WO2015080564A1

WO2015080564A1 - A system and method for detecting anomalies in computing resources

Info

Publication number: WO2015080564A1
Application number: PCT/MY2014/000178
Authority: WO
Inventors: Chin Teong TAN; Swee Eng KHOR; Chee Kheen CHIN; Teck Huat GOH; Ka Wee TEE
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2013-11-27
Filing date: 2014-06-12
Publication date: 2015-06-04
Anticipated expiration: 2016-05-27
Also published as: MY166960A

Abstract

The present invention relates to a system (1000) and method for detecting anomalies in computing resources. The system (1000) comprising an Authentication Resource Management Controller (ARMC) server (100) connected to a front end web user (110) and a database server (120). The ARMC server (100) further comprises an Inputting Module (20); a Maximum Distance Tree Node Counter (30); a Scoring Module (40); an Anomalies Classifier Module (SO) and a Decision Display Module (60). The method comprises the steps of inputting hierarchical resources data, nodes data and linkages data; counting the longest distance between two nodes from the tree hierarchy structure; calculating score for each linkage using hierarchical balanced method; classifying a targeted node as anomaly or normal to a targeted resource according to score calculated; and displaying a real time result report to the end user.

Description

A SYSTEM AND METHOD FOR DETECTING ANOMALIES IN COMPUTING

RESOURCES

FIELD OF INVENTION

The present invention relates to a system and method for detecting anomalies in computing resources. More particularly, the present invention relates to a system and method for detecting over-association anomalies in computing resources connected in a tree hierarchy structure. BACKGROUND OF THE INVENTION

Access right assignments of a policy in a large organisation are becoming more complicated these days. An individual may have multiple roles with multiple kind of access to a lot of software applications. The association or connection of an access right to an individual is usually carried out manually as it is a complicated task and prone to errors.

For an organisation with a treelike structure, wherein the access right such as the approval of a budget or the accessibility to restricted information is represented by a resource and the individuals having positions that perform specific functions such as a chief executive officer or a senior manager in an organisation are represented by nodes, there is a high possibility of lower nodes that are assigned with a targeted resource being over-associated. This is true especially when most of the nodes that are linked to the target resource are meant for the higher level nodes. In other words, this is highly likely when a policy which is meant for a higher level authority, is wrongly assigned to a lower level authority. Over-association can be catastrophic for an organisation as it can lead to a leakage of private and confidential data, privacy infringement, operational chaos and many more. Although many researches have been done for detecting anomalies, little have been done on detecting the anomalies in an organisation tree hierarchy structure. There is a need to provide a method that can detect resources over- association anomalies or suspected nodes with wrong associations that addresses the above mentioned drawbacks. SUMMARY OF INVENTION

The present invention relates to a system and method for detecting anomalies in computing resources. The system comprising an Authentication Resource Management Controller (ARMC) server (100) connected to a front end web user (110) and a database server (120). The ARMC server (100) may comprise an Inputting Module (20) to input resources data, nodes data and linkages data of the tree hierarchy structure; a Maximum Distance Tree Node Counter (30) to count the longest distance between two nodes; a Scoring Module (40) to calculate score for each linkage data using hierarchical balanced method; and an Anomalies Classifier Module (50) to classify the linkage between a node and a targeted resource as anomaly or normal according to the score calculated by the Scoring Module (40). Additionally, the ARMC server (100) may comprise a Decision Display Module (60) to display a report to an end user. The method for detecting anomalies in computing resources is characterised by the steps of inputting hierarchical resources data, nodes data and linkages data; counting the longest distance between two nodes from the tree hierarchy structure; calculating score for each linkage using hierarchical balanced method; and classifying a targeted node as anomaly or normal to a targeted resource according to the score calculated.

Preferably, the step of calculating score for each linkage using hierarchical balanced method includes identifying all nodes that are connected to a resource; setting a node that is linked to the resource as a targeted node; separating the rest of the nodes to "Association" class and "Dissociation" class according to the level and relationship relative to the targeted node; calculating association score for each node that is relative to the targeted node; calculating dissociation score for each node that is relative to the targeted node; calculating self-score of the targeted node; and calculating a total score.

