Scored privileges

Abstract

Provided is a computer-implemented method comprising monitoring commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities, each command corresponds to one of one or more command types, and each command involves one of one or more privileges; storing numbers of commands, each number of command being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot; performing risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, the risk level processing comprising: determining a risk level, from among at least three risk levels, using the stored numbers of commands; and outputting a risk indication based on the determined risk level.

Description

[0001] Scored Privileges

[0002] TECHNICAL FIELD

[0003] The present disclosure generally relates to methods and systems in the field of privilege management of data repositories.

[0004] BACKGROUND

[0005] In a typical implementation of a data repository, like a database, for example, a hierarchical structure is applied that required a user that needs access to a database object to have permission to all the objects in the path from the database to the individual object that is to be accessed. For this purpose, certain privileges are granted to a user, a group of users, or a role, on different levels of hierarchy, and on different entities. Example privileges include select, insert, delete, and update, wherein each of which typically pertains to data values that are stored within a table, index, view, or other DB object or data repository entity. Other examples of privileges include, for instance, commands like create, drop, alter, or truncate (e.g. Data Definition Language (DDL) commands), for instance, for creating a data repository entity, e.g. a table or collection in a certain level of the hierarchy. Further examples include commands to create a new user, to grant access to a user to a different parts of the data repository.

[0006] Accordingly, the granted privilege are complex. Due to the complexity, it may be difficult to analyze which privileges are required or needed and which privileges are not or no longer required. Further, removing a required privilege may cause issues or data repository downtime. On the other hand, maintaining a privilege that is actually not required or not used at all, security issued may arise. Maintaining a privilege / permission that is not required may increase the risk of an attack. For instance, there is a risk that the user becomes compromised or malicious. It is therefore desirable to keep the granted privileges to a minimum required for proper operation of / interaction with the data repository according to the intended purpose and function of the data repository.

[0007] Therefore, the concept of least privilege is a fundamental principle in computer security and access control. It advocates for providing users, programs, and processes with only the minimum level of access or permissions needed to perform their legitimate tasks.

[0008] In practical terms, this means granting users and processes the fewest privileges necessary to complete their tasks, while still maintaining functionality. By adhering to the principle of least privilege, organizations can reduce the potential damage caused by compromised accounts or malicious software. It helps mitigate the risk of unauthorized access, data breaches, and system compromises by limiting the scope of actions that can be taken by any given entity.

[0009] Implementing least privilege requires careful analysis of the access rights required by users and applications, followed by the configuration of access controls to enforce those minimum privileges. This approach helps to minimize the attack surface of a system, making it more resilient to both internal and external threats.

[0010] US 2015 / 0370824 Al describes a method for identifying a subset of privileges that are not used by any of requesting entities by monitoring accesses to an object of a database and storing a record associating said database accesses to the database, the requesting entity, the privilege, and the object. Using said records of database accesses, a subset of privileges not used by any of the requesting entities is identified.

[0011] However, since in above-described method focus is laid only on whether or not a privilege is used or not, a privilege that is used only rarely and, hence, might not be required, may be maintained. Thus, data loss or data corruption might occur when maintaining the privileges identified by said method. SUMMARY

[0012] As detailed above, there is room for improvement in order to prevent data loss or data corruption in the framework of analysis of privileges in a data repository environment.

[0013] The present disclosure attempts to mitigate this situation. The present disclosure relates to the analysis of commands, involving a privilege, to a data repository during a monitoring period and the provision of a risk level associated with respective privilege.

[0014] The present disclosure is defined by the scope of the independent claims. The dependent claims provide advantageous embodiments of the present disclosure.

[0015] The present disclosure provides a first aspect of a computer-implemented method, comprising monitoring commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities, each command corresponds to one of one or more command types, and each command involves one of one or more privileges; storing numbers of commands, each number of command being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot; performing risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, the risk level processing comprising: determining a risk level, from among at least three risk levels, using the stored numbers of commands; and outputting a risk indication based on the determined risk level.

[0016] Using a three or more risk levels allows for a decision on whether or not a privilege is needed. According to the present disclosure, different risk levels may be determined according to different situations, which may facilitate an improved security solution.

[0017] Further, outputting the risk indication, in particular for unusual and suspicious situations, may allow a customer to make better decisions and to guide him to follow some operations and focus the customer’s attention on risky activities that might require deeper investigation.

[0018] Still further, by the risk indication, the customer may be provided with an explanation as to why a certain risk level is determined, which may facilitate the customer to perform a reasonable decision of whether or not a privilege should be removed.

[0019] According to an implementation of the method of the first aspect, determining the risk level may comprise: calculating a plurality evaluation values using the stored numbers of commands; determining two or more determination levels by applying a set of rules to the plurality of evaluation values; and determining the risk level according to a risk assessment array associating each combination of the two or more determination levels with one of the at least three risk levels.

[0020] The application of statistical rules to the evaluation values facilitates a simple implementation of risk level determination. Complex libraries and / or the user of more complex systems, e.g. including the application of artificial intelligence, is not required. This reduces the processing resources to be necessary for performing the risk level determination.

[0021] According to an implementation of the method of the first aspect, the plurality of evaluation values may be calculated using at least one of (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, (ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, (iii) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, (iv) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity, (v) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, (vi) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots, and (v) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots.

[0022] With this, there is the possibility to distinguish between situations and to identify suspicious actions, even though said actions might be legitimate actions. Again, this may allow for alerting a customer in a case where an unusual or suspicious situation is detected.

[0023] According to an implementation of the method of the first aspect, determining the risk level may comprise: determining a user entity ratio, using (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots; and determining the respective risk level using the user entity ratio.

