WO2015133891A1

WO2015133891A1 - Method for detecting missing association in computing resources

Info

Publication number: WO2015133891A1
Application number: PCT/MY2015/050011
Authority: WO
Inventors: Swee Eng KHOR; Chin Teong TAN; Chee Kheen CHIN; Teck Huat GOH
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2014-03-06
Filing date: 2015-03-05
Publication date: 2015-09-11
Anticipated expiration: 2016-09-06
Also published as: MY173035A

Abstract

The present invention relates to a method for detecting nodes with resource missing association anomalies in computing resources. The method includes inputting resources data, nodes data and linkages data between the resources and the nodes of an organisation tree structure by a Policy Assignment Module (20). It also includes computing accumulators for each node which is not associated to a resource in the organisation tree structure by a Missing Association Detection component (33) before displaying a real time result report to end users with different accumulators values for each node which is not associated to a resource by a Decision Display Module (40). Additionally, the method also includes rectifying the identified anomaly by an Anomalies Rectification Module (50).

Description

METHOD FOR DETECTING MISSING ASSOCIATION IN COMPUTING

RESOURCES

FIELD OF INVENTION

The present invention relates to a method for detecting anomalies in computing resources. More particularly, the present invention relates to a method for detecting nodes with missing resource association anomalies in computing resources connected in an organisation tree structure. BACKGROUND OF THE INVENTION

Access right assignments of a policy in a large organisation are becoming more complicated these days. An individual may have multiple roles with multiple kind of access to a lot of software applications. The association or connection of an access right to an individual is usually carried out manually as it is a complicated task and prone to errors.

Furthermore, for an organisation treelike structure, wherein the organisation is represented by the tree structure; a division or a department of the organisation is represented by a sub-tree of the organisation treelike structure; an assignment is represented by a resource; and an individual in the organisation is represented by a node, there is a high possibility of a missed-association when there are too many nodes linked to a resource. This could lead to a problem whereby an individual who is supposed to have an access to a resource is not assigned to the access right or resource. In other words, when there are too many people in an organisation tree structure, it is highly likely that an individual is not correctly associated to a certain resource.

Previously, United States Patent Application Publication number 2013/0051248 A1 has disclosed a method for hierarchical anomaly localisation and prioritisation. The method disclosed comprises of obtaining reported status for a plurality of nodes of a hierarchical topology, the reported status for a particular node being at least one of normal, abnormal or indeterminate, and determining a subset of root cause abnormal nodes. The prior art also discloses an apparatus that comprises of a candidate selector to select a set of candidate root cause abnormal nodes from a set of abnormal nodes identified in the hierarchical topology and a root cause determiner to determine each respective candidate root cause abnormal node and respective subset of the set of abnormal nodes identified in the hierarchical topology. Although many researches have been done for detecting anomalies, little have been done on detecting anomalies in an organisation tree hierarchy structure with missing associations with a resource. There is a need to provide a method that can detect suspected nodes with missing resource association anomalies that addresses the above mentioned drawbacks.

SUMMARY OF INVENTION

The present invention relates to a method for detecting nodes with missing resource association anomalies in computing resources connected in an organisation tree structure. The method is characterised by the steps of inputting resources data, nodes data and linkages data between the resources and the nodes of an organisation tree structure by a Policy Assignment Module (20); computing accumulators for each node which is not associated to a resource in the organisation tree structure by a Missing Association Detection component (33); and rectifying the identified anomaly by an Anomalies Rectification Module (50).

Preferably, the step of computing accumulators for each node which is not associated to a resource in the organisation tree structure includes retrieving a resource from a list of resources; initialising the accumulator of each node without any association to the retrieved resource to zero if the resource has not been processed; traversing each node and checking whether the node is a leaf or a root node; obtaining a sub-tree if the traversed node is a root node; setting the level of the sub-tree for each sub-tree obtained; computing the percentage of nodes that are not associated to the resource; computing the percentage of nodes associated to the resource; adding the accumulator value of the node with a possible missing link in the sub-tree with the percentage of nodes associated to the resource computed if the percentage of nodes that are not associated to the resource is less than a dynamic threshold; and setting the level of the sub-tree to another level.

Preferably, if the traversed node is not a root node, the computation stops. Preferably, if the percentage of nodes that are not associated to the resource is more than the dynamic threshold there is no increment on the accumulator value of the node. Preferably, the percentage of nodes that are not associated to the resource is computed as number of nodes not associated to a resource in a sub-tree divided by number of nodes in the sub-tree.

Preferably, the percentage of nodes associated to the resource is computed as number of nodes associated to a resource in a sub-tree divided by number of nodes in the sub-tree.