Preferably, the step of separating the rest of the nodes to "Association" class and "Dissociation" class according to the level and relationship relative to the targeted node includes analysing the tree hierarchy structure; grouping the nodes above the targeted node as "Dissociation" class; grouping the nodes below the targeted node or of the same level as the targeted node as "Association" class; clustering the "Association" class and "Dissociation" class to a spectrum of clusters according to their level relative to the targeted node; and segmenting all individual clusters into segments. Preferably, the targeted node is classified as anomaly relative to the targeted resource if a sum of the total score is less than zero.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.

FIG. 1 illustrates an architecture diagram of system (1000) for detecting resources anomalies according to an embodiment of the present invention.

FIG. 2 illustrates a block diagram of an Authentication Resource Management Controller server (100) of FIG. 1.

FIG. 3 illustrates a flow chart of a method for detecting resources anomalies according to an embodiment of the present invention.

FIG. 4 illustrates a flow chart of hierarchical balanced method according to the method shown in FIG. 3. FIG. 5 illustrates a flow chart of the substeps of separating the nodes to "Association" class and "Dissociation" class according to the method shown in FIG. 4.

FIG. 6 illustrates a flow chart of the substeps of calculating score for each node relative to targeted node according to the method shown in FIG. 4.

FIGS. 7 (a) - (d) illustrate examples for anomaly or normal classification process according to the method shown in FIG. 4. DESCRIPTION OF THE PREFFERED EMBODIMENT

A preferred embodiment of the present invention will be described herein below with reference to the accompanying drawings. In the following description, well known functions or constructions are not described in detail since they would obscure the description with unnecessary detail.

Reference is made initially to FIG. 1 which illustrates an architecture diagram of a system (1000) for detecting anomalies in computing resources according to an embodiment of the present invention. The anomalies detection system resides in an Authentication Resource Management Controller (ARMC) server (100), wherein the ARMC server (100) is connected to an ARMC front end webserver (110) and a database server (120). The ARMC front end webserver (110) is used to host the ARMC server (100) website, render webpages and deliver the webpages to end users. The database server (120) is used to store nodes data, resources data and tree hierarchy structure. The system for the anomalies detection is shown in detail in FIG. 2.

Reference is now made to FIG. 2 which illustrates a block diagram of the ARMC server (100) shown in FIG. 1. The ARMC server (100) comprises of an Inputting Module (20) which inputs resources data, nodes data and linkages data between the resources and nodes of a tree hierarchy structure; a Maximum Distance Tree Node Counter (30) which counts the longest distance between two nodes; a Scoring Module (40) which calculates the score for each linkage data using hierarchical balanced method; an Anomalies Classifier Module (SO) which classifies the linkage between a node and a targeted resource as anomaly or normal according to the score calculated by the Scoring Module (40); and a Decision Display Module (60) which displays the real time result report to end user for further rectification.

The Inputting Module (20) is connected to the Maximum Distance Tree Node Counter (30), wherein the Maximum Distance Tree Node Counter (30) is connected to the Scoring Module (40). The Scoring Module (40) is connected to the Anomalies Classifier Module (50) while the Anomalies Classifier Module (50) is connected to the Decision Display Module (60). Referring to FIG. 3, it illustrates a flow chart of a method for detecting resources anomalies according to an embodiment of the present invention. Initially, the Inputting Module (20) inputs resources data, nodes data and linkages data between the resources and the nodes. The resources data refers to access rights, wherein the access rights are used determine whether a computing resource is able to access a particular data. The nodes data refers to the computing resources, while the linkages data between these resources and nodes refers to the assignments from a tree hierarchy structure as in step 200. Next, the Maximum Distance Tree Node Counter (30) counts the longest distance between two nodes in the hierarchical tree as in step 300. Thereon, the Scoring Module (40) calculates the score for each linkage between resources and nodes using hierarchical balanced method to investigate the likeliness of anomalies as in step 400. The Anomalies Classifier Module (50) then classifies the linkage between the resources and nodes as anomaly if the score calculated by the Scoring Module (40) is less than a threshold value as in step 500, wherein the threshold value is preferably predetermined as zero. Finally, the Decision Display Module (60) displays the real time result report to end user for further rectification as in step 600.

