Machine learning risk assessment utilizing calendar data

1. A computer-implemented method comprising:

processing historical calendar data attributed to users on a network;

generating, based at least in part on the processed historical calendar data and historical user activity data associated with the network, one or more machine learning user activity models;

processing input data, wherein the input data comprise additional user activity data associated with the network attributed to at least one of the users and additional calendar data temporally related to the additional user activity data, wherein processing the input data comprises:

processing the additional user activity data from one or more data structures associated with network monitoring to one or more data structures associated with the one or more machine learning user activity models, wherein the additional user activity data comprises data related to a number of times at least one user accesses one or more network locations associated with one or more particular hyperlinks;

performing a network domain determination to authenticate that the one or more particular hyperlinks exist with links to protect the one or more network locations;

processing the additional calendar data from one or more data structures associated with one or more user calendar applications to the one or more data structures associated with the one or more machine learning user activity models; and

applying distinct weights to overlapping events in the additional calendar data, wherein the distinct weights are based at least in part on priority information derived from the additional calendar data, and wherein the priority information represents a level of importance of the overlapping events for the at least one user;

generating a risk assessment output for the at least one user by applying at least one of the machine learning user activity models to the processed input data; and

providing the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based at least in part on the risk assessment output;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The computer-implemented method of claim 1 , wherein generating the risk assessment output comprises performing one or more static calendar data-related determinations by applying the at least one machine learning user activity model to one or more binary aspects of the processed additional calendar data.

3. The computer-implemented method of claim 1 , further comprising:

modifying the risk assessment output by applying an adjustment factor to the risk assessment output, wherein the adjustment factor is based at least in part on performing one or more dynamic calendar data-related determinations by applying the at least one machine learning user activity model to one or more variable aspects of the processed additional calendar data.

4. The computer-implemented method of claim 3 , wherein modifying the risk assessment output by applying the adjustment factor to the risk assessment output comprises increasing a risk level associated with the risk assessment output by a given amount or decreasing a risk level associated with the risk assessment output by a given amount, based at least in part on the one or more dynamic calendar data-related determinations.

5. The computer-implemented method of claim 1 , wherein processing the additional calendar data comprises applying one or more natural language processing techniques to the additional calendar data, thereby determining one or more portions of the additional calendar data to process to the one or more data structures associated with the one or more machine learning user activity models.

6. The computer-implemented method of claim 1 , wherein processing the historical calendar data comprises applying one or more natural language processing techniques to the historical calendar data.

7. The computer-implemented method of claim 1 , wherein at least one of the historical calendar data and the additional calendar data comprise at least one of participant information for a scheduled event, organizer information for a scheduled event, start time information for a scheduled event, end time information for a scheduled event, date information for a scheduled event, location information for a scheduled event, priority information for a scheduled event, and one or more hyperlinks to one or more protected resources.

8. The computer-implemented method of claim 1 , wherein processing the input data comprises implementing an application programming interface associated with a risk engine.

9. The computer-implemented method of claim 1 , wherein the risk assessment output comprises identification of one or more protected resources accessed at a particular time by the at least one user, and a risk level associated therewith.

10. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

to process historical calendar data attributed to users on a network;

to generate, based at least in part on the processed historical calendar data and historical user activity data associated with the network, one or more machine learning user activity models;

to process input data, wherein the input data comprise additional user activity data associated with the network attributed to at least one of the users and additional calendar data temporally related to the additional user activity data, wherein processing the input data comprises:

processing the additional user activity data from one or more data structures associated with network monitoring to one or more data structures associated with the one or more machine learning user activity models, wherein the additional user activity data comprises data related to a number of times at least one user accesses one or more network locations associated with one or more particular hyperlinks;

performing a network domain determination to authenticate that the one or more particular hyperlinks exist with links to protect the one or more network locations;

processing the additional calendar data from one or more data structures associated with one or more user calendar applications to the one or more data structures associated with the one or more machine learning user activity models; and

applying distinct weights to overlapping events in the additional calendar data, wherein the distinct weights are based at least in part on priority information derived from the additional calendar data, and wherein the priority information represents a level of importance of the overlapping events for the at least one user;

to generate a risk assessment output for the at least one user by applying at least one of the machine learning user activity models to the processed input data; and

to provide the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based at least in part on the risk assessment output.