Preferably, the dynamic threshold is computed as 1 divided by level of the corresponding sub-tree.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.

FIG. 1 illustrates an architecture diagram of system (1000) for detecting resources anomalies according to an embodiment of the present invention.

FIG. 2 illustrates a block diagram of an Authentication Resource Management Controller server (100) of FIG. 1.

FIG. 3 illustrates a flow chart of a method for detecting nodes with missing resources association anomalies according to an embodiment of the present invention. FIG. 4 illustrates a flow chart of missing association detection method according to the method shown in FIG. 3.

FIGS. 5 (a - i) illustrate an example of detecting nodes with missing resources association anomalies according to the method shown in FIG. 4. DESCRIPTION OF THE PREFERRED EMBODIMENT

A preferred embodiment of the present invention will be described herein below with reference to the accompanying drawings. In the following description, well known functions or constructions are not described in detail since they would obscure the description with unnecessary detail.

Reference is made initially to FIG. 1 which illustrates an architecture diagram of a system (1000) for detecting anomalies in computing resources according to an embodiment of the present invention. The anomalies detection system resides in an Authentication Resource Management Controller (ARMC) server (100), wherein the ARMC server (100) is connected to an ARMC front end webserver (110) and a database server (120). The ARMC front end webserver (110) is used to host the ARMC server (100) website, render webpages and deliver the webpages to end users. The database server (120) is used to store nodes data, resources data and organisation tree structures. The system for the anomalies detection is shown in detail in FIG. 2.

Reference is now made to FIG. 2 which illustrates a block diagram of the ARMC server (100) shown in FIG. 1. The ARMC server (100) comprises of a Policy Assignment Module (20); a Tree Cascading Anomalies Detection Module (30); a Decision Display Module (40); and an Anomalies Rectification Module (50). The Policy Assignment Module (20), which is connected to the Tree Cascading Anomalies Detection Module (30), is used to input an association of a user to resources in an organisation tree structure. The Tree Cascading Anomalies Detection Module (30) further comprises of a Hierarchical Balanced component (31) which is used to detect resources over-association anomaly in the organisation tree structure, a Missing Association Detection component (33) which is used to detect potential nodes with missing resource association in the organisation tree and to quantify the suspicious level; and a Minority Group Differentiation component (35) which is used to detect an intergroup anomaly within the organisation tree. The Tree Cascading Anomalies Detection Module (30) is connected to the Decision Display Module (40) which is a graphical user-interface (GUI) display to display any detected anomalies to users graphically. It is connected to the Anomalies Rectification Module (50) that is used to rectify the anomaly detected such as the missing association of resources for a node. Referring to FIG. 3, it illustrates a flow chart of a method for detecting nodes with missing resource association anomalies in computing resources connected in an organisation tree structure according to an embodiment of the present invention. Initially, the Policy Assignment Module (20) inputs resources data, nodes data and linkages data between the resources and the nodes as in step 200. The resources data refers to access rights, wherein the access rights are used to determine whether a computing resource is able to access a particular data. The nodes data refers to the computing resources, while the linkages data between these resources and nodes refers to the assignments from a tree hierarchy structure. Next, the Missing Association Detection component (30) of the Tree Cascading Anomalies Detection module (30) computes accumulator values for each node which is not associated to a resource in the organisation tree structure as in step 300 using missing association detection method. Accumulator values are suspicious values for the nodes which are not associated to a resource. The higher the value, the more likely the node has a missing resource association anomaly. Thereon, the Decision Display Module (40) displays the real time result report to end users with different accumulators' values for each node which is not associated to a resource as in step 400. Finally, the Anomalies Rectification Module (50) rectifies the identified anomaly as in step 500 by reassigning the resources to the nodes with high risk of missing resource association anomaly which are determined by their high accumulator values.

Referring now to FIG. 4, it illustrates a detailed flow chart of the missing association detection method as in step 300 of the method of FIG. 3. The basic concept of the method is if most of the nodes within a sub-tree are associated to a resource, there is a high tendency of the remaining left out nodes are miss associated. Subsequently, the nodes with no association to resources are reflected with accumulator values, wherein the accumulator value is an indicator of a missed- association. The higher the accumulator value is, the higher chance of the node being classified as a missed-association.

After the Policy Assignment Module (20) inputs resources data, nodes data and linkages data between the resources and the nodes as in step 200, the Missing Association Detection component (33) retrieves a resource from a list of resources of an organisation tree structure as in step 301. It processes each node in the organisation tree structure by iterating from the resource list. If the resource has yet to be processed as in decision 302, the accumulator of each node without any association to the retrieved resource is initialised to zero as in step 303. The Missing Association Detection component (33) traverses for each node as in step 304 and checks whether the node is a leaf node or a root node as in decision 305. When the traversed node is not a leaf node but a root node, the Missing Association Detection component (33) obtains a sub-tree as in step 306 to compute suspicious score of possible missing link for each traversed node. However, if the traversed node is not a root node but a leaf node, the computation stops.