Referring now to FIG. 4, it illustrates a detailed flow chart of the method of FIG. 3. After the Maximum Distance Tree Node Counter (30) determines the maximum distance in the hierarchical tree as in step 300, the Scoring Module (40) proceeds to a first resource as in step 402 before it identifies all the nodes that are connected to the first resource as in step 403. After identifying the nodes connected, the Scoring Module (40) proceeds to a first node that is linked to the first resource and sets it as a targeted node as in step 404 and step 405. Next, it separates the rest of the nodes to "Association" class and "Dissociation" class according to the level and relationship that is relative to the targeted node as in step 406. Thereon, the Scoring Module (40) calculates the score for each node that is relative to the targeted node as in step 407 according to a method as shown in FIG. 6.

From the calculated scores in step 407, the targeted node is classified as anomaly relative to the first resource if the sum of the total score is less than zero as in decision 501 and step 502. On the other hand, if the sum of total score is more than zero, the targeted node is classified as normal relative to the first resource as in decision 501 and step 503. The process continues by proceeding to the next node that is relative to the first resource if there are more nodes as in decision 504 and step 505. The next node is set as the current targeted node and the process repeats from step 405. However, if there are no more nodes linked to the first resource, the process continues by proceeding to the next resource if there are more resources as in decision 506 and step 507. After proceeding to the next resource, the process repeats from step 403, wherein the Scoring Module (40) identifies all the nodes that are connected to resource. However, if there are no more resources the process proceeds to step 600 which is displaying a real time result report to an end user. Referring to FIG. 5, it illustrates a flow chart of the substeps of separating the nodes to "Association" class and "Dissociation" class according to step 406 of FIG. 4. Initially, to perform the anomalies detection of targeted Node S to a resource, R1, the ARMC server (100) analyses the tree hierarchy structure. The nodes above the targeted Node S are grouped as "Dissociation," while the nodes below the targeted Node S or of the same level as the targeted Node S are grouped into "Association" class as in step 406a. The "Association" class shows a higher possibility of true association while the "Dissociation" class shows a higher possibility of over- association anomaly of targeted Node S and R1. As the influence of different nodes towards the targeted Node S varies relative to the relationship between the nodes and the targeted Node S, these nodes are placed into different clusters which are predefined with certain weightage as in step 406b. The two classes which are the "Association" class and "Dissociation" class are further clustered to a spectrum of clusters according to their level relative to the targeted node. The "Association" class is clustered to Own', 'siblings', 'same/lower T, 'lower 2 etc. till 'lower nth'. On the other hand, the "Dissociation" class is clustered to 'top', 'upper level 2', 'upper level 3', etc. till 'upper nth level'. Own' cluster in the tree hierarchy structure refers to the targeted node itself, 'sibling' cluster refers to the nodes that share the same parent node as the targeted node, and 'top' cluster refers to a root node.

Thereon, all individual clusters are further segmented into 'K segments, wherein ' represents the maximum distance between two nodes in the tree hierarchy structure as in step 406c. This step is to ensure that the nodes at the same level but with a different distance relative to the targeted node have different impact on the score.

Referring now to FIG. 6, it illustrates a flow chart of the substeps of calculating score for each node relative to a targeted node according to step 407 of FIG. 4. Initially, the Scoring Module (40) calculates association score as in step 407a using the following formula:

n

∑( max distance + 1— Li _x\ V cluster weightagei _x * — a a i,x max distance ) i=l

wherein x is a targeted node x, / is node-/^' which is associated to a similar resource as targeted node x, Z_,_,x is the distance between node-/^' and targeted node x, cluster weightage,* refers to a predefined weightage of the classified cluster of node- and max distance refers to the maximum distance between two nodes in the tree hierarchy structure.

Association Score is an indicator to reflect that the likeliness of a targeted node is not an anomaly because of the support from other nodes in the similar or lower level hierarchy. The score is influenced by the distance of the targeted node relative to the supporting nodes and level difference between targeted node and supporting nodes. The supporting nodes of an association refer to the nodes which contribute to the likelihood of a targeted node as not being an anomaly. These nodes are usually at the similar level or bottom level relative to the targeted node. In the example shown in step 407a, Node S, Node A and Node B are associated to a similar resource, wherein Node S is the targeted node and Node S is to be examined its likelihood of anomaly with the associated resource. Since Node A and Node B are both on the same level as Node S, both Node A and Node B are classified to the 'Same/Lower T cluster with a weightage of 1/3. Node A is 4 steps away from the targeted Node S while Node B is 6 steps away from the targeted Node S. Thus, L (A) = maximum distance + 1 - 4 = 3 and L (B) = maximum distance + 1 - 6 = 1 , wherein L (A) is the distance of Node A relative to the targeted Node S, L (B) is the distance of Node B relative to the targeted Node S and the maximum distance equals to 6. By following the association score formula, the association score for this example as shown in step 407a is as follows: Association score

f ( ^L(A) \ B) \ cluster weightage_ax x — + cluster weightage_bx x

^ Vmax distance/ max distance '

