Approaches to ascertaining behavioral deviations based on an analysis of multiple digital activities performed on the same service or across different services to detect threats
Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.
1 . A method performed by a threat detection platform for surfacing indications of risk discovered through analysis of digital activities performed with multiple accounts associated with an individual across multiple Software-as-a-Service (SaaS) services, the method comprising:
for each of the multiple SaaS services,
acquiring, via a corresponding one of multiple application programming interfaces (APIs), data relating to digital activities performed with a corresponding one of the multiple accounts; and
canonicalizing the data into a standardized format such that:
(i) each of the digital activities is represented by a separate data structure, and
(ii) a series of data structures, having the same form and arranged in temporal order, is created for each of the multiple SaaS services;
applying a machine learnt model to the multiple series of data structures created for the multiple SaaS services,
wherein the machine learnt model is trained to understand what constitutes normal behavior of the individual with respect to the multiple SaaS services;
identifying
(i) a first digital activity for which a first score produced by the machine learnt model indicates a variation from the normal behavior of the individual with respect to a first one of the multiple accounts on a first one of the multiple SaaS services, and
(ii) a second digital activity for which a second score produced by the machine learnt model indicates a variation from the normal behavior of the individual with respect to a second one of the multiple accounts on a second one of the multiple SaaS services;
establishing a likelihood of the first account and/or the second account being compromised by—
comparing the first score against a first threshold to establish whether the first digital activity differs from the normal behavior of the first account on the first SaaS service by at least a certain amount,
comparing the second score against a second threshold to establish whether the second digital activity differs from the normal behavior of the second account on the second SaaS service by at least a certain amount, and
comparing a sum of the first and second scores against a third threshold;
determining that a given one of the first and second accounts is compromised in response to a determination that (i) the first score exceeds the first threshold, (ii) the second score exceeds the second threshold, or (iii) the sum of the first and second scores exceeds the third threshold; and
performing a remediation action in response to said determining.
2 . The method of claim 1 ,
wherein the first score that is indicative of a degree to which the first digital activity varies from the normal behavior of the first account on the first SaaS service, and
wherein the second score that is indicative of a degree to which the second digital activity varies from the normal behavior of the second account on the second SaaS service.
3 . The method of claim 2 , wherein said establishing is adaptive such that scores indicative of higher degrees of variance from normal behavior are weighted more heavily.
4 . The method of claim 1 , wherein the machine learnt model is a neural network with weights that are tuned as the neural network learns from an analysis of past digital activities performed with the multiple accounts on the multiple SaaS services.
5 . The method of claim 1 ,
wherein the data relating to the digital activities performed with the multiple accounts is acquired, via the multiple APIs, in near real time, and
wherein said canonicalizing and said applying are performed in response to said acquiring, such that unusual digital activities are identified in near real time.
6 . The method of claim 1 ,
wherein the data is acquired from the multiple SaaS services in real time as the digital activities are performed with the multiple accounts, and
wherein said canonicalizing, said applying, said identifying, and said establishing are performed in response to said acquiring, such that a threat posed by compromise of the multiple accounts is monitored in near real time.
7 . The method of claim 1 , further comprising:
in response to a determination that the given account is compromised,
causing display of a notification that specifies the remediation action was performed to address a threat posed by the given account being compromised.
8 . A non-transitory medium with instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:
for each of multiple Software-as-a-Service (SaaS) services,
acquiring, via a corresponding one of multiple application programming interfaces (APIs), data relating to digital activities performed with a corresponding one of multiple accounts that are associated with an individual; and
canonicalizing the data into a standardized format such that:
(i) each of the digital activities is represented by a separate data structure, and
(ii) a series of data structures, having the same form and arranged in temporal order, is created for each of the multiple SaaS services;
applying a machine learnt model to the multiple series of data structures created for the multiple SaaS services,
wherein the machine learnt model is trained to understand what constitutes normal behavior of the individual with respect to the multiple SaaS services;
identifying
(i) a first digital activity for which a first score produced by the machine learnt model indicates a variation from the normal behavior of the individual with respect to a first one of the multiple accounts on a first one of the multiple SaaS services, and
(ii) a second digital activity for which a second score produced by the machine learnt model indicates a variation from the normal behavior of the individual with respect to a second one of the multiple accounts on a second one of the multiple SaaS services;
establishing a likelihood of the first account and/or the second account being compromised by—
comparing the first score against a first threshold to establish whether the first digital activity differs from the normal behavior of the first account on the first SaaS service by at least a certain amount,
comparing the second score against a second threshold to establish whether the second digital activity differs from the normal behavior of the second account on the second SaaS service by at least a certain amount, and
comparing a sum of the first and second scores against a third threshold;
determining that a given one of the first and second accounts is compromised in response to a determination that (i) the first score exceeds the first threshold, (ii) the second score exceeds the second threshold, or (iii) the sum of the first and second scores exceeds the third threshold; and
performing a remediation action in response to said determining.