Using weighted peer groups to selectively trigger a security alert
Techniques are described herein that are capable of using weighted peer groups to selectively trigger a security alert. A determination is made that an entity performs an operation. The entity has peers that are categorized among peer groups. For each peer group, an extent to which the peers in the peer group perform the operation is determined. Weights are assigned to the respective peer groups. For each peer group, the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group are combined to provide a respective weighted group value. A risk score, which is based at least in part on the weighted group values of the peer groups, is assigned to the operation. The security alert regarding the operation is selectively triggered based at least in part on the risk score.
1. A system comprising:
a memory; and
a processing system coupled to the memory, the processing system configured to:
determine that an entity performs an operation, the operation comprising an attempt to access a resource;
obtain a feature vector to represent the entity, wherein the feature vector of the entity is based on at least one of a behavioral attribute of the entity or a static attribute of the entity;
obtain feature vectors to represent respective peers of a plurality of peers of the entity, wherein the feature vectors of the respective peers are based on at least one of the following: behavioral attributes of the respective peers or static attributes of the respective peers;
cluster the plurality of peers of the entity into a plurality of peer groups, which comprise subsets of the plurality of peers, using a non-parametric or density-based clustering algorithm by providing information indicating types of relationships, comprising a collaboration relationship, between the peers and the entity from the feature vector of the entity and the feature vectors of the respective peers as input to the non-parametric or density-based clustering algorithm, which causes the non-parametric or density-based clustering algorithm to define the plurality of peer groups, comprising a collaboration peer group, based at least in part on peers in the subsets having respective types of relationships with the entity and further based at least in part on the peers in the subsets having a number of features in common with the entity that is greater than or equal to a threshold number, the collaboration peer group defined by the subset of the peers in the collaboration peer group and the entity having the collaboration relationship by sharing a file, a folder, or a message;
determine a plurality of extents to which the peers in the plurality of peer groups perform the operation;
assign a plurality of weights to the plurality of peer groups, the plurality of weights indicating a plurality of extents to which attributes of the entity, as indicated by the feature vector of the entity, correspond to attributes of the peers in the plurality of peer groups, as indicated by a plurality of combinations of the feature vectors corresponding to the plurality of peer groups, wherein the weights that are assigned to the peer groups are based at least in part on respective sizes of the peer groups, wherein a size of a peer group being smaller corresponds to the weight of the peer group being higher, and wherein the size of the peer group being larger corresponds to the weight of the peer group being lower;
combine the plurality of extents to which the peers in the plurality of peer groups perform the operation and the plurality of weights that are assigned to the plurality of peer groups to provide a plurality of weighted group values;
assign a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation; and
based at least in part on the risk score being greater than or equal to a score threshold, perform a remedial action with regard to the operation by preventing the entity from accessing the resource.
2. The system of claim 1 , wherein the plurality of peer groups further comprises an organizational peer group, which is defined such that each peer in the organizational peer group has a same manager as the entity.
3. The system of claim 1 , wherein the plurality of peer groups further comprises a security peer group, which is defined such that each peer in the security peer group has an identified security permission in common with the entity.
4. The system of claim 1 , wherein the plurality of peer groups further comprises a behavioral peer group, which is defined such that each peer in the behavioral peer group performs a same activity as the entity.
5. The system of claim 1 , wherein the plurality of peer groups is configured to change over time based at least in part on the attributes of the entity changing over time.
6. The system of claim 1 , wherein the weight that is assigned to a peer group is inversely proportional to an average of a difference between a representation of the attributes of the entity and a representation of the attributes of the peers in the peer group; and
wherein the processing system is configured to:
divide the weight that is assigned to the peer group by the extent to which the peers in the peer group perform the operation to provide the respective weighted group value.
7. The system of claim 6 , wherein the risk score that is assigned to the operation is based at least in part on a sum of the weighted group values of the peer groups.
8. The system of claim 1 , wherein the risk score that is assigned to the operation is further based at least in part on a number of peer groups of the entity;
wherein fewer peer groups weights in favor of a lower risk score; and
wherein more peer groups weigh in favor of a higher risk score.
9. The system of claim 1 , wherein the threshold number changes dynamically with time depending on at least one of the following:
a number of peers that are included in the plurality of peers;
an average number of attributes per peer in the plurality of peers; or
a median number of attributes per peer in the plurality of peers.
