Malicious activity detection for cloud computing platforms

1 . A method comprising:

obtaining a first log comprising a record of a first control plane operation executed by a cloud application associated with an entity;

generating, based on the first log, a first property set comprising at least an identifier of the entity;

utilizing the identifier of the entity to obtain a plurality of second logs from a data store, wherein each of the second logs comprises a record of a respective second control plane operation executed in association with the entity prior to the first control plane operation;

generating a second property set based on the plurality of second logs;

determining, based on the first property set and the second property set, a malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the entity;

determining malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity; and

generating a security alert indicative of the first control plane operation potentially corresponding to malicious activity.

2 . The method of claim 1 , further comprising:

mitigating the first control plane operation based on said determining the malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity.

3 . The method of claim 1 , wherein the first control plane operation is a create compute resource operation.

4 . The method of claim 1 , wherein:

said determining the malicious activity score comprises:

determining the malicious activity score based on a comparison of a first property of the first property set and a second property of the second property set; and

said determining the malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity-comprises:

determining the malicious activity score is greater than an alert threshold.

5 . The method of claim 4 , further comprising:

obtaining a third log comprising a record of a third control plane operation executed in association with the entity in proximity to the first control plane operation;

determining the third log is indicative of malicious activity; and

responsive to determining the third log is indicative of malicious activity, decreasing the alert threshold.

6 . The method of claim 5 , wherein said obtaining the third log is in response to said determining the malicious activity score is greater than the alert threshold.

7 . The method of claim 1 , further comprising:

obtaining a third log comprising a record of a third control plane operation executed in association with the entity in proximity to the first control plane operation;

determining the third log is included in a list of impactful operations; and

responsive to determining the third log is included in the list of impactful operations, determining the first control plane operation potentially corresponds to malicious activity.

8 . The method of claim 7 , further comprising:

determining the malicious activity score is greater than a flag threshold; and

obtaining the third log in response to determining the malicious activity score is greater than the flag threshold.

9 . A system, comprising:

a processor circuit; and

a memory device that stores program code structured to cause the processor circuit to:

obtain a first log comprising a record of a first control plane operation executed by a cloud application associated with an entity;

generate, based on the first log, a first property set comprising at least an identifier of the entity;

utilize the identifier of the entity to obtain a plurality of second logs from a data store, wherein each of the second logs comprises a record of a respective second control plane operation executed in association with the entity prior to the first control plane operation;

generate a second property set based on the plurality of second logs;

determine, based on the first property set and the second property set, a malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the plurality of second logs;

determine, based on the determined malicious activity score indicating the first control plane operation is anomalous with respect to the plurality of second logs, the first control plane operation potentially corresponds to malicious activity; and

generate a security alert.

10 . The system of claim 9 , wherein the program code is further structured to cause the processor to:

mitigating the first control plane operation based on said determining the first control plane operation potentially corresponds to malicious activity.

11 . The system of claim 9 , wherein the first control plane operation is a create compute resource operation.

12 . The system of claim 9 , wherein to determine the malicious activity score, the program code is further structured to cause the processor to:

determine the malicious activity score based on a comparison of a first property of the first property set and a second property of the second property set; and

to determine the first control plane operation potentially corresponds to malicious activity, the program code is further structured to cause the processor to:

determine the malicious activity score is greater than an alert threshold.

13 . The system of claim 12 , wherein the program code is further structured to cause the processor to:

obtain a third log comprising a record of a third control plane operation executed in association with the entity in proximity to the first control plane operation;

determine the third log is indicative of malicious activity; and

responsive to the determination the third log is indicative of malicious activity, decrease the alert threshold.

14 . The system of claim 13 , wherein the third log is obtained in response to the determination the malicious activity score is greater than the alert threshold.

15 . The system of claim 9 , wherein the program code is further structured to cause the processor to:

obtain a third log comprising a record of a third control plane operation executed in association with the entity in proximity to the first control plane operation;

determine the third log is included in a list of impactful operations; and

responsive to the determination the third log is included in the list of impactful operations, determine the first control plane operation potentially corresponds to malicious activity.

16 . The system of claim 15 , wherein the program code is further structured to cause the processor to:

determine the malicious activity score is greater than a flag threshold; and

obtain the third log in response to the determination the malicious activity score is greater than the flag threshold.

17 . A computer-readable storage medium encoded with program instructions that, when executed by one or more processors, performs a method comprising:

obtaining a first log comprising a record of a first control plane operation executed by a cloud application associated with an entity;

generating, based on the first log, a first property set comprising at least an identifier of the entity;

utilizing the identifier of the entity to obtain a plurality of second logs from a data store, wherein each of the second logs comprises a record of a respective second control plane operation executed in association with the entity prior to the first control plane operation;

generating a second property set based on the plurality of second logs;

determining, based on the first property set and the second property set, a malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the entity;

determining the malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity; and

generating a security alert indicative of the first control plane operation potentially corresponding to malicious activity.

18 . The computer-readable storage medium of claim 17 , wherein the method further comprises:

mitigating the first control plane operation based on said determining the malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity.

19 . The computer-readable storage medium of claim 17 , wherein:

said determining the malicious activity score comprises:

determining the malicious activity score based on a comparison of a first property of the first property set and a second property of the second property set; and

said determining the malicious activity score is indicative of the first control