Techniques for identity data characterization for data protection
Certain aspects involve a system, computer-implemented method, and computer-readable medium for identifying attributes associated with a target entity such as a person. A hierarchical characterization system receives an attribute and a request for associated identity data. The system generates an identity graph that includes attribute nodes corresponding to respective attributes and online interaction nodes corresponding to respective online interactions. The system correlates at least a subset of the online interactions and at least a subset of the attributes with a particular entity. The system generates a report indicating an identity of the entity and a behavior of the entity based on the correlated online interactions and the correlated attributes.
1. A computer-implemented method comprising:
receiving, by a computing system from a computing device, a first attribute and a request for associated identity data;
responsive to the request, generating, by the computing system, an identity graph comprising a plurality of attribute nodes corresponding to a respective plurality of attributes and a plurality of online interaction nodes corresponding to a respective plurality of online interactions, the attribute nodes including an attribute node corresponding to the first attribute;
based on the identity graph, correlating, by the computing system, at least a subset of the plurality of online interactions and at least a subset of the plurality of attributes with a particular entity, wherein the correlating comprises executing a diffusion process on the identity graph to compute a probability distribution for each of the online interactions; and
generating, by the computing system based on the correlated online interactions and the correlated attributes, a report indicating an identity of the particular entity and a behavior of the particular entity.
2. The method of claim 1 , further comprising:
responsive to the request for the identity data, providing the report to the computing device as output.
3. The method of claim 1 , further comprising: based on the correlated online interactions and the correlated attributes, executing an action to prevent the particular entity from accessing a computing resource.
4. The method of claim 1 , wherein the diffusion process comprises one or more of:
personalized page rank;
restricted personalized page rank;
random walks with restarts;
a variant of belief propagation; or
lazy random walks.
5. The method of claim 1 , wherein the identity graph comprises a bipartite graph.
6. The method of claim 1 , wherein the particular entity is a first entity, and wherein generating the report indicating the identity and the behavior of the first entity includes determining an identity and a behavior of a second entity that is associated with the first entity.
7. The method of claim 6 , further comprising determining one or more projections of future behavior associated with the first entity and the second entity.
8. The method of claim 1 , wherein each attribute semi-uniquely identifies the particular entity.
9. The method of claim 1 , wherein:
generating the report indicating the identity and the behavior of the particular entity includes inferring a set of historical events associated with the particular entity, wherein the set of historical events includes one or more online interactions; and
generating the report indicating the identity and the behavior of the particular entity includes determining whether the set of historical events includes an anomaly.
10. A system comprising:
a processor; and
a non-transitory computer-readable medium comprising instructions that are executable by the processor to cause the processor to perform operations comprising:
receiving, by a computing system from a computing device, a first attribute and a request for associated identity data;
responsive to the request, generating, by the computing system, an identity graph comprising a plurality of attribute nodes corresponding to a respective plurality of attributes and a plurality of online interaction nodes corresponding to a respective plurality of online interactions, the attribute nodes including an attribute node corresponding to the first attribute;
based on the identity graph, correlating, by the computing system, at least a subset of the plurality of online interactions and at least a subset the plurality of attributes with a particular entity, wherein the correlating comprises executing a diffusion process on the identity graph to compute a probability distribution for each of the online interactions; and
generating, by the computing system based on the correlated online interactions and the correlated attributes, a report indicating an identity of the particular entity and a behavior of the particular entity.
11. The system of claim 10 , wherein the operations further comprise:
responsive to the request for the identity data, providing the report to the computing device as output.
12. The system of claim 10 , wherein the identity graph comprises a bipartite graph, and wherein the diffusion process comprises one or more of:
personalized page rank;
restricted personalized page rank;
random walks with restarts;
a variant of belief propagation; or
lazy random walks.
13. The system of claim 10 , wherein the particular entity is a first entity, and wherein the operation of generating the report indicating the identity and the behavior of the first entity includes determining an identity and a behavior of a second entity that is associated with the first entity, and wherein the operations further comprise determining one or more projections of future behavior associated with the first entity and the second entity.
14. The system of claim 10 , wherein each attribute semi-uniquely identifies the particular entity.
15. The system of claim 10 , wherein:
the operation of generating the report indicating the identity and the behavior of the particular entity includes inferring a set of historical events associated with the particular entity, wherein the set of historical events includes one or more online interactions; and
the operation of generating the report indicating the identity and the behavior of the particular entity includes determining whether the set of historical events includes an anomaly.
16. A non-transitory computer-readable storage medium having program code that is executable by a processor device to cause a computing device to perform operations, the operations comprising:
receiving, by a computing system from a computing device, a first attribute and a request for associated identity data;
responsive to the request, generating, by the computing system, an identity graph comprising a plurality of attribute nodes corresponding to a respective plurality of attributes and a plurality of online interaction nodes corresponding to a respective plurality of online interactions, the attribute nodes including an attribute node corresponding to the first attribute;
based on the identity graph, correlating, by the computing system, at least a subset of the plurality of online interactions and at least a subset the plurality of attributes with a particular entity, wherein the correlating comprises executing a diffusion process on the identity graph to compute a probability distribution for each of the online interactions; and
generating, by the computing system based on the correlated online interactions and the correlated attributes, a report indicating an identity of the particular entity and a behavior of the particular entity.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the operations further comprise:
responsive to the request for the identity data, providing the report to the computing device as output.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the identity graph comprises a bipartite graph, and wherein the diffusion process comprises one or more of:
personalized page rank;
restricted personalized page rank;
random walks with restarts;
a variant of belief propagation; or
lazy random walks.
19. The non-transitory computer-readable storage medium of claim 16 wherein:
each attribute semi-uniquely identifies the particular entity;
the operation of generating the report indicating the identity and the behavior of the particular entity includes inferring a set of historical events associated with the particular entity, wherein the set of historical events includes one or more online interactions; and
the operation of generating the report indicating the identity and the behavior of the particular entity includes determining whether the set of historical events includes an anomaly.