System and method for role mining in identity management artificial intelligence systems using cluster based analysis of network identity graphs
Systems and methods for embodiments of a graph based artificial intelligence systems for identity management are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to analyzing identities or entitlements of a distributed networked enterprise computing environment. Specifically, in certain embodiments, an artificial intelligence based identity management systems may utilize the peer grouping of an identity graph (or peer grouping of portions or subgraphs thereof) to identify roles from peer groups or the like.
1. An identity management system of using identity graphs for risk detection, comprising:
a data store;
a hardware processor;
a non-transitory, computer-readable storage medium, including computer instructions executable by the hardware processor for:
presenting a role mining interface;
presenting a role determined from an identity graph through the role mining interface, wherein the identity graph was created from identity management data, the identity management data utilized in identity management in a distributed enterprise computing environment and comprising data on a first set of identities and a first set of entitlements associated with the first set of identities, wherein the identity graph includes:
a node for each of the first set of identities, and
an edge between a first node and a second node for each first identity and second identity that share at least one entitlement of the first set of entitlements, wherein the first node and the second node respectively represent the first identity and the second identity and whom wherein the edge has a similarity weight based on the at least one shared entitlement between the first identity and the second identity; and
wherein the role was determined by:
pruning a first set of edges of the identity graph based on each similarity weight associated with each of the first set of edges to generate a second identity graph;
clustering a second set of identities or a second set of entitlements represented in the pruned identity graph of the second identity graph into a peer group, the peer group including a set of nodes of the pruned identity graph of the second identity graph representing the second set of identities or a second set of edges of the pruned identity graph representing the second set of entitlements;
determining the role, presented through the role mining interface, from the peer group of clustered second set of identities or second set of entitlements, wherein the role comprises the second set of entitlements determined from the peer group; and
storing the determined role comprising the second set of entitlements in the data store.
2. The identity management system of claim 1 , wherein the role mining interface presents a graphical depiction of the role determined from the identity graph.
3. The identity management system of claim 2 , wherein the graphical depiction of the role is a presentation of the second set of entitlements.
4. The identity management system of claim 3 , wherein the presentation includes a count or distribution of the second set of entitlements across the second set of identities.
5. The identity management system of claim 1 , wherein the role is determined in response to a user interaction with the role mining interface.
6. The identity management system of claim 5 , wherein the role mining interface presents a graphical representation of the peer group and the role was determined in response to a user interaction with the graphical representation of the peer group.
7. The identity management system of claim 1 , wherein a role size is received through the role mining interface and the second set of identities or second set of entitlements is greater than the role size.
8. The identity management system of claim 1 , wherein a pruning threshold is received through the role mining interface and the pruning of the first set of edges of the identity graph is based on the received pruning threshold.
9. The identity management system of claim 1 , wherein the instructions are further for storing the role in the data store in response to a user interaction with the role mining interface, the role including an identification of the second set of entitlements.
10. The identity management system of claim 1 , wherein the instructions are further for determining the identity graph based on a scoping attribute received through the role mining interface.
11. A method of using identity graphs for risk detection, comprising:
presenting a role mining interface;
presenting a role determined from an identity graph through the role mining interface, wherein the identity graph was created from identity management data, the identity management data utilized in identity management in a distributed enterprise computing environment and comprising data on a first set of identities and a first set of entitlements associated with the first set of identities, wherein the identity graph includes:
a node for each of the first set of identities, and
an edge between a first node and a second node for each first identity and second identity that share at least one entitlement of the first set of entitlements, wherein the first node and the second node respectively represent the first identity and the second identity and wherein the edge has a similarity weight based on the at least one shared entitlement between the first identity and the second identity; and
wherein the role was determined by:
pruning a first set of edges of the identity graph based on each similarity weight associated with each of the first set of edges to generate a second identity graph;
clustering a second set of identities or a second set of entitlements represented in the pruned identity graph of the second identity graph into a peer group, the peer group including a set of nodes of the pruned identity graph of the second identity graph representing the second set of identities or a second set of edges of the pruned identity graph representing the second set of entitlements;
determining the role, presented through the role mining interface, from the peer group of clustered second set of identities or second set of entitlements, wherein the role comprises the second set of entitlements determined from the peer group; and
storing the determined role comprising the second set of entitlements in the data store.
12. The method of claim 11 , wherein the role mining interface presents a graphical depiction of the role determined from the identity graph.
13. The method of claim 12 , wherein the graphical depiction of the role is a presentation of the second set of entitlements.
14. The method of claim 13 , wherein the presentation includes a count or distribution of the second set of entitlements across the second set of identities.
15. The method of claim 11 , wherein the role is determined in response to a user interaction with the role mining interface.
16. The method of claim 15 , wherein the role mining interface presents a graphical representation of the peer group and the role was determined in response to a user interaction with the graphical representation of the peer group.
17. The method of claim 11 , wherein a role size is received through the role mining interface and the second set of identities or second set of entitlements is greater than the role size.
18. The method of claim 11 , wherein a pruning threshold is received through the role mining interface and the pruning of the first set of edges of the identity graph is based on the received pruning threshold.
19. The method of claim 11 , further comprising storing the role in the data store in response to a user interaction with the role mining interface, the role including an identification of the second set of entitlements.
20. The method of claim 11 , further comprising determining the identity graph based on a scoping attribute received through the role mining interface.