J

2

9

After calculating the association score, the Scoring Module (40) calculates the dissociation score as in step 407b using the formula:

n

Dissociation Score(x) =— (cluster weightage_{i x} *

J / _t \ ^{a a l,x} max distance/

i=l

wherein x is a targeted node x, /^' is node-/ which is associated to the similar resource as targeted node x, L,_,x is the distance between node-/^' and targeted node x, cluster weightage,_x refers to a predefined weightage of the classified cluster of node-/^' and max distance refers to the maximum distance between two nodes in the tree hierarchy structure. Dissociation score is an indicator to reflect that the likeliness of a targeted node is an anomaly because of the support from other nodes in the upper level hierarchy. The score is influenced by the distance of the targeted node relative to the supporting nodes and level difference between targeted node and supporting nodes. The supporting nodes of a dissociation refer to the nodes which contribute to the likelihood of a targeted node as being an anomaly. These nodes are usually at the upper level relative to the targeted node. The negative sign in front of the formula represents the dissociation impact to the total score, wherein the dissociation score is always subtracted to get a total score. In the example shown in step 407b, Node S, Node C and Node D are associated to a similar resource, wherein Node S is the targeted node and Node S is to be examined its likelihood of anomaly with the associated resource. Since Node C and Node D are both at the same upper level of Node S, both Node C and Node D are classified to the 'Upper Level 2' cluster with a weightage of 1/2. Node C is 2 steps away from the targeted Node S while Node D is 4 steps away from the targeted Node S. Thus, L (C) = distance Node C to targeted Node S = 2 and L (D) = distance Node D to targeted Node S = 4, wherein L (C) is the distance of node C relative to the targeted node S, and wherein L (D) is the distance of node D relative to the targeted node S. By following the dissociation score formula, the dissociation score for this example as shown in step 407b is as follows: Dissociation score

1

~~ ~ 2

Finally, the Scoring Module (40) calculates self-score as in step 407c. Self- score is an indicator that the targeted node is not an anomaly, wherein the targeted node also has some influence on itself. Self-score is influenced by the distance of the parent node. The self-score is associated to Own' cluster and it is calculated using the formula: cluster weightage

Self— score ~

distant from targeted node to parent assigned node wherein parent assigned node refers to the upper level node that is assigned to the same resource as targeted Node S, and wherein the upper level node refers to the node on top of a targeted node which shares a similar node. If there is no parents node assigned to the similar resource, the root node is assumed to be the parent assigned node. In the example shown in step 407c, the distance of parent node to targeted

Node S is 2 steps. By following the self-score formula, the self-score for this example as shown in step 407c is 1/2.

Referring to FIGS. 7 (a) to (d), they illustrate 4 examples of different scenarios in classifying a targeted node as anomaly or normal to a resource based on the total score calculated by the Scoring Module (40) as in decision 408 and step 409 or step 410 of FIG. 4. A first example in FIG. 7 (a) is the same as the previous example provided in step 407a to step 407c, wherein the association score is 2/9, the dissociation score is -1/2 and the self-score is 1/2. Hence, the total score is 2/9. Since the score is more than zero, the targeted Node S is classified as normal to the targeted resource. In a second example as shown in FIG. 7 (b), Node S and Node E are associated to a similar resource, wherein Node S is the targeted node and Node S is to be examined its likelihood of anomaly with the associated resource. Since Node E is the root node, there are only self-score and dissociation score. Since the cluster weightage for Own' cluster is 1 and the distance of Node E which is a parent node to the targeted Node S is 3 steps, the self-score is 1/3. Furthermore, Node E is classified to the Top' cluster with the weightage of 1. Node S is 3 steps away from Node E and the maximum distance in this tree hierarchy structure is 6, hence the dissociation score equals to -1(3/6) which is -1/2. From the two scores calculated which are 1/3 and -1/2 respectively, the total score is -1/6. As a conclusion, the targeted Node S is considered anomaly to the targeted resource.

