OAAM Post-Authentication Security Oracle Fusion Middleware Online Documentation Library

OAAM Security and Autolearning Policies 11-13

11.5.3.2.2 OAAM Predictive Analysis Flow Diagram

Figure 11–7 OAAM Predictive Analysis Policy Flow

11.5.3.2.3 OAAM Predictive Analysis Policy: Details of Rules

The table below shows the rule conditions and parameters in the OAAM Predictive Analysis Policy.

11.5.3.2.4 OAAM Predictive Analysis Policy: Trigger Combination

None Table 11–9 OAAM Predictive Analysis Policy Summary Summary Details Purpose Harnesses the predictive capabilities of Oracle Data Miner. These rules are only functional if Oracle Data Miner is configured. Scoring Engine Maximum Weight 100 Group Linking Linked Users Table 11–10 OAAM Predictive Analysis Policy Rules Details Rule Rule Condition and Parameters Results Predict if current session is fraudulent USER: Check Fraudulent User Request Classification Model = OAAM Fraud Request Model Required Classification = Fraud Minimum Value of Probability required = 0.70 Maximum Value of Probability required = 1.00 Default Value to return if error = FALSE Action = NONE Alert = OAAM Suspected Fraudulent request Score = 700 Predict if current session is anomalous USER: Check Anomalous User Request Anomaly Model = OAAM Anomalous Request Model Minimum Value of Probability required = 0.60 Maximum Value of Probability required = 1.00 Default Value to return if error = FALSE Action = NONE Alert = OAAM Anomalous Request Score = 600 11-14 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

11.5.3.3 Auto-learning Pattern-Based Policy: OAAM Does User Have Profile

This policy checks if pattern autolearning is enabled and if a user has past behavior recorded. Users with enough recorded behavior are evaluated against their own profile while users without enough recorded behavior are evaluated against the profiles of all other users.

11.5.3.3.1 OAAM Does User Have Profile Policy Summary

11.5.3.3.2 OAAM Does User Have Profile Flow Diagram

Figure 11–8 Autolearning Pattern-Based Policy: OAAM Does User Have Profile Flow

11.5.3.3.3 OAAM Does User Have Profile: Details of Rules

Table 11–11 Auto-learning Pattern-Based Policy: OAAM Does User Have Profile Summary Summary Details Purpose Checks if pattern autolearning is enabled and if a user has past behavior recorded. Users with enough recorded behavior are evaluated against their own profile while users without enough recorded behavior are evaluated against the profiles of all other users. Scoring Engine Maximum Weight 100 Group Linking All Users OAAM Security and Autolearning Policies 11-15

11.5.3.3.4 OAAM Does User Have Profile: Trigger Combination

11.5.3.4 Auto-learning Pattern-Based Policy: OAAM Users vs. Themselves

If a user has a sufficient amount of historical data captured, this policy is used to evaluate his current behavior against his own historical behavior. This policy uses pattern-based rules to evaluate risk.

11.5.3.4.1 OAAM Users vs. Themselves Policy Summary

11.5.3.4.2 OAAM Users vs. Themselves Flow Diagram

Table 11–12 Auto-learning Pattern-Based Policy Rules Details: OAAM Does User Have Profile Rule Rule Condition and Parameters Results Does user have a profile System - Check Boolean Property Property = vcrypt.tracker.autolearning.enabled Value = True Default Return Value = True System - Check Boolean Property Property = vcrypt.tracker.autolearning.use.auth.status.for.analysis Value = True Default Return Value = False User - Check Login Count Check only current user = True Authentication Status = Success In seconds = 0 With Login more than = 7 If Error return = False Consider current request or not = True Action = None Alert = None Score = 0 Table 11–13 Auto-learning Pattern-Based Policy: OAAM Does User Have Profile Trigger Combination Description Combination Detail Result If a user has enough recorded behavior in his profile he is evaluated by this policy. Does User have profile = TRUE Policy = OAAM users vs. themselves Alert = NONE If a user does not have enough recorded behavior in his profile he is evaluated by this policy. Does User have profile = ANY Policy = OAAM users vs. all users Alert = NONE Table 11–14 Auto-learning Pattern-Based Policy: OAAM Users vs. Themselves Summary Summary Details Purpose Used to evaluate a users current behavior against his own historical behavior. This policy uses pattern-based rules to evaluate risk. Scoring Engine Maximum Weight 100 Group Linking Linked Users It is a nested policy 11-16 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager Figure 11–9 Auto-learning Pattern-Based Policy: OAAM Users vs. Themselves Flow

11.5.3.4.3 OAAM Users vs. Themselves: Details of Rules