10. A method implemented by a computing system, the method comprising:
determining that an entity performs an operation, the operation comprising an attempt to access a resource;
obtaining a feature vector to represent the entity, wherein the feature vector of the entity is based on at least one of a behavioral attribute of the entity or a static attribute of the entity;
obtaining feature vectors to represent respective peers of a plurality of peers of the entity, wherein the feature vectors of the respective peers are based on at least one of the following: behavioral attributes of the respective peers or static attributes of the respective peers;
clustering the plurality of peers of the entity into a plurality of peer groups, which comprise subsets of the plurality of peers, using a non-parametric or density-based clustering algorithm by providing information indicating types of relationships, which comprise a collaboration relationship, between the peers and the entity from the feature vector of the entity and the feature vectors of the respective peers as input to the non-parametric or density-based clustering algorithm, which causes the non-parametric or density-based clustering algorithm to define the plurality of peer groups, which comprise a collaboration peer group, based at least in part on peers in the subsets having respective types of relationships with the entity and further based at least in part on the peers in the subsets having a number of features in common with the entity that is greater than or equal to a threshold number, the collaboration peer group defined by a first subset of the plurality of peers having the collaboration relationship with the entity by sharing a file, a folder, or a message with the entity;
determining a plurality of extents to which the peers in the plurality of peer groups perform the operation;
assigning a plurality of weights to the plurality of peer groups, the plurality of weights indicating a plurality of extents to which attributes of the entity, as indicated by the feature vector of the entity, correspond to attributes of the peers in the plurality of peer groups, as indicated by a plurality of combinations of the feature vectors corresponding to the plurality of peer groups;
combining the plurality of extents to which the peers in the plurality of peer groups perform the operation and the plurality of weights that are assigned to the plurality of peer groups to provide a plurality of weighted group values;
assigning a risk score to the operation, wherein the risk score is based at least in part on the weighted group values of the peer groups and is further based at least in part on a number of peer groups of the entity, wherein fewer peer groups weighs in favor of a lower risk score, and wherein more peer groups weighs in favor of a higher risk score; and
based at least in part on the risk score being greater than or equal to a score threshold, performing a remedial action with regard to the operation by preventing the entity from accessing the resource.
11. The method of claim 10 , wherein the plurality of peer groups changes over time based at least in part on the attributes of the entity changing over time.
12. The method of claim 10 , wherein the weight that is assigned to a peer group is inversely proportional to an average of a difference between a representation of the attributes of the entity and a representation of the attributes of the peers in the peer group; and
wherein, for each peer group in the plurality of peer groups, combining the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value comprises:
dividing the weight that is assigned to the peer group by the extent to which the peers in the peer group perform the operation to provide the respective weighted group value.
13. The method of claim 10 , wherein the weights that are assigned to the peer groups are based at least in part on respective sizes of the peer groups;
wherein a smaller size of a peer group causes the weight of the peer group to be higher; and
wherein a larger size of a peer group causes the weight of the peer group to be lower.
14. The method of claim 10 , wherein the organizational peer group defined by the subset of the peers in the organizational peer group and the entity have a same manager.
15. A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
determining that an entity performs an operation, the operation comprising an attempt to access a resource;
obtaining a feature vector to represent the entity, wherein the feature vector of the entity is based on at least one of a behavioral attribute of the entity or a static attribute of the entity;
obtaining feature vectors to represent respective peers of a plurality of peers of the entity, wherein the feature vectors of the respective peers are based on at least one of the following: behavioral attributes of the respective peers or static attributes of the respective peers;
clustering the plurality of peers of the entity into a plurality of peer groups, which comprise subsets of the plurality of peers, using a non-parametric or density-based clustering algorithm by providing information indicating types of relationships, comprising an organizational relationship, between the peers and the entity from the feature vector of the entity and the feature vectors of the respective peers as input to the non-parametric or density-based clustering algorithm, which causes the non-parametric or density-based clustering algorithm to define the plurality of peer groups, comprising an organizational peer group, based at least in part on peers in the subsets having respective types of relationships with the entity and further based at least in part on the peers in the subsets having a number of features in common with the entity that is greater than or equal to a threshold number;
determining a plurality of extents to which the peers in the plurality of peer groups perform the operation;
assigning a plurality of weights to the plurality of peer groups, the plurality of weights indicating a plurality of extents to which attributes of the entity, as indicated by the feature vector of the entity, correspond to attributes of the peers in the plurality of peer groups, as indicated by a plurality of combinations of the feature vectors corresponding to the plurality of peer groups;
combining the plurality of extents to which the peers in the plurality of peer groups perform the operation and the plurality of weights that are assigned to the plurality of peer groups to provide a plurality of weighted group values;
assigning a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation; and
based at least in part on the risk score being greater than or equal to a score threshold, performing a remedial action with regard to the operation by preventing the entity from accessing the resource;
wherein at least one of the following:
the plurality of weights that are assigned to the plurality of peer groups are based at least in part on a plurality of respective sizes of the plurality of peer groups, wherein a smaller size of a peer group causes the weight of the peer group to be higher, and wherein a larger size of a peer group causes the weight of the peer group to be lower; or
the risk score that is assigned to the operation is further based at least in part on a number of peer groups of the entity, wherein fewer peer groups weights in favor of a lower risk score, and wherein more peer groups weigh in favor of a higher risk score.
16. The computer program product of claim 15 , wherein the plurality of peer groups further comprises a collaboration peer group, which is defined by the subset of the peers in the collaboration peer group and the entity having the collaboration relationship by sharing at least one of a file or a folder.
17. The computer program product of claim 15 , wherein the plurality of peer groups further comprises a security peer group, which is defined such that each peer in the security peer group has an identified security permission in common with the entity.
18. The computer program product of claim 15 , wherein the plurality of peer groups further comprises a behavioral peer group, which is defined such that each peer in the behavioral peer group performs a same activity as the entity.
19. The computer program product of claim 15 , wherein the plurality of weights that are assigned to the plurality of peer groups are based at least in part on the plurality of respective sizes of the plurality of peer groups.
20. The computer program product of claim 15 , wherein the risk score that is assigned to the operation is further based at least in part on the number of peer groups of the entity.