Risk assessment for network access control through data analytics

Abstract

Methods and systems of risk assessment for network access control through data analytics. An embodiment of the invention employs well-known machine-learning clustering methods to learn normal entity behavior by looking for patterns in the events that stream in continuously. In an embodiment of the invention, normal entity behaviors are represented as clusters of event vectors. An embodiment of the invention evaluates the risk level for a new event of an entity by comparing the event with the entity's profile represented as clusters of event vectors. In an embodiment of the invention, the risk level is associated with a confidence level. Confidence level indicates how well the system knows about the entity. Embodiments of the invention do not need human administration in the process of building entity profile and assessing risk level of events associated with an entity.

Description

FIELD OF THE DISCLOSURE[0001]This disclosure relates generally to Internet security and, more particularly, to methods and systems of risk assessment for network access control through data analytics.BACKGROUND[0002]Authentication and authorization are security means to protect a computer network from unauthorized access to its resources such as computer servers, software applications and services, and so on. Authentication verifies the identity of an entity (person, user, process, or device) that wants to access a computer network resources. In the rest of this disclosure, terms of an entity, a person, a process, a user and a device will be used interchangeably. Common ways for authentication are username / password combination, fingerprint readers, retinal scans, etc. On the other hand, authorization determines what privileges that an authenticated entity has during the entity's session from log-on until log-off. The privileges assigned to an entity define the entity's access right ...

AI Technical Summary

Benefits of technology

The invention allows for the automatic building of profiles for entities and the assessment of associated risks, without requiring human intervention. The system uses rules to trigger risk assessments based on the events that have previously occurred with that entity, and these rules are updated based on new events. This makes the system much easier to use than previous methods.

Problems solved by technology

For example, an entity may only be able to read documents but not allowed to edit documents.

However, MFA increases the authentication security at the cost of increased complexity of the network login process for a user.

Adaptive MFA is rule-based, though, which limits its effectiveness because those rules are static.

In addition, adaptive MFA only act on the conditions at the time of a user's login without considering the user's past network access and usage history.

Therefore, adaptive MFA cannot determine if the user's current login activity is normal or abnormal.

Images