Generating configuration rules using machine learning
A system and method for access control in a computerize system comprise generating configuration rules using machine learning. Configuration data of a computerized system is organized into matrices representing entity attributes and entitlements, and is used to train a machine-learning model to generate configuration rules. The model predicts entity entitlement probabilities based on entity attributes. The generated rules include quality metrics and can be used to configure access control for new or existing entities in the system.
1 . A method for training a machine-learning model to generate a set of configuration rules for a computerized system, comprising:
organizing a set of configuration data of the computerized system into one or more multi-label matrices comprising a plurality of observations, where the one or more multi-label matrices comprise a first matrix and a second matrix, where the first matrix comprises a first plurality of observations comprising for each entity of a plurality of entities of the computerized system a respective plurality of configured entity attributes of the entity, and where the second matrix comprises a second plurality of observations comprising for each entity of the plurality of entities a respective plurality of configured entity entitlements of the entity, wherein the second matrix is for use as labels in a multi-label supervised training session of the machine-learning model;
training a machine-learning model to produce a set of configuration rules by in each of a plurality of supervised training iterations, providing the machine-learning model digital training data comprising the set of configuration data organized into the one or more multi-label matrices, each of the set of configuration rules comprising a plurality of entity attributes of at least one entity of the plurality of entities and at least one target entity entitlement, to generate at least one configuration rule;
providing the at least one configuration rule to at least one software object for computing one or more entity entitlements controlling access of one or more entities of the plurality of entities to the computerized system; and
controlling access of the one or more entities to the computerized system by modifying, by at least one configuration software object, at least one system configuration value of the computerized system according to at least one configuration instruction generated using the one or more entity entitlements.
2 . The method of claim 1 , further comprising:
computing a set of predicted entity entitlements by providing the machine-learning model with validation digital data comprising a validation set of configuration data of the computerized system;
computing at least one statistical value by comparing the set of predicted entity entitlements to a validation set of configured entitlements of the computerized system; and
computing at least one prediction threshold value using the at least one statistical value and at least one business metric value.
3 . The method of claim 2 , wherein the machine-learning model;
generates the set of configuration rules further using the at least one prediction threshold value.
4 . The method of claim 3 , wherein using the prediction threshold values comprises:
providing the configuration validation digital data to the machine-learning model to produce at least one entitlement probability value; and
comparing the at least one entitlement probability value to the at least one prediction value to produce the set of predicted entity values.
5 . The method of claim 3 , wherein the at least one prediction threshold values are computed using at least one statistical value and at least one business metric value.
6 . The method of claim 1 , wherein the plurality of entities comprises at least one of: a user, a user group, a user role, a user permission, a software application, a device of the computerized system, and a service.
7 . The method of claim 1 , wherein each entity attribute of the plurality of entity attributes comprises an entity attribute identifier and an entity attribute value.
8 . The method of claim 7 , wherein an entity attribute value is one of: a user name value, a department identification value, a title value, an amount of years of experience, a role identification value, and an office identification value.
9 . The method of claim 1 , wherein each entity entitlement of the at least one entity entitlement comprises an entitlement identifier and an entitlement value.
10 . The method of claim 9 , wherein an entitlement value is one of: an application identification value, an application permission value, a group identification value, a role identification value, and an access permission value.
11 . The method of claim 1 , wherein the set of configuration data comprises one or more of:
a plurality of configured entity attributes of the plurality of entities of the computerized system;
a plurality of configured entity entitlements of the computerized system;
a plurality of user groups of the computerized system,
a plurality of user roles of the computerized system;
a plurality of access permissions of the computerized system; and
a plurality of existing configuration rules of the computerized system.
12 . The method of claim 1 , wherein the set of configuration data is generated by at least one of:
receiving from a domain management application of a management domain of the computerized system at least one set of digital records, each describing one of the plurality of entities in the management domain;
retrieving from a repository of another management domain of the computerized system at least one other set of digital records, each describing another of the plurality of entities in the other management domain; and
receiving from a scanning application, configured to scan the computerized system, at least one yet another set of digital records, each describing yet another of the plurality of entities.
13 . The method of claim 1 , wherein modifying the at least one system configuration value according to at least one configuration instruction generated using the one or more entity entitlements comprises at least one of:
sending the at least one configuration software object at least one configuration request; and
modifying at least one configuration file of the computerized system.
14 . The method of claim 1 , wherein the at least one configuration software object comprises a first configuration software object of a first domain management application of a first management domain and a second configuration software object of a second domain management application of a second management domain; and
wherein the first management domain is different from the second management domain.