[0024] For example, the user entity ratio may be determined by calculating the ratio of (i) the total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) the total number of commands associated with the respective command type, any of the users, the respective data repository entity.

[0025] According to an implementation of the method of the first aspect, determining the risk level may further comprise: determining a user entity frequency, as an evaluation value of one or more evaluation values, using: (i) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, and (ii) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity; and determining the risk level further using the user entity frequency.

[0026] For example, the user entity frequency may be determined by calculating a ratio of (i) the total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, and (ii) the total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity.

[0027] According to an implementation of the method of the first aspect, determining the risk level may further comprise: determining a user ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the user ratio.

[0028] For example, the user ratio may be determined by calculating the ratio of (i) the total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, and (ii) the total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots. According to an implementation of the method of the first aspect, determining the risk level may further comprise: determining an entity ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the entity ratio.

[0029] For example, the entity ratio may be determined by calculating a ratio of (i) the total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, and (ii) the total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots.

[0030] According to an implementation of the method of the first aspect, determining the risk level may further comprise: determining a command ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the command ratio.

[0031] For example, the command ratio may be determined by calculating a ratio of (i) the total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) the total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots.

[0032] According to an implementation of the method of the first aspect, determining the risk level may further comprise: determining a user entity ratio level, from among a plurality of user entity ratio levels, by performing a classification using the user entity ratio; determining a population ratio level, from among a plurality of population ratio levels, by applying a set of rules to the one or more evaluation values; and determining the risk level according to a risk assessment matrix associating each pair consisting of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels with one of the at least three risk levels.

[0033] This facilitates a simple implementation of risk evaluation.

[0034] According to an implementation of the method of the first aspect, the method may further comprise: in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing user entity ratio level.

[0035] For example, in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels may increase with decreasing user entity ratio level.

[0036] According to an implementation of the method of the first aspect, in the risk assessment matrix, for at least one population ratio level, the highest user entity ratio level may be associated with a risk level lower than a risk level associated with the lowest user entity ratio level.

[0037] According to an implementation of the method of the first aspect, the method may comprise: in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing population ratio level. For example, in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels may increase with decreasing population ratio level.

[0038] According to an implementation of the method of the first aspect, in the risk assessment matrix, for at least one user entity ratio level, the highest population ratio level may be associated with a risk level lower than a risk level associated with the lowest population ratio level.

[0039] According to an implementation of the method of the first aspect, the risk level processing may comprise: performing a removal recommendation determination of whether a privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed or maintained, according to the determined risk level, wherein the risk indication may correspond to a result of the removal recommendation determination.

[0040] This allows for a recommendation to be given to the customer as to whether or not a privilege should be removed. Accordingly, a burden of the customer for deciding of whether or not the privilege is to be removed is decreased.

[0041] According to an implementation of the method of the first aspect, the removal recommendation determination may comprise: determining that the privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed, when the determined risk level is equal to or higher than a threshold risk level; and determining that said privilege should be maintained when the determined risk level is lower than the threshold risk level.

[0042] According to an implementation of the method of the first aspect, the risk level processing may comprise: removing or maintaining the privilege corresponding to the respective command type, the respective user, and the respective data repository entity, according to a result of the removal recommendation determination.

[0043] This allows for an automatic removal of privileges associated with a relatively high risk level, rendering the decision of the customer on this aspect unnecessary. Further, the privileges may be removed / maintained in a relatively short period of time, not requiring any customer interaction.

[0044] According to an implementation of the method of the first aspect, the risk level processing may be performed for at least two combinations of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the at least two combinations may differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

[0045] According to an implementation of the first method of the first aspect, the risk level processing may be performed for each combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the combinations may differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

[0046] The present disclosure further provides a second aspect of a data processing apparatus, comprising processing circuitry configured to monitor commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities, each command corresponds to one of one or more command types, and each command involves one of one or more privileges; and a memory configured to store numbers of commands, each number of commands being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot, wherein the processing circuitry is further configured to perform risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, the risk level processing comprising: determining a risk level, from among at least three risk levels, using the stored numbers of commands, and outputting a risk indication based on the determined risk level.

[0047] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may comprise: calculating a plurality evaluation values using the stored numbers of commands; determining two or more determination levels by applying a set of rules to the plurality of evaluation values; and determining the risk level according to a risk assessment array associating each combination of the two or more determination levels with one of the at least three risk levels.

[0048] According to an implementation of the data processing apparatus of the second aspect, the plurality of evaluation values may be calculated using at least one of (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, (ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, (iii) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, (iv) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity, (v) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, (vi) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots, and (vii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots.

[0049] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may comprise: determining a user entity ratio, using: (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots; and determining the respective risk level using the user entity ratio.

[0050] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may further comprise: determining a user entity frequency, as an evaluation value of one or more evaluation values, using: (i) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, and (ii) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity; and determining the risk level further using the user entity frequency.

[0051] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may further comprise: determining a user ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the user ratio.

[0052] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may further comprise: determining an entity ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the entity ratio. According to an implementation of the data processing apparatus of the second aspect, determining the risk level may further comprise: determining a command ratio, as an evaluation value of one or more evaluation values, using: (i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and (ii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the command ratio.

[0053] According to an implementation of the data processing apparatus of the second aspect, determining the risk level may further comprise: determining a user entity ratio level, from among a plurality of user entity ratio levels, by performing a classification using the user entity ratio; determining a population ratio level, from among a plurality of population ratio levels, by applying a set of rules to the one or more evaluation values; and determining the risk level according to a risk assessment matrix associating each pair consisting of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels with one of the at least three risk levels.

[0054] According to an implementation of the data processing apparatus of the second aspect, the data processing apparatus may comprise: in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing user entity ratio level.

