlier and anomaly detection in identity management artificial intelligence systems using cluster based analysis of network identity graphs
Systems and methods for artificial intelligence systems for identity management systems are disclosed. Embodiments may perform outlier detection and risk assessment based on identity management data, including one or more property graphs or peer groups determined from those property graphs, to determine identity management artifacts with ‘abnormal’ patterns when compared to other related identity management artifacts.
1. An identity management system using graphs for risk detection, comprising:
a memory;
a hardware processor;
a non-transitory, computer-readable storage medium including computer instructions executable by the hardware processor for:
obtaining first identity management data from one or more source systems of an enterprise at a first time;
evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
generating a first graph from the first identity management data by:
creating a node of the first graph for each of the determined first set of identities,
for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
storing the first graph in a data store;
analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges; and
identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
2. The system of claim 1 , wherein analyzing the first graph comprises determining a normal usage baseline for a unit associated with the identity management artifact associated with the outlier node and determining that the identity management artifact associated with outlier node deviates from the normal usage baseline for the unit.
3. The system of claim 2 , wherein the normal usage baseline is determined based on event log data of the identity management data.
4. The system of claim 2 , wherein the unit comprises a peer group of identity nodes associated with the outlier node in the first graph.
5. The system of claim 1 , wherein analyzing the first graph comprises comparing the first graph to a second graph created from identity management data from a second time.
6. The system of claim 5 , wherein the outlier node is identified by comparing a first node in the first property graph associated with the identity management artifact with a second node in the second property graph associated with the identity management artifact.
7. The system of claim 1 , wherein the identity management artifact associated with the outlier node is a role or an identity.
8. A method for risk detection by using graphs, comprising:
obtaining first identity management data from one or more source systems of an enterprise at a first time;
evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
generating a first graph from the first identity management data by:
creating a node of the first graph for each of the determined first set of identities,
for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
storing the first graph in a data store;
analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges; and
identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
9. The method of claim 8 , wherein analyzing the first graph comprises determining a normal usage baseline for a unit associated with the identity management artifact associated with the outlier node and determining that the identity management artifact associated with outlier node deviates from the normal usage baseline for the unit.
10. The method of claim 9 , wherein the normal usage baseline is determined based on event log data of the identity management data.
11. The method of claim 9 , wherein the unit comprises a peer group of identity nodes associated with the outlier node in the first graph.
12. The method of claim 8 , wherein analyzing the first graph comprises comparing the first graph to a second graph created from identity management data from a second time.
13. The method of claim 12 , wherein the outlier node is identified by comparing a first node in the first property graph associated with the identity management artifact with a second node in the second property graph associated with the identity management artifact.
14. The method of claim 8 , wherein the identity management artifact associated with the outlier node is a role or an identity.
15. A non-transitory computer readable storage medium, comprising instructions executable for risk detection by using graphs to perform the steps of:
obtaining first identity management data from one or more source systems of an enterprise at a first time;
evaluating the obtained first identity management data to determine a first set of identities and a first set of entitlements associated with the first set of identities, wherein the first set of identities and the associated first set of entitlements are utilized in identity management in association with the enterprise;
generating a first graph from the first identity management data by:
creating a node of the first graph for each of the determined first set of identities,
for each first identity and second identity from the determined first set of identities that share at least one entitlement of the determined first set of entitlements, creating an edge of the first graph between a first node and a second node of the first graph representing respectively the corresponding first identity and the second identity, and
generating similarity weights for each of the created edges of the first graph, wherein a weight for the created edge between the first node and the second node is based on the at least one entitlement shared between the corresponding first identity and the second identity represented respectively by the corresponding first node and the second node;
storing the first graph in a data store;
analyzing the first graph or the first identity management data to identify an outlier node based upon a pruning a set of edges of the first graph based on the similarity weights of the set of edges; and
identifying an identity management artifact associated with the outlier node as a high risk identity management artifact.
16. The non-transitory computer readable storage medium of claim 15 , wherein analyzing the first graph comprises determining a normal usage baseline for a unit associated with the identity management artifact associated with the outlier node and determining that the identity management artifact associated with outlier node deviates from the normal usage baseline for the unit.
17. The non-transitory computer readable storage medium of claim 16 , wherein the normal usage baseline is determined based on event log data of the identity management data.
18. The non-transitory computer readable storage medium of claim 16 , wherein the unit comprises a peer group of identity nodes associated with the outlier node in the first graph.
19. The non-transitory computer readable storage medium of claim 15 , wherein analyzing the first graph comprises comparing the first graph to a second graph created from identity management data from a second time.
20. The non-transitory computer readable storage medium of claim 19 , wherein the outlier node is identified by comparing a first node in the first property graph associated with the identity management artifact with a second node in the second property graph associated with the identity management artifact.
21. The non-transitory computer readable storage medium of claim 15 , wherein the identity management artifact associated with the outlier node is a role or an identity.