Reducing false detection of anomalous user behavior on a computer network
The disclosed technology teaches a method of reducing false detection of anomalous user behavior on a computer network, including forming groups from identity and access management (IAM) properties and assigning the users into initially assigned groups based on respective IAM properties, and recording individual user behavior in a statistical profile, including application usage frequency. The method also includes dynamically assigning a user with a realigned group, different from the initial assigned group, based on comparing the recorded user behavior, with user behavior in statistical profiles of the users in the groups, evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group. The method utilizes common app usage for forming the groups, in some cases. Further, evaluating anomalous events includes evaluating deviations of the events among ongoing behavior of the individual user based from the individual's statistical profile.
1. A method of reducing false detection of anomalous user behavior on a computer network, including:
actions of,
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initially assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group; and
wherein said actions are enabled via a cloud-based security system, said cloud-based security system being implemented as computer readable instructions being stored within a non-transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU).
2. The method of claim 1 , wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.
3. The method of claim 2 , wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.
4. The method of claim 1 , wherein three-quarters of the groups formed have 30 to 500 users per group.
5. The method of claim 1 , wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
6. The method of claim 1 , wherein the IAM is active directory (abbreviated AD).
7. The method of claim 1 , wherein the IAM is open lightweight directory access protocol (abbreviated LDAP).
8. A tangible non-transitory computer readable storage medium, including program instructions loaded into memory that, when executed on processors, cause the processors to implement a method of reducing false detection of anomalous user behavior on a computer network, including:
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.
9. The tangible non-transitory computer readable storage medium of claim 8 , wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.
10. The tangible non-transitory computer readable storage medium of claim 9 , wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.
11. The tangible non-transitory computer readable storage medium of claim 8 , wherein three-quarters of the groups formed have 30 to 500 users per group.
12. The tangible non-transitory computer readable storage medium of claim 8 , wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
13. The tangible non-transitory computer readable storage medium of claim 8 , wherein the IAM is active directory (abbreviated AD).
14. The tangible non-transitory computer readable storage medium of claim 8 , wherein the IAM is open lightweight directory access protocol (abbreviated LDAP).
15. A device for reducing false detection of anomalous user behavior on a computer network, the device including a processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to implement a process that includes:
forming groups of users from identity and access management (abbreviated IAM) properties;
assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency;
dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and
evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.
16. The device of claim 15 , wherein properties from the IAM used for forming the groups include common app usage, common location and common organization.
17. The device of claim 16 , wherein the statistical profiles of groups are not used when fewer than 100 users or fewer than ten percent of organization population are included in the group, or more than 500 users or more than eighty percent of the organization population are included in the group.
18. The device of claim 15 , wherein evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
19. The device of claim 15 , wherein the IAM is active directory (abbreviated AD).
20. The device of claim 15 , wherein the IAM is lightweight directory access protocol (abbreviated LDAP).