Microsoft Technology Licensing, LLC

Avichai Ben David

Idan Yehoshua Hen

Ilay Grossman

A system to detect an abnormal classic authorizations, such as in a classic authorization system of a resource access management system, and take action is described. The system determines an anomaly score in from a model applied to a classic assignment event. An indicator score is determined from the classic assignment event applied to domain-based rules. The security action is taken based on a combination of the anomaly score and the indicator score.

Abnormal classic authorization detection systems

A system to detect an abnormally permissive role definition, which can include an abnormally permissive custom role definition, and take action is described. The system receives a role definition for a security principal over a scope of resources in which the role definition includes a built-in role and a custom role. Permissions of the role definition and a creation event of the role definition are analyzed. A security score based on the role definition and creation event for the scope of resources is determined. An action is taken based on the security score and the creation event analysis.

Abnormally permissive role definition detection systems

According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to determine that an entity was granted an anomalous role assignment to a managed environment. The processor may also, based on the determination that the role assignment of the entity is anomalous, identify at least one indicator associated with the role assignment, determine an indicator value corresponding to the identified at least one indicator, and determine whether the indicator value exceeds a predefined threshold value. The processor may, based on a determination that the indicator value exceeds the predefined threshold value, output an alert indicating that the role assignment is suspicious.

Anomalous and suspicious role assignment determinations

A system to detect abnormal cross authorizations and take action is described. The system determines whether cross authorization event applied to a first trained anomaly detection model and activity post cross authorization event applied to a second trained anomaly detection model is suspicious. An indicator score is determined from rule-based security indications applied to the cross authorization. A security action is taken based on application of the indicator score applied to a threshold.

Growing community of inventors

Tel Aviv, Israel

Avichai Ben David