Abstract: Techniques are provided for distribution-based aggregation of scores across multiple events. One method comprises obtaining a plurality of individual scores associated with a plurality of events; obtaining an expected distribution for the plurality of individual scores; and generating an aggregate score for the plurality of individual scores based on a deviation of the plurality of individual scores from the obtained expected distribution for the plurality of individual scores. The aggregate score, for example, reflects how closely the individual scores follow the expected distribution. The aggregate score comprises, for example, an aggregate risk score that: (i) is compared across different vectors of an organization; (ii) is used to create a security policy and/or modify a security policy; and/or (iii) triggers an alert based on one or more predefined threshold criteria. The multiple aggregate risk scores can be visualized in one or more geographic regions and/or sub-networks of an organization.

Abstract: Techniques are provided for visualizing user access data and for configuring and enforcing location-based access policies.

Abstract: Methods, apparatus, and processor-readable storage media for machine learning risk assessment utilizing calendar data are provided herein. An example computer-implemented method includes processing historical calendar data attributed to users on a network; generating, based on the processed historical calendar data and historical user activity data associated with the network, a machine learning user activity model; processing input data, wherein the input data comprise additional user activity data associated with the network attributed to one of the users and additional calendar data temporally related to the additional user activity data; generating a risk assessment output for the user by applying the machine learning user activity model to the processed input data; and providing the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based on the risk assessment output.

Abstract: Techniques are provided for visualizing user access data and for configuring and enforcing location-based access policies.

Abstract: Methods, apparatus, and processor-readable storage media for machine learning risk assessment utilizing calendar data are provided herein. An example computer-implemented method includes processing historical calendar data attributed to users on a network; generating, based on the processed historical calendar data and historical user activity data associated with the network, a machine learning user activity model; processing input data, wherein the input data comprise additional user activity data associated with the network attributed to one of the users and additional calendar data temporally related to the additional user activity data; generating a risk assessment output for the user by applying the machine learning user activity model to the processed input data; and providing the risk assessment output to one or more risk management entities within the network for execution of one or more automated actions based on the risk assessment output.

Abstract: Techniques are provided for distribution-based aggregation of scores across multiple events. One method comprises obtaining a plurality of individual scores associated with a plurality of events; obtaining an expected distribution for the plurality of individual scores; and generating an aggregate score for the plurality of individual scores based on a deviation of the plurality of individual scores from the obtained expected distribution for the plurality of individual scores. The aggregate score, for example, reflects how closely the individual scores follow the expected distribution. The aggregate score comprises, for example, an aggregate risk score that: (i) is compared across different vectors of an organization; (ii) is used to create a security policy and/or modify a security policy; and/or (iii) triggers an alert based on one or more predefined threshold criteria. The multiple aggregate risk scores can be visualized in one or more geographic regions and/or sub-networks of an organization.