For each sub-tree obtained, the Missing Association Detection component (33) sets the level of the sub-tree, n starting from level 2 as in step 307 and step 308. Thereon, it computes the percentage of nodes that are not associated to a resource, p, wherein p is computed as number of nodes not associated to a resource in a sub- tree divided by number of nodes in the sub-tree as in step 309 and the percentage of nodes associated to the resource, w, wherein w is computed as number of nodes associated to a resource in a sub-tree divided by number of nodes in the sub-tree or 1 - p as in step 310. If p is less than a dynamic threshold, wherein the dynamic threshold is computed as 1 divided by level of the corresponding sub-tree as in decision 311 , the accumulator value of the node with a possible missing link in the sub-tree is added with the value of w as in step 312 before setting the level of the sub-tree to another level as in step 313.

However, if p is more than the dynamic threshold as in decision 311 , there is no increment on the accumulator value of the node and the Missing Association Detection component (33) directly sets the level of the sub-tree to another level as in step 313. The process then repeats from step 309, which is the step of computing p until the sub-tree has reached the maximum level as in decision 314. Once the level of the sub-tree has reached the maximum level, the Missing Association Detection component (33) checks whether or not the traversed node is the last node in the resource as in decision 315. If the traversed node is not the last node in the resource, the process repeats from step 304, wherein the Missing Association Detection component (33) traverses to the next node. Once the Missing Association Detection component (33) has traversed until the last node in the resource, the process then repeats from step 301 , wherein the Missing Association Detection component (33) retrieves another resource from the list of resources of the organisation tree structure.

Once the sub-tree reaches level n as in step 314 and when the node traversed is the last node as in decision 315, the process repeats from step 301 , wherein the Missing Association Detection component (33) retrieves another resource from the resource list. However, if there are no more resources as in decision 302, the process proceeds to step 400 which is displaying a real time result report to end users with different accumulators' values for each node which is not associated to a resource.

Referring to FIGS. 5 (a - i), they illustrate an example of detecting nodes with missing resources association anomalies of an organisation tree structure according to the method shown in FIG. 4. FIG 5 (a) initially shows the organisation tree with missing resources association. Coloured nodes represent the nodes that are already associated to the coloured resource by an administrator, while the white nodes are the nodes with high tendency of missing resources association.

As the first node traversed in the organisation tree is a root node, it gets a sub-tree with different levels. From the organisation tree shown in FIG. 5 (a), the node is able to get 3 sub-trees starting from level 2 to a maximum of level 4 sub-tree. In each level of the sub-tree, the percentage of nodes that are not associated to the resource, p is computed. If the percentage is less than a dynamic threshold, which is 1 divided by level of the corresponding sub-tree, the nodes without the resource get an increment of accumulator value.

FIG. 5 (b) illustrates the first traversed node with the sub-tree at level 2. Initially, the percentage of nodes that are not associated to the resource, p is computed. As there is only 1 out of 3 nodes in the corresponding sub-tree that is not connected to the resource, the percentage of nodes that are not associated to the resource, p is 1/3. Next, the dynamic threshold of the corresponding sub-tree is computed. As the level of sub-tree for the corresponding sub-tree is 2, the dynamic threshold is 1/2. Thereon, the percentage of nodes associated to the resource of the sub-tree, w is computed. As there are 2 out of 3 nodes in the corresponding sub-tree associated to the resource, the percentage of nodes associated to the resource equals to 2/3 or 0.6667. The Missing Association Detection component (33) then checks whether the percentage of nodes that are not associated to the resource, p is less than the dynamic threshold. If the percentage of nodes that are not associated to the resource, p is less than the dynamic threshold of the corresponding sub-tree, the nodes that are not associated to the resource of the sub-tree get an increment of accumulator value. Since the percentage of nodes that are not associated to the resource, p which is 1/3 is less than the dynamic threshold of the corresponding subtree which is 1/2, the node that is not associated to the resource of the sub-tree gets an increment of accumulator value which is equal to the percentage of nodes associated to the resource, w which is 0.6667.

Thereon, the first traversed node loops to the next level of sub-tree which is level 3 as shown in FIG. 5 (c). Similarly, the Missing Association Detection component (33) computes the percentage of nodes that are not associated to the resource, p of the corresponding sub-tree and it is less than the dynamic threshold, wherein the percentage of nodes that are not associated to the resource, p is 2/7, and wherein the dynamic threshold of the sub-tree is 1/3. Since the percentage of nodes that are not associated to the resource, p is less than the dynamic threshold, the nodes that are not associated to the resource of the sub-tree get an increment of accumulator, w which is 5/7. Thus, the accumulator values of the nodes are 1.3809 and 0.7142 respectively.