[0055] According to an implementation of the data processing apparatus of the second aspect, in the risk assessment matrix, for at least one population ratio level, the highest user entity ratio level may be associated with a risk level lower than a risk level associated with the lowest user entity ratio level.

[0056] According to an implementation of the data processing apparatus of the second aspect, the data processing apparatus may comprise: in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing population ratio level.

[0057] According to an implementation of the data processing apparatus of the second aspect, in the risk assessment matrix, for at least one user entity ratio level, the highest population ratio level may be associated with a risk level lower than a risk level associated with the lowest population ratio level.

[0058] According to an implementation of the data processing apparatus of the second aspect, the risk level processing may comprise: performing a removal recommendation determination of whether a privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed or maintained, according to the determined risk level, wherein the risk indication may correspond to a result of the removal recommendation determination.

[0059] According to an implementation of the data processing apparatus of the second aspect, the removal recommendation determination may comprise: determining that the privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed, when the determined risk level is equal to or higher than a threshold risk level; and determining that said privilege should be maintained when the determined risk level is lower than the threshold risk level.

[0060] According to an implementation of the data processing apparatus of the second aspect, the risk level processing may comprise: removing or maintaining the privilege corresponding to the respective command type, the respective user, and the respective data repository entity, according to a result of the removal recommendation determination. According to an implementation of the data processing apparatus of the second aspect, the risk level processing may be performed for at least two combinations of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the at least two combinations may differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

[0061] According to an implementation of the data processing apparatus of the second aspect, the risk level processing may be performed for each combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the combinations differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

[0062] The present disclosure further provides a third aspect of a data processing apparatus, the data processing apparatus being configured to carry out the method of the first aspect.

[0063] The present disclosure further provides a fourth aspect of a computer program product comprising program code for performing the method according to the first aspect when executed on a computer or a processor.

[0064] The present disclosure further provides a fifth aspect of a non-transitory computer-readable storage medium comprising instructions which, when executed by one or more computing devices, cause the one or more computing devices to carry out the method of the first aspect.

[0065] BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In the following, embodiments of the present disclosure are described in more detail with reference to the attached figures and drawings.

[0067] FIG. 1 illustrates the steps of a computer-implemented method according to an embodiment of the present disclosure. FIG. 2 illustrates a configuration of a data processing apparatus according to an embodiment of the present disclosure.

[0068] FIG. 3 illustrates exemplary details of a risk level processing of a computer-implemented method according to the embodiment of the present disclosure.

[0069] FIG. 4 illustrates details of a risk level determination of a computer-implemented method according to the embodiment of the present disclosure.

[0070] FIG. 5 illustrates an example of stored numbers of commands associated with respective command types, users, and data repository entity.

[0071] FIG. 6 illustrates exemplary measures used for calculation of evaluation values using the example of Fig. 5.

[0072] FIG. 7 illustrates a risk assessment matrix according to an embodiment of the present disclosure.

[0073] FIG. 8 illustrates an example of another risk assessment matrix according to another embodiment of the present disclosure.

[0074] FIG. 9 illustrates an example of yet another risk assessment matrix according to yet another embodiment of the present disclosure.

[0075] FIG. 10 illustrates examples of the determination of risk levels for combinations of command types, users, and data repository entities according to an embodiment of the present disclosure.

[0076] FIG. 11 illustrates a decision tree for determining a risk level according to an embodiment of the present disclosure. DESCRIPTION

[0077] FIG. 1 illustrates the steps illustrates the steps of a computer-implemented method according to an embodiment of the present disclosure. In step SI, commands to a data repository initiated by users are monitored during a monitoring period including a plurality of time slots. The data repository includes one or more data repository entities. Each command corresponds to one or more command types, and involves one of one or more privileges. In step S2, numbers of commands are stored, wherein each number of command is associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot. In step S3, risk level processing is performed for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities.

[0078] FIG. 2 illustrates details of a risk level processing of a computer-implemented method according to the embodiment of the present disclosure. In step S31, a risk level is determined, from among at least three risk levels, using the stored numbers of commands. In step S32, a risk indication is output, that is based on the determined risk level.

[0079] FIG. 3 illustrates exemplary details of a risk level determination of a computer-implemented method according to the embodiment of the present disclosure. In step S311, evaluation values are calculated using the stored numbers of commands. In step S312, two or more determination levels are determined by applying a set of rules to the plurality of evaluation values. Subsequently, in step S313, the risk level is determined according to a risk assessment array, in which each combination of the two or more determination levels are associated with one of the at least three risk levels.

[0080] FIG. 4 illustrates a configuration of a data processing apparatus 1 according to an embodiment of the present disclosure. The data processing apparatus 1 comprises processing circuitry 11 and a memory 12. The processing circuitry 12 is configured to monitor commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities, each command corresponds to one of one or more command types, and each command involves one of one or more privileges. The memory 12 is configured to store number of commands each number of commands being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot. The processing circuitry 11 is further configured to perform risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities. The risk level processing comprises determining a risk level, from among at least three risk levels, using the stored numbers of commands, and outputting a risk indication based on the determined risk level.

[0081] It is to be noted that a data repository may be a database, a relational database management system, a NoSQL database, a cloud storage, a file system, or any other system. A data repository entity may relate to a table, a data structure, a database entity, or any other entity. Further, a user may be a specific user, a group of users, or users associated with a certain role.

[0082] In the following, a detailed implementation of the determination of the risk level according to an embodiment of the present disclosure is provided.

