Generating zero-trust policy for application access based on sequence-based application segmentation
Systems and methods include obtaining log data for a plurality of users of an enterprise where the log data relates to usage of a plurality of applications by the plurality of users and user metadata; analyzing the log data to determine one or more sequential patterns of application access; determining i) app-segments that are groupings of application of the plurality of applications and ii) user-groups that are groupings of users of the plurality of users, based on the log data and the one or more sequential patterns of application access; and providing access policy of the plurality of applications based on the user-groups and the app-segments. The one or more sequential patterns of application access include a sequence of accessing a plurality of applications in a given time period.
1 . A non-transitory computer-readable storage medium having computer readable code stored thereon for programming at least one processor to perform steps of:
obtaining log data for a plurality of users of an enterprise where the log data relates to usage of a plurality of applications by the plurality of users and user metadata;
analyzing the log data to determine one or more sequential patterns of ordered transitions of application access;
determining i) app-segments that are groupings of application of the plurality of applications and ii) user-groups that are groupings of users of the plurality of users, based on the log data and the one or more sequential patterns of application access, wherein the sequential patterns are used to compute transition probabilities or transition-likelihood metrics between applications to infer application similarity and correlated user roles; and
providing access policy of the plurality of applications based on the user-groups and the app-segments.
2 . The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
monitoring the access policy over time based on ongoing log data, manual verification of the access policy defining human intervention for refining of the policy, and incidents where users are prevented from accessing any application; and
adjusting any of the determined app-segments and the user-groups, based on the monitoring.
3 . The non-transitory computer-readable storage medium of claim 1 , wherein the one or more sequential patterns of application access include a sequence of accessing a plurality of applications in a given time period and are configured to define a role of the user and a similarity between the applications.
4 . The non-transitory computer-readable storage medium of claim 1 , wherein the usage of the plurality of applications by the plurality of users is via wildcard rules allowing a large subset of users to access the plurality of applications.
5 . The non-transitory computer-readable storage medium of claim 4 , wherein the access policy of the plurality of applications has less access than via the wildcard rules.
6 . The non-transitory computer-readable storage medium of claim 1 , wherein the log data and the one or more sequential patterns of application access is transformed to feature vectors, and wherein the determining includes clustering with the feature vectors.
7 . The non-transitory computer-readable storage medium of claim 1 , wherein the log data is obtained over a period of time and the determining and providing is performed over the period of time until the access policy meets a quality threshold.
8 . The non-transitory computer-readable storage medium of claim 1 , wherein the enterprise is an existing customer of a cloud service and the access policy is for one of existing applications and new applications, and wherein the determining is based on a similarity metric with existing user-groups.
9 . The non-transitory computer-readable storage medium of claim 1 , wherein the enterprise is a new customer of a cloud service, and wherein the determining is based on clustering to determine the user-groups and the app-segments.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein user-groups are fixed to determine the app-segments.
11 . The non-transitory computer-readable storage medium of claim 1 , wherein the access policy includes which user-groups can access which app-segments on which ports.
12 . The non-transitory computer-readable storage medium of claim 1 , wherein the determining is via a machine learning model that uses features including any of port and protocol usage pattern; the computer process that initiated the connection to the application; similarity based on domain names; Internet Protocol (IP) address; an organization's network addressing structure; app location; user location; job title; department; manager; and behavior patterns.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein the machine learning model includes an ensemble of different models.
14 . A method comprising steps of:
obtaining log data for a plurality of users of an enterprise where the log data relates to usage of a plurality of applications by the plurality of users and user metadata;
analyzing the log data to determine one or more sequential patterns of ordered transitions of application access;
determining i) app-segments that are groupings of application of the plurality of applications and ii) user-groups that are groupings of users of the plurality of users, based on the log data and the one or more sequential patterns of application access, wherein the sequential patterns are used to compute transition probabilities or transition-likelihood metrics between applications to infer application similarity and correlated user roles; and
providing access policy of the plurality of applications based on the user-groups and the app-segments.
15 . The method of claim 14 , wherein the steps further include
monitoring the access policy over time based on ongoing log data, manual verification of the access policy, and incidents where users are prevented from accessing any application; and
adjusting any of the determined app-segments and the user-groups, based on the monitoring.
16 . The method of claim 14 , wherein the one or more sequential patterns of application access include a sequence of accessing a plurality of applications in a given time period.
17 . The method of claim 14 , wherein the usage of the plurality of applications by the plurality of users is via wildcard rules allowing a large subset of users to access the plurality of applications.
18 . The method of claim 14 , wherein the log data and the one or more sequential patterns of application access is transformed to feature vectors, and wherein the determining includes clustering with the feature vectors.
19 . The method of claim 14 , wherein the log data is obtained over a period of time and the determining and providing is performed over the period of time until the access policy meets a quality threshold.
20 . The method of claim 14 , wherein the enterprise is an existing customer of a cloud service and the access policy is for one of existing applications and new applications, and wherein the determining is based on a similarity metric with existing user-groups.