11. The non-transitory processor-readable storage medium of claim 10 , wherein generating the risk assessment output comprises performing one or more static calendar data-related determinations by applying the at least one machine learning user activity model to one or more binary aspects of the processed additional calendar data.

12. The non-transitory processor-readable storage medium of claim 10 , wherein the program code further causes the at least one processing device:

to modify the risk assessment output by applying an adjustment factor to the risk assessment output, wherein the adjustment factor is based at least in part on performing one or more dynamic calendar data-related determinations by applying the at least one machine learning user activity model to one or more variable aspects of the processed additional calendar data.

13. The non-transitory processor-readable storage medium of claim 12 , wherein modifying the risk assessment output by applying the adjustment factor to the risk assessment output comprises increasing a risk level associated with the risk assessment output by a given amount or decreasing a risk level associated with the risk assessment output by a given amount, based at least in part on the one or more dynamic calendar data-related determinations.

14. The non-transitory processor-readable storage medium of claim 10 , wherein processing the additional calendar data comprises applying one or more natural language processing techniques to the additional calendar data, thereby determining one or more portions of the additional calendar data to process to the one or more data structures associated with the one or more machine learning user activity models.

15. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to process historical calendar data attributed to users on a network;

to generate, based at least in part on the processed historical calendar data and historical user activity data associated with the network, one or more machine learning user activity models;

to process input data, wherein the input data comprise additional user activity data associated with the network attributed to at least one of the users and additional calendar data temporally related to the additional user activity data, wherein processing the input data comprises:

processing the additional user activity data from one or more data structures associated with network monitoring to one or more data structures associated with the one or more machine learning user activity models, wherein the additional user activity data comprises data related to a number of times at least one user accesses one or more network locations associated with one or more particular hyperlinks;

performing a network domain determination to authenticate that the one or more particular hyperlinks exist with links to protect the one or more network locations;

processing the additional calendar data from one or more data structures associated with one or more user calendar applications to the one or more data structures associated with the one or more machine learning user activity models; and

applying distinct weights to overlapping events in the additional calendar data, wherein the distinct weights are based at least in part on priority information derived from the additional calendar data, and wherein the priority information represents a level of importance of the overlapping events for the at least one user;

to generate a risk assessment output for the at least one user by applying at least one of the machine learning user activity models to the processed input data; and

to provide the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based at least in part on the risk assessment output.

16. The apparatus of claim 15 , wherein generating the risk assessment output comprises performing one or more static calendar data-related determinations by applying the at least one machine learning user activity model to one or more binary aspects of the processed additional calendar data.

17. The apparatus of claim 15 , wherein the at least one processing device is further configured:

to modify the risk assessment output by applying an adjustment factor to the risk assessment output, wherein the adjustment factor is based at least in part on performing one or more dynamic calendar data-related determinations by applying the at least one machine learning user activity model to one or more variable aspects of the processed additional calendar data.

18. The apparatus of claim 17 , wherein modifying the risk assessment output by applying the adjustment factor to the risk assessment output comprises increasing a risk level associated with the risk assessment output by a given amount or decreasing a risk level associated with the risk assessment output by a given amount, based at least in part on the one or more dynamic calendar data-related determinations.

19. The apparatus of claim 15 , wherein processing the additional calendar data comprises applying one or more natural language processing techniques to the additional calendar data, thereby determining one or more portions of the additional calendar data to process to the one or more data structures associated with the one or more machine learning user activity models.

20. The apparatus of claim 15 , wherein processing the input data comprises implementing an application programming interface associated with a risk engine.