[0083] FIG. 5 illustrates an example of stored numbers of commands associated with respective command types, users, and data repository entity. In the illustrated example, users include ‘Mobilel ’, ‘Webl’, ‘Web2’, ‘Mobile2’, ‘Devops’, ‘HR’, and ‘Analytics’. However, these users are only exemplary, and a user may refer to a specific user, a group of users comprising one or more specific users, or a role associated with one or more users. The data repository, in this example, includes the data repository entities, which are implemented as data tables, ‘Tickets’, ‘Ticket_event’, ‘Priorities’, ‘Users’, and ‘Countries’. However, these tables / data repositories are merely exemplary and the present disclosure is not limited to any of these tables. In Fig. 5, the number of commands initiated by the users during the monitoring period are indicated. Fig. 5 illustrates the number of commands initiated during the entire monitoring period for a specific command. The specific command may be, for example, any one of select, insert, delete, and update. However, the present disclosure is not limited to any specific set of command types, and the present disclosure may be applied to any command type (e.g. SQL command types of SQL DDL, DML, DCL, TCL, and / or DQL). Further, Fig. 5 illustrates the total number of said specific command associated with respective user and respective table / data repository entity initiated during the entire monitoring period. However, a similar table is stored for each of the plurality of time slots. A time slot may be any time period. For example, the monitoring period may consist of a plurality of consecutive time slots of each length. A time slot may be a minute, an hour, a day, a week, a month, etc. It is to be noted that in the lowest row and the rightmost column, the sum over all rows and columns, respectively, is provided. In order to prevent a division by zero, a small > (in this example, 0.0001) is added to each of said sums.

[0084] Using the stored numbers of commands, risk level processing is performed in order to determine a risk level for at least one combination of a command type (e.g. select, insert, delete, update), a user, and a data repository entity. This may be performed using certain evaluation values derived from the stored numbers of commands initiated during the monitoring period. The evaluation values may be derived using at least one of the following measures:

[0085] • A total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots. This measure may be referred to as user command entity, UCE, and denotes the contribution of a user command to the data repository entity.

[0086] • A total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots. This measure may be referred to as command entity, CE, and denotes the number of a specific command to a specific data repository entity.

[0087] • A total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity. This measure may be referred to as UCE_TS and denotes the number of time slots a specific user performed a specific command to a specific data repository entity. For example, when a time slot is a day, this measure indicates the number of days during the monitoring period a specific user inserted records to a specific data repository entity / table.

[0088] • A total number of time slots associated with a number of commands greater than zero, the respective command type, any one ofthe users, and the respective data repository entity. This measure may be referred to as CE_TS and denotes the total number of time slots a specific data repository entity was active with a specific command type. For example, given that a time slot is a day, CE_TS may indicate the number of days during the monitoring period a specific data repository entity was active, irrespective of the users.

[0089] • A total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots. This measure may be referred to as user command, UC, and denotes the total number of commands a specific user initiated to any of the data repository entities during the entire monitoring period. For example, UC may indicate that a specific user initiated a certain number of ‘select’ -commands over all data repository entities.

[0090] • A total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots. This measure may be referred to as population command, C, and denotes the total number of commands of a specific command type over all data repository entities and all users during the entire monitoring period. For example, C may indicate a certain number of ‘select’ commands initiated by all users during the entire monitoring period for any of the data repository entities / tables.

[0091] • A total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots. This measure may be denoted user total command, U, and denotes the total number of commands (not of a specific command type) a specific user initiated during the entire monitoring period to any of the data repository entities. That is, U indicates the total number of commands of a specific user during the monitoring period.

[0092] FIG. 6 illustrates exemplary measures that may be used for calculation of evaluation values using the example of Fig. 5. In the illustrated example, UCE is indicated for user ‘Web2’ and data repository entity / table ‘Ticket’ as 100. That is, the user (or user group, or role) ‘Web2’ initiated 100 commands of the specific command type during the monitoring period to data repository entity / table ‘Ticket’. Further, CE is indicated for data repository ‘Ticket’ as 10200.0001. That is, for data repository entity ‘Ticket’, a 10200 commands of the specific command type were initiated to the data repository entity ‘Ticket’ during the entire monitoring period. In this respect, it is again noted that a small > (0.0001) was added in order to prevent division by zero in subsequent processing of the measures. Still further, UC is indicated for user ‘Web2’ as 10101.0001. That is, the user (or user group, role) ‘Web2’ performed 10101 commands during the monitoring period to any of the data repository entities (again, > is added here). Still further, C is indicated for the specific command as 40437.0001. That is, the total number of commands of the specific type performed during the monitoring period is 40437 (again, > is added here).

[0093] Using the measured indicated above and, exemplarily, illustrated in Fig. 6, a plurality of evaluation values may be derived. For example, evaluation values may be derived by calculating a ratio of certain combinations of the indicated measures. For example, the following evaluation values may be obtained using the indicated measures:

[0094] • An evaluation value referred to as user entity ratio may be derived using UCE and CE, for example by calculating the ratio UCE / CE. The user entity ratio represents how dominant a specific user was in a specific part of a dataflow.

[0095] • An evaluation value referred to as user entity frequency may be derived using UCE_TS and CE_TS, for example by calculating the ratio UCE_TS / CE_TS. The user entity frequency represents how often a command of a certain command type is initiated by a specific user, in comparison to the commands of said command type initiated by any user.

[0096] • An evaluation value referred to as a user ratio may be derived using UC and C, for example by calculating the ratio UC / C. The user ratio represents, for a specific command type, the dominance of the specific user, over all data repository entities, with respective to all users.

[0097] • An evaluation value referred to as entity ratio may be derived using CE and C, for example by calculating the ratio CE / C. The entity ratio represents, for a specific command type, the dominance of a specific data repository entity, over all users, with respect to all data repository entities.

[0098] • An evaluation value referred to as command ratio may be derived using UCE and U, for example by calculating UCE / C. The command ratio represents the dominance, for a specific user, of a specific command type, with respect to all commands.