In a third example as shown in FIG. 7 (c), Node S and Node F are associated to a similar resource, wherein Node S is the targeted node and Node S is to be examined its likelihood of anomaly with the associated resource. Similarly, there are only self-score and dissociation score since Node F is above targeted Node S. The self-score is 1 since Own' cluster is 1 and the distance between Node S and Node F is 1. Furthermore, Node F is classified to the 'Upper Level 3' cluster, and hence the cluster weightage is 1/3. Node S is only 1 step away from the resource and the maximum distance is 6. By following the dissociation score formula, the dissociation score of example 3 equals to -1/3(1/6) which is -1/18. As a result, the total score is 17/18 which is more than zero. Hence, the targeted Node S is concluded as normal to the targeted resource.

Finally in the last example as shown in FIG. 7 (d), Node S and Node G are associated to a similar resource, wherein Node S is the targeted node and Node S is to be examined its likelihood of anomaly with the associated resource. Similarly, there are only self-score and dissociation score. The self-score is 1 since the 'own' cluster has a cluster weightage of 1 and the distance between the targeted Node S and Node G is 1 step away. On the other hand, Node G is classified to the Top' cluster, and hence the cluster weightage is 1. Since Node S is 1 step away from Node G and the maximum distance in this tree hierarchy structure is 6, the dissociation score equals to -1(1/6) which is -1/6. From the two scores calculated which are 1 and -1/6 respectively, the total score is 5/6. As a conclusion, the targeted Node S is considered normal to the targeted resource.

While embodiments of the invention have been illustrated and described, it is not intended that these embodiments illustrate and describe all possible forms of the invention. Rather, the words used in the specifications are words of description rather than limitation and various changes may be made without departing from the scope of the invention.

Claims

1. A system (1000) for detecting anomalies in computing resources comprising an Authentication Resource Management Controller (ARMC) server (100) connected to a front end web user (110) and a database server (120), characterised in that the ARMC server (100) further comprises:

a. an Inputting Module (20) to input resources data, nodes data and linkages data of the tree hierarchy structure;

b. a Maximum Distance Tree Node Counter (30) to count the longest distance between two nodes;

c. a Scoring Module (40) to calculate score for each linkage data using hierarchical balanced method; and

d. an Anomalies Classifier Module (50) to classify the linkage between a node and a targeted resource as anomaly or normal according to the score calculated by the Scoring Module (40).

2. The system as claimed in claim 1 , wherein the ARMC server (100) comprises a Decision Display Module (60) to display a report to an end user.

3. A method for detecting anomalies in computing resources is characterised by the steps of:

a. inputting hierarchical resources data, nodes data and linkages data; b. counting the longest distance between two nodes from the tree hierarchy structure;

c. calculating score for each linkage using hierarchical balanced method; and

d. classifying a targeted node as anomaly or normal to a targeted resource according to the score calculated.

4. The method as claimed in claim 3, wherein the step of calculating score for each linkage using hierarchical balanced method includes:

a. identifying all nodes that are connected to a resource;

b. setting a node that is linked to the resource as a targeted node;

c. separating the rest of the nodes to "Association" class and "Dissociation" class according to the level and relationship relative to the targeted node; d. calculating association score for each node that is relative to the targeted node;

e. calculating dissociation score for each node that is relative to the targeted node;

f. calculating self-score of the targeted node; and

g. calculating a total score.

The method as claimed in claim 4, wherein the step of separating the rest of the nodes to "Association" class and "Dissociation" class according to the level and relationship relative to the targeted node includes:

a. analysing the tree hierarchy structure;

b. grouping the nodes above the targeted node as "Dissociation" class; c. grouping the nodes below the targeted node or of the same level as the targeted node as "Association" class;

d. clustering the "Association" class and "Dissociation" class to a spectrum of clusters according to their level relative to the targeted node; and

e. segmenting all individual clusters into segments.

The method as claimed in claim 3 and 4, wherein the targeted node is classified as anomaly relative to the targeted resource if a sum of the total score is less than zero.