Detecting unused, abnormal permissions of users for cloud-based applications using a genetic algorithm
Systems and methods include obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time; determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users; scoring and ranking the unused and abnormal user accounts; and remediating a set of the ranked unused and abnormal user accounts.
1. A method comprising:
obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time;
determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users;
scoring and ranking the unused and abnormal user accounts, wherein the scoring is based on a combination of extra granted assignments, assignment counts, and permitted actions; and
remediating a set of the ranked unused and abnormal user accounts.
2. The method of claim 1 , wherein the similar users are ones that have commonality in any of department, location, and job function, and wherein anomalous means a user has different permissions from corresponding similar users.
3. The method of claim 1 , wherein the abnormal user accounts are determined using a genetic algorithm.
4. The method of claim 3 , wherein the genetic algorithm determines assignment based communities and determines a distance therebetween, with the abnormal user accounts being based on the distance.
5. The method of claim 3 , wherein the genetic algorithm utilizes communities based on any of assignments, entitlements, behavior attributes, and meta attributes.
6. The method of claim 3 , wherein the genetic algorithm utilizes a bipartite graph between users and assignments, converts the bipartite graph to a bitmap, determines communities based on the bitmap, computes a relational weight of each community, and computes distances among the community using the relational weight.
7. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processing device to perform the steps of:
obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time;
determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users;
scoring and ranking the unused and abnormal user accounts, wherein the scoring is based on a combination of extra granted assignments, assignment counts, and permitted actions; and
remediating a set of the ranked unused and abnormal user accounts.
8. The non-transitory computer-readable medium of claim 7 , wherein the similar users are ones that have commonality in any of department, location, and job function, and wherein anomalous means a user has different permissions from corresponding similar users.
9. The non-transitory computer-readable medium of claim 7 , wherein the abnormal user accounts are determined using a genetic algorithm.
10. The non-transitory computer-readable medium of claim 9 , wherein the genetic algorithm determines assignment based communities and determines a distance therebetween, with the abnormal user accounts being based on the distance.
11. The non-transitory computer-readable medium of claim 9 , wherein the genetic algorithm utilizes communities based on any of assignments, entitlements, behavior attributes, and meta attributes.
12. The non-transitory computer-readable medium of claim 9 , wherein the genetic algorithm utilizes a bipartite graph between users and assignments, converts the bipartite graph to a bitmap, determines communities based on the bitmap, computes a relational weight of each community, and computes distances among the community using the relational weight.
13. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processing device to perform the steps of:
obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time;
determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users and the abnormal user accounts are determined using a genetic algorithm;
scoring and ranking the unused and abnormal user accounts; and
remediating a set of the ranked unused and abnormal user accounts,
wherein the genetic algorithm utilizes a bipartite graph between users and assignments, converts the bipartite graph to a bitmap, determines communities based on the bitmap, computes a relational weight of each community, and computes distances among the community using the relational weight.
14. The non-transitory computer-readable medium of claim 13 , wherein the similar users are ones that have commonality in any of department, location, and job function, and wherein anomalous means a user has different permissions from corresponding similar users.
15. The non-transitory computer-readable medium of claim 13 , wherein the genetic algorithm determines assignment based communities and determines a distance therebetween, with the abnormal user accounts being based on the distance.
16. The non-transitory computer-readable medium of claim 13 , wherein the genetic algorithm utilizes communities based on any of assignments, entitlements, behavior attributes, and meta attributes.
17. The non-transitory computer-readable medium of claim 13 , wherein the scoring is based on a combination of extra granted assignments, assignment counts, and permitted actions.