[0099] However, the present disclosure is not limited to any specific calculation of evaluation values, and other evaluation values may be determined using the measures indicated above. For example, instead or in addition to the calculation of above-mentioned ratios, respective inverse values may be determined und used in the further processing.

[0100] Using the derived evaluation values, two or more determination levels are determined by applying a set of rules, which may be statistical rules, to the plurality of evaluation values.

[0101] For example, a first determination level, referred to as a user entity ratio level, is determined by performing a classification using the user entity ratio. The first determination level is determined from among a plurality of potential first determination levels. For example, the user entity ratio level is determined as one of ‘significant’, ‘moderate’, ‘rare’, and ‘unlikely’ as potential user entity ratio levels. The user entity ratio level is determined as being • ‘significant’ if the determined user entity ratio is above 0.9,

[0102] • ‘moderate’ if the determined user entity ratio is equal to or below 0.9 and equal to or above 0.1,

[0103] • ‘rare’ if the determined user entity ratio is below 0.1, but not 0, and

[0104] • ‘unlikely’ if the determined user entity ratio is 0.

[0105] However, the boundaries between the potential user entity ratio levels may be set differently and may be set according to a configuration. That is, the boundaries between the user entity ratio levels may be configured or re-configured according to a user (operator / customer)-selected configuration. For example, the boundaries between said user entity ratio levels may be set to 0.8, 0.2, and zero.

[0106] Further, a second determination level, referred to as a population ratio level, may is set by applying a set of rules to the evaluation values. For this purpose, the user entity frequency, the user ration, the entity ratio and the command ratio may be used. The potential population ratios may be ‘negligible’, ‘moderate’, and ‘high’. The population ratio may be determined from among these levels according to the following.

[0107] In the following, Tow’ indicates a value below 0.1, ‘medium’ indicates a value equal to or above 0.1 and equal to or below 0.9, and ‘high’ indicates a value above 0.9. However, the boundaries between Tow’, ‘medium’, and ‘high’ may be set differently and, in particular, may be configured according to user (operator / customer) preferences. For example, the boundaries may be set to 0.2 and 0.8.

[0108] The population ratio level is set as ‘negligible’ if

[0109] • the user entity frequency is low, or

[0110] • the user ratio is low and the entity ratio is low and the command ratio is low or medium and the user entity frequency is medium or high.

[0111] The population ratio level is set as ‘moderate’ if

[0112] • the user ratio is medium or high and the entity ratio is low and the command ratio is low or medium and the user entity frequency is medium or high, or

[0113] • the user ratio is medium or high and the entity ratio is medium or high and the command ratio is low or medium and the user entity frequency is medium or high.

[0114] The population ratio level is set as ‘high’ if

[0115] • the command ratio is high, or

[0116] • the user ratio is medium or high and the entity ratio is medium or high and the command ratio is low or medium and the user entity frequency is medium or high.

[0117] That is, using these statistical rules, a first determination level, i.e. the user entity ratio level, and a second determination level, i.e. the population ratio level, are determined. This may be performed for one combination of a user, a command type, and a data repository entity (e.g. a table of a database). However, the determination levels may be determined for more than one combination or for all possible combinations. Although a specific set of statistical rules is described for determining the determination levels using the evaluation values, the present disclosure is not limited thereto, and a different set of statistical rules may be utilized. For example, such statistical rules may be determined by assuming a potential attack scenario (illegitimate command to the data repository) and analyzing a pattern of how such an attack scenario may map to the evaluation values.

[0118] Further, a risk level is determined using the determination levels using a risk assessment array, which associates each combination of the determination levels with one of at least three risk levels. For example, the risk assessment array may be a risk assessment matrix associating each pair of the user entity ratio level and the population ratio level with one of three or more risk levels. The risk levels may be, for example, ‘high’, ‘medium’, and Tow’.

[0119] FIG. 7 illustrates a risk assessment matrix according to an embodiment of the present disclosure. In this example risk assessment matrix, a ‘significant’ user entity ratio level is associated with a ‘medium’ (‘M’) risk level for a ‘negligible’ population ratio level, with a Tow’ (‘L’) risk level for a ‘moderate’ population ratio level, and an ‘L’ risk level for a ‘high’ population ratio level. Further, a ‘moderate’ user entity ratio level is associated with an ‘M’ risk level for a ‘negligible’ population ratio level, with an ‘M’ risk level for a ‘moderate’ population ratio level, and with an ‘L’ risk level for a ‘high’ population ratio level. Further, a ‘rare’ user entity ratio level is associated with a ‘high’ (‘H’) risk level for a ‘negligible’ population ratio level, with an ‘M’ risk level for a ‘moderate’ population ratio level, and with an ‘M’ risk level for a ‘high’ population ratio level. Further, an ‘unlikely’ user entity ratio level is associated with an ‘H’ risk level for a ‘negligible’ population ratio level, for a ‘moderate’ population ratio level, and for a ‘high’ population ratio level.

[0120] However, as described above, the user entity ratio level may be determined from among more or less than four possible user entity ratios, and the population ratio level may be determined from among more or less than three possible population ratio levels. This may be achieved by applying a different set of statistical rules to the evaluation values, as detailed further above.

[0121] FIG. 8 illustrates an example of another risk assessment matrix according to another embodiment of the present disclosure. FIG. 9 illustrates an example of yet another risk assessment matrix according to yet another embodiment of the present disclosure.

[0122] In the risk assessment matrix as illustrated in FIG. 8, a risk level (‘H’, ‘M’, or ‘L’) is associated with a user entity ratio level that may be ‘significant’, ‘moderate’, or ‘rare’, and a population ratio level that may be Tow’ or ‘high’.

