US Patent 11651313 Insider threat detection using access behavior analysis

A security threat candidate (STC) detector examines a set of activity log records representing access requests directed to data artifacts by various entities of an organization. In a first threat analysis, the STC detector determines that an activity log record indicates a use of an access path which is not present in a database of legitimate access paths for an entity. In a second threat analysis, the STC detector determines whether the behavior of the entity matches a stored suspect behavior pattern template. Results of the first and/or second analysis are transmitted to a selected security management component of the organization.