Referring now to FIG. 5 (d), the traversed node loops to the next level of subtree which is to level 4. Similarly, the Missing Association Detection component (33) computes the percentage of nodes that are not associated to the resource, p of the corresponding sub-tree. Since the percentage of nodes that are not associated to the resource, p of the corresponding sub-tree is 3/10 and is more than the dynamic threshold which is 1/4, there is no increment on all accumulators. Once the traversed node has looped till the maximum number of level for the sub-tree, the Missing Association Detection component (33) traverses to the next node.

FIG. 5 (e) illustrates the second traversed node with its first sub-tree, wherein the second traversed node is able to get 2 levels of sub-tress. For the first level of the sub-tree which is at level 2, the Missing Association Detection component (33) computes the percentage of nodes that are not associated to the resource, p of the corresponding sub-tree which is 1/4. Since the percentage of nodes that are not associated to the resource, p is less than the dynamic threshold which is 1/2, the node that is not associated to the resource of the sub-tree gets an increment of 3/4 on its accumulator value making it a total of 1.4642.

Thereon, the Missing Association Detection component (33) loops to the second level of sub-tree of the second traversed node loop which is level 3 as shown in FIG. 5 (f). Since the percentage of nodes that are not associated to the resource, p is 2/7 which is less than the dynamic threshold which is 1/3, the node that is not associated to the resource of the sub-tree gets an increment of 5/7 on its accumulator value making it a total of 2.1785.

Next, the Missing Association Detection component (33) traverses to the third node as shown in FIG. 5 (g). The third traversed node only gets one sub-tree with a level of 2. There is no increment of accumulator value as there is no node that is not associated to the resource of the corresponding sub-tree.

Referring now to FIG.5 (h), it illustrates the fourth traversed node, wherein it only gets one sub-tree with a level of 2. Since the percentage of nodes that are not associated to the resource, p is 1/4 which is less than the dynamic threshold which is 1/2, the node that is not associated to the resource of the corresponding sub-tree gets an increment of 3/4 on its accumulator value making it a total of 1.4643. The iteration continues for all nodes except leaf nodes. The final accumulation values are shown in FIG. 5 (i), wherein a higher accumulator value shows a higher tendency of a miss-association of the nodes,

While embodiments of the invention have been illustrated and described, it is not intended that these embodiments illustrate and describe all possible forms of the invention. Rather, the words used in the specifications are words of description rather than limitation and various changes may be made without departing from the scope of the invention.

Claims

1. A method for detecting nodes with resource missing association anomalies in computing resources is characterised by the steps of:

a) inputting resources data, nodes data and linkages data between the resources and the nodes of an organisation tree structure by a Policy Assignment Module (20);

b) computing accumulators for each node which is not associated to a resource in the organisation tree structure by a Missing Association Detection component (33); and

c) rectifying the identified anomaly by an Anomalies Rectification Module (50).

2. The method as claimed in claim 1 , wherein the step of computing accumulators for each node which is not associated to a resource in the organisation tree structure includes:

a) retrieving a resource from a list of resources;

b) initialising the accumulator of each node without any association to the retrieved resource to zero if the resource has not been processed; c) traversing each node and checking whether the node is a leaf or a root node;

d) obtaining a sub-tree if the traversed node is a root node;

e) setting the level of the sub-tree for each sub-tree obtained; f) computing the percentage of nodes that are not associated to the resource;

g) computing the percentage of nodes associated to the resource;

h) adding the accumulator value of the node with a possible missing link in the sub-tree with the percentage of nodes associated to the resource computed if the percentage of nodes that are not associated to the resource is less than a dynamic threshold; and

i) setting the level of the sub-tree to another level.

3. The method as claimed in claim 2, wherein if the traversed node is not a root node, the computation stops. The method as claimed in claim 2, wherein if the percentage of nodes that are not associated to the resource is more than the dynamic threshold there is no increment on the accumulator value of the node.

The method as claimed in claim 2, wherein the percentage of nodes that are not associated to the resource is computed as number of nodes not associated to a resource in a sub-tree divided by number of nodes in the subtree.

The method as claimed in claim 2, wherein the percentage of nodes associated to the resource is computed as number of nodes associated to a resource in a sub-tree divided by number of nodes in the sub-tree.

The method as claimed in claim 2, wherein the dynamic threshold is computed as 1 divided by level of the corresponding sub-tree.