[0123] In the risk assessment matrix as illustrated in FIG. 9, a risk level may be one of ‘H’, ‘high medium’ (‘HM’), Tow medium’ (‘LM’), or ‘L’, and may be associated with a user entity ratio level and a population ratio level as in FIG. 7.

[0124] In the following, an example is given of a determination of the risk level using the risk assessment matrix as illustrated in FIG. 8, assuming a specific command type and the stored numbers of commands as illustrated in FIG. 5. It goes without saying that, in the determination of the risk levels, the stored numbers of commands for each time slot (not illustrated) are utilized for determination of the user entity frequency, which is utilized for the determination of the population ratio level. Further, the determination of the risk level may be performed for another command type in a corresponding manner.

[0125] FIG. 10 illustrates examples of the determination of risk levels for combinations of a specific command type, users, and data repository entities according to an embodiment of the present disclosure. In the example illustrated in FIG. 10, the determination of a few combinations of users and data repository entities are illustrated by arrows that connect the respective combination of the user and the data repository entity and the risk level of the assessment matrix. For example, for the specific command type, a risk level ‘L’ is determined for user ‘Mobilel’ and table (an example of a data repository entity) ‘Ticket’, arisk level ‘L’ is determined for user ‘Webl ’ and table ‘Ticket_event’, a risk level ‘M’ is determined for a user ‘Devops’ and table ‘Ticket_event’, and a risk level ‘H’ is determined for user ‘Devops’ and table ’Users’.

[0126] However, the determination of the risk level is not limited to the application of a risk assessment matrix, and, for a given command type, user, and data repository entity, the determination of the risk level may be based on the evaluation values and a decision tree.

[0127] FIG. 11 illustrates a decision tree for determining a risk level according to an embodiment of the present disclosure. In determination DI, it is determined whether the user entity frequency is medium / high (i.e. medium or high; not low) or low. If the user entity frequency is low, a determination D53 is performed. If the user entity frequency is medium / high, a determination D2 is performed. In determination D2, it is determined whether the command ratio is high or low / medium (i.e. low or medium; not high) or high. If the command ratio is high, a determination D51 is performed. If the command ratio of low / medium, a determination D3 is performed. In determination D3, it is determined whether the user ratio is medium / high (i.e. medium or high; not low) or low. If the user ratio is medium / high, a determination D41 is performed. If the user ratio is low, a determination D42 is performed. In determination D41, it is determined whether the entity ration is medium / high (i.e. medium or high; not low) or low. If the entity ratio is medium / high, the determination D51 is performed. If the entity ratio is low, a determination D52 is performed. In determination D42, it is determined whether the user entity is medium / high (i.e. medium or high; not low) or low. If the entity ratio is medium / high, the determination D52 is performed. If the entity ratio is low, the determination D53 is performed. In determination D51, it is determined whether the user entity ratio is significant, moderate, rare, or unlikely. If the user entity ratio is significant, the risk level is determined as ‘L’. If the user entity ratio is moderate, the risk level is determined as ‘L’. If the user entity ratio is rare, the risk level is determined as ‘M’. If the user entity ratio is unlikely, the risk level is determined as ‘H’. In determination D52, it is determined whether the user entity ratio is significant, moderate, rare, or unlikely. If the user entity ratio is significant, the risk level is determined as ‘L’. If the user entity ratio is moderate, the risk level is determined as ‘M’ . If the user entity ratio is rare, the risk level is determined as ‘M’ . If the user entity ratio is unlikely, the risk level is determined as ‘H’. In determination D53, it is determined whether the user entity ratio is significant, moderate, rare, or unlikely. If the user entity ratio is significant, the risk level is determined as ‘M’. If the user entity ratio is moderate, the risk level is determined as ‘M’. If the user entity ratio is rare, the risk level is determined as ‘H’. If the user entity ratio is unlikely, the risk level is determined as ‘H’.

[0128] Applying the decision tree as illustrated in Fig. 11 results in the same risk levels for the combination of a command type, a user, and a data repository entity / table as the determination of the determination levels and the use of the risk assessment matrix as illustrated in Fig. 7. That is, the decision tree reflects the same statistical rules applied to the evaluation values for determination of the determination levels (e.g. user entity ratio level and population ratio level) and the risk assessment matrix connecting said determination levels with respective risk levels.

[0129] Based on the determined risk level, a risk indication is output (e.g. step S32 in Fig. 2). The risk indication may be output for a specific combination of a user, a command type, and a data repository entity, or a plurality of such combinations, or every possible combination. That is, a risk indication may be output for each of a subset of such combinations.

[0130] The risk indication may be output to a (human) user via a display, for example, or may be output to another data processing apparatus for further processing, or may be output to be used by the same data processing apparatus that performed the risk level determination for further processing. The risk indication may correspond to a result of the risk determination. For example, the risk indication may indicate the determined risk.

[0131] Additionally or alternatively, a removal recommendation determination of whether a privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed or maintained, according to the determined risk level may be performed. In other words, it may be determined whether the privilege involved in the command (of a certain command type) initiated by the user to a data repository entity should be removed or maintained. The risk indication to be output may correspond to a result of the removal recommendation determination. In other words, in an embodiment of the present disclosure, a recommendation may be output, as detailed above, for example, to a (human user) via a display or other dedicated means, or to a data processing apparatus for further processing.

[0132] For example, it may be determined that the privilege should be removed when the determined risk level for respective combination of user, command type, and data repository entity is equal to or higher than a threshold risk value, and that the privilege should not be remove (i.e. maintained) when the determined risk level is below said threshold risk level.

