Supervised learning system for identity compromise risk computation
Systems are provided for improving computer security systems that are based on user risk scores. These systems can be used to improve both the accuracy and usability of the user risk scores by applying multiple tiers of machine learning to different the user risk profile components used to generate the user risk scores and in such a manner as to dynamically generate and modify the corresponding user risk scores.
1. A computer system that facilitates recall utility for identity risk scores, said computer system comprising:
one or more processors; and
one or more computer-readable hardware storage devices that store instructions that are executable by the one or more processors to cause the computer system to:
access data associated with a set of sign-in events corresponding to an entity;
based on the data, identify a set of sign-in detectors, wherein the set of sign-in detectors includes one or more sign-in detectors for each sign-in event in the set of sign-in events;
generate a set of quantified risk levels based on the set of sign-in detectors by applying a group of one or more machine learning tools to the set of sign-in detectors;
generate an identity risk score for the entity, wherein generating the identity risk score is based on the set of quantified risk levels;
use the identity risk score to update data used to train a machine learning tool selected from the group of one or more machine learning tools;
based on the updated data, further tune the machine learning tool, resulting in at least one machine learning tool in the group of one or more machine learning tools being further trained;
iteratively update the identity risk score for the entity or generate a new identity risk score for the entity by reapplying the group of one or more machine learning tools to generate a new set of quantified risk levels;
in response to iteratively updating the identity risk score for the entity or in response to generating the new identity risk score for the entity, modify a second identity risk score for a second entity, wherein modifying the second identity risk score is performed independently to new sign-in data being received for the second entity such that a modification to the identity risk score impacts the second identity risk score;
detect a request from the entity, which corresponds to a new sign-in event;
identify the new identity risk score corresponding to the entity; and
in response to determining the new identity risk score exceeds a predetermined threshold, trigger a remedial action to the request, or alternatively, in response to determining the new identity risk score falls below the predetermined threshold, grant the request.
2. The computer system of claim 1 , wherein the identity risk score is for a user.
3. The computer system of claim 1 , wherein the identity risk score is quantified and is represented in a form of a numeric.
4. The computer system of claim 1 , wherein the identity risk score is quantified and is represented as one of a high risk, a medium risk, or a low risk.
5. The computer system of claim 1 , wherein the identity risk score is quantified and is represented in binary form as risk or no risk.
6. The computer system of claim 1 , wherein the identity risk score is for a computing entity.
7. The computer system of claim 1 , wherein the set of sign-in events is stored for a predetermined period of time before aging out.
8. The computer system of claim 1 , wherein the set of sign-in events is stored in a ring buffer.
9. The computer system of claim 1 , wherein the group of one or more machine learning tools include or use one or more of the following: a linear regression model, a logistic regression model, or a support vector machine.
10. The computer system of claim 1 , wherein the set of sign-in events include data associated with one or more of: a suspicious device, a new device, an atypical or typical location, an anonymous Internet Protocol (IP) address, a familiar or unfamiliar IP address, credentials that are known to have been leaked, a device known to have been infected with malware, or a location that is distant from a known location of a user.
11. A method comprising:
accessing data associated with a set of sign-in events corresponding to an entity;
based on the data, identifying a set of sign-in detectors, wherein the set of sign-in detectors includes one or more sign-in detectors for each sign-in event in the set of sign-in events;
generating a set of quantified risk levels based on the set of sign-in detectors by applying a group of one or more machine learning tools to the set of sign-in detectors;
generating an identity risk score for the entity, wherein generating the identity risk score is based on the set of quantified risk levels;
using the identity risk score to update data used to train a machine learning tool selected from the group of one or more machine learning tools;
based on the updated data, further tuning the machine learning tool, resulting in at least one machine learning tool in the group of one or more machine learning tools being further trained;
iteratively updating the identity risk score for the entity or generate a new identity risk score for the entity by reapplying the group of one or more machine learning tools to generate a new set of quantified risk levels;
in response to iteratively updating the identity risk score for the entity or in response to generating the new identity risk score for the entity, modifying a second identity risk score for a second entity, wherein modifying the second identity risk score is performed independently to new sign-in data being received for the second entity such that a modification to the identity risk score impacts the second identity risk score;
detecting a request from the entity, which corresponds to a new sign-in event;
identifying the new identity risk score corresponding to the entity; and
in response to determining the new identity risk score exceeds a predetermined threshold, triggering a remedial action to the request.
12. The method of claim 11 , wherein the remedial action includes preventing access to a resource.
13. The method of claim 11 , wherein the remedial action includes initiating a request for additional authentication.
14. The method of claim 11 , wherein the remedial action includes triggering expiry of a current access right.
15. The method of claim 11 , wherein the remedial action includes triggering demotion of a current access right.
16. The method of claim 11 , wherein a crowdsourced feedback loop is implemented to further tune the machine learning tool.
17. The method of claim 11 , wherein the identity risk score is for a user.
18. The method of claim 11 , wherein the identity risk score is for a computing entity.
19. A method comprising:
accessing data associated with a set of sign-in events corresponding to an entity;
based on the data, identifying a set of sign-in detectors, wherein the set of sign-in detectors includes one or more sign-in detectors for each sign-in event in the set of sign-in events;
generating a set of quantified risk levels based on the set of sign-in detectors by applying a group of one or more machine learning tools to the set of sign-in detectors;
generating an identity risk score for the entity, wherein generating the identity risk score is based on the set of quantified risk levels;
using the identity risk score to update data used to train a machine learning tool selected from the group of one or more machine learning tools;
based on the updated data, further tuning the machine learning tool, resulting in at least one machine learning tool in the group of one or more machine learning tools being further trained;
iteratively updating the identity risk score for the entity or generate a new identity risk score for the entity by reapplying the group of one or more machine learning tools to generate a new set of quantified risk levels;
in response to iteratively updating the identity risk score for the entity or in response to generating the new identity risk score for the entity, modifying a second identity risk score for a second entity, wherein modifying the second identity risk score is performed independently to new sign-in data being received for the second entity such that a modification to the identity risk score impacts the second identity risk score;
detecting a request from the entity, which corresponds to a new sign-in event;
identifying the new identity risk score corresponding to the entity; and
in response to determining the new identity risk score falls below the predetermined threshold, granting the request.
20. The method of claim 19 , wherein the identity risk score is for a computing entity.