[0133] In the example illustrated in Fig. 10, it may be determined that the respective privilege should be removed if the determined risk level is ‘H’ and should be maintained when the determined risk level is ‘L’ or ‘M’. Alternatively, it may be determined that the respective privilege should be removed if the determined risk level is ‘M’ or ‘H’ and should be maintained when the determined risk level is ‘L’. The threshold risk level may be individually configured or re-configured according to user (customer / operator) preferences.

[0134] Further, in an embodiment, the privilege, for which it has been determined in the removal recommendation determination that it should be removed, may be automatically removed. That is, a privilege corresponding to the respective command type, the respective user, and the respective data repository entity, may be removed or maintained according to a result of the removal recommendation determination.

[0135] With the approach of the embodiment of the present disclosure, the following scenarios may be addressed. Said scenarios relate to an illegitimate user initiating certain commands to a data repository that maps to a certain pattern of the evaluation values / determination levels. By the approach of the present disclosure, a relatively high risk level is associated with the illegitimate user, respective command and data repository entity, which may result in a recommendation that respective privilege should be removed.

[0136] In a first scenario, a certain user may try to attack / modify the data stored in the data repository entity or gain access to said data. In this case, the privilege should be removed. Said scenario might manifest itself in in a specific command by the specific user being initiated during a single or only a few time slots of the monitoring period. This results in a high user entity frequency and, accordingly, to the determination of a high risk level.

[0137] In a second scenario, a specific user may try to solve a problem occurring in the data repository entity, which results in a similar pattern as in the first scenario, namely a high user entity frequency. This causes a high user entity frequency to be determined, leading to a determination of a high risk level. Since, the privilege might not be required (e.g. due to said problem being solved), the privilege involved by the command initiated by the user could be removed.

[0138] In a third scenario, an illegitimate user may use the privilege of a legitimate user in order to perform an illegitimate action on a data repository. This behavior may result in a rate of the user specific command being relatively low in comparison to the legitimate user’s other commands, resulting in a relatively high risk level being determined for the user, respective command type and respective data repository entity. Accordingly, the privilege should be removed.

[0139] In a fourth scenario, a user initiates a command by accident, for a specific task, or for reasons of attack, which might result in the user action with a specific command over all data repository entities being low, the specific command ration of all users with respect to the specific data repository entity being low in comparison with other data repository entities, and the user entity ratio being low. According to the present disclosure, a relatively high risk level may be determined in such a situation, resulting in a recommendation that the respective privilege should be removed.

[0140] In a fifth, unsuspicious, scenario, the user ratio as well as the entity ration take a high portion of the entire population. However, in a case where the user entity ratio is low, a high risk level may be determined since the user activity may relate to an illegitimate data access or an attack.

[0141] SUMMARY

[0142] Summarizing the key points of the present disclosure are as follows:

[0143] The present disclosure provides a method for determining risk levels for combinations of command types of a command to a data repository, a user, and a data repository entity, allowing for a recommendation of whether a privilege involved by the command should be maintained or removed.

[0144] Further, the present disclosure may allow for enabling the principle of least privileges in an easy manner.

Claims

CLAIMS1. A computer-implemented method, comprising: monitoring commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities, each command corresponds to one of one or more command types, and each command involves one of one or more privileges; storing numbers of commands, each number of command being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot; performing risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, the risk level processing comprising: determining a risk level, from among at least three risk levels, using the stored numbers of commands; and outputting a risk indication based on the determined risk level.

2. The method according to claim 1 , wherein determining the risk level comprises: calculating a plurality evaluation values using the stored numbers of commands, determining two or more determination levels by applying a set of rules to the plurality of evaluation values, and determining the risk level according to a risk assessment array associating each combination of the two or more determination levels with one of the at least three risk levels.

3. The method according to claim 2, wherein the plurality of evaluation values is calculated using at least one of(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots,(ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots,(iii) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity,(iv) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity,(v) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots,(vi) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots, and(vii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots.

4. The method according to claim 1 , wherein determining the risk level comprises determining a user entity ratio, using:(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots; and determining the respective risk level using the user entity ratio.

5. The method according to claim 4, wherein determining the risk level further comprises: determining a user entity frequency, as an evaluation value of one or more evaluation values, using:(i) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, and(ii) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity; and determining the risk level further using the user entity frequency.

6. The method according to claim 4 or 5, wherein determining the risk level further comprises: determining a user ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the user ratio.

7. The method according to any one of claims 4 to 6, wherein determining the risk level further comprises: determining an entity ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the entity ratio.

8. The method according to any one of claims 4 to 7, wherein determining the risk level further comprises: determining a command ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the command ratio.

9. The method according to any one of claim 5 to 8, wherein determining the risk level further comprises: determining a user entity ratio level, from among a plurality of user entity ratio levels, by performing a classification using the user entity ratio; determining a population ratio level, from among a plurality of population ratio levels, by applying a set of rules to the one or more evaluation values; and determining the risk level according to a risk assessment matrix associating each pair consisting of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels with one of the at least three risk levels.

10. The method according to claim 9, wherein in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing user entity ratio level.

11. The method according to claim 10, wherein in the risk assessment matrix, for at least one population ratio level, the highest user entity ratio level is associated with a risk level lower than a risk level associated with the lowest user entity ratio level.

12. The method according to any one of claims 9 to 11, wherein in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing population ratio level.

13. The method according to claim 12, wherein in the risk assessment matrix, for at least one user entity ratio level, the highest population ratio level is associated with a risk level lower than a risk level associated with the lowest population ratio level.

14. The method according to any one of claims 1 to 13, wherein the risk level processing comprises: performing a removal recommendation determination of whether a privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed or maintained, according to the determined risk level, wherein the risk indication corresponds to a result of the removal recommendation determination.

15. The method according to claim 14, wherein the removal recommendation determination comprises: determining that the privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed, when the determined risk level is equal to or higher than a threshold risk level, and determining that said privilege should be maintained when the determined risk level is lower than the threshold risk level.

16. The method according to claim 14 or 15, wherein the risk level processing comprises: removing or maintaining the privilege corresponding to the respective command type, the respective user, and the respective data repository entity, according to a result of the removal recommendation determination.

17. The method according to any one of claims 1 to 16, wherein the risk level processing is performed for at least two combinations of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the at least two combinations differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

18. The method according to any one of claims 1 to 17, wherein the risk level processing is performed for each combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the combinations differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

19. A data processing apparatus, comprising processing circuitry configured to monitor commands to a data repository initiated by users during a monitoring period including a plurality of time slots, wherein the data repository includes one or more data repository entities,each command corresponds to one of one or more command types, and each command involves one of one or more privileges; and a memory configured to store numbers of commands, each number of commands being associated with the respective command type, the respective user, the respective data repository entity, and the respective time slot; wherein the processing circuitry is further configured to perform risk level processing for at least one combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, the risk level processing comprising: determining a risk level, from among at least three risk levels, using the stored numbers of commands, and outputting a risk indication based on the determined risk level.

20. The data processing apparatus according to claim 19, wherein determining the risk level comprises: calculating a plurality evaluation values using the stored numbers of commands, determining two or more determination levels by applying a set of rules to the plurality of evaluation values, and determining the risk level according to a risk assessment array associating each combination of the two or more determination levels with one of the at least three risk levels.

21. The data processing apparatus according to claim 20, wherein the plurality of evaluation values is calculated using at least one of(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots,(ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots,(iii) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity,(iv) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity,(v) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots,(vi) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots, and(vii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots.

22. The data processing apparatus according to claim 19, wherein determining the risk level comprises: determining a user entity ratio, using:(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots; and determining the respective risk level using the user entity ratio.

23. The data processing apparatus according to claim 22, wherein determining the risk level further comprises: determining a user entity frequency, as an evaluation value of one or more evaluation values, using:(i) a total number of time slots associated with a number of commands greater than zero, the respective command type, the respective user, and the respective data repository entity, and(ii) a total number of time slots associated with a number of commands greater than zero, the respective command type, any one of the users, and the respective data repository entity; and determining the risk level further using the user entity frequency.

24. The data processing apparatus according to 22 or 23, wherein determining the risk level further comprises: determining a user ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, the respective user, any of the data repository entities, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the user ratio.

25. The data processing apparatus according to any one of claims 22 to 24, wherein determining the risk level further comprises: determining an entity ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, any of the users, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with the respective command type, any of the users, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the entity ratio.

26. The data processing apparatus according to any one of claims 22 to 25, wherein determining the risk level further comprises: determining a command ratio, as an evaluation value of one or more evaluation values, using:(i) a total number of commands associated with the respective command type, the respective user, the respective data repository entity, and any of the plurality of time slots, and(ii) a total number of commands associated with any command type, the respective user, any of the data repository entities, and any of the plurality of time slots; and determining the risk level further using the command ratio.

27. The data processing apparatus according to any one of claims 23 to 26, wherein determining the risk level further comprises: determining a user entity ratio level, from among a plurality of user entity ratio levels, by performing a classification using the user entity ratio; determining a population ratio level, from among a plurality of population ratio levels, by applying a set of rules to the one or more evaluation values; and determining the risk level according to a risk assessment matrix associating each pair consisting of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels with one of the at least three risk levels.

28. The data processing apparatus according to claim 27, wherein in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing user entity ratio level.

29. The data processing apparatus according to claim 28, wherein in the risk assessment matrix, for at least one population ratio level, the highest user entity ratio level is associated with a risk level lower than a risk level associated with the lowest user entity ratio level.

30. The data processing apparatus according to any one of claims 27 to 29, wherein in the risk assessment matrix, the risk level associated with each pair of one of the plurality of user entity ratio levels and one of the plurality of population ratio levels does not decrease with decreasing population ratio level.

31. The data processing apparatus according to claim 30, wherein in the risk assessment matrix, for at least one user entity ratio level, the highest population ratio level is associated with a risk level lower than a risk level associated with the lowest population ratio level.

32. The data processing apparatus according to any one of claims 19 to 31, wherein the risk level processing comprises: performing a removal recommendation determination of whether a privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed or maintained, according to the determined risk level, wherein the risk indication corresponds to a result of the removal recommendation determination.

33. The data processing apparatus according to claim 32, wherein the removal recommendation determination comprises: determining that the privilege corresponding to the respective command type, the respective user, and the respective data repository entity should be removed, when the determined risk level is equal to or higher than a threshold risk level; and determining that said privilege should be maintained when the determined risk level is lower than the threshold risk level.

34. The data processing apparatus according to claim 32 or 33, wherein the risk level processing comprises: removing or maintaining the privilege corresponding to the respective command type, the respective user, and the respective data repository entity, according to a result of the removal recommendation determination.

35. The data processing apparatus according to any one of claims 19 to 34, wherein the risk level processing is performed for at least two combinations of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the at least two combinations differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

36. The data processing apparatus according to any one of claims 19 to 35, wherein the risk level processing is performed for each combination of one of the one or more command types, one of the users, and one of the one or more data repository entities, wherein the combinations differ from each other in at least one of the respective command types, the respective users, and the respective data repository entities.

37. A data processing apparatus configured to carry out the method of any one of claims 1 to 18.

38. A computer program product comprising program code for performing the method according to any one of the preceding claims 1 to 18 when executed on a computer or a processor.

39. A non-transitory computer-readable storage medium comprising instructions which, when executed by one or more computing devices, cause the one or more computing devices to carry out the method of any one of claims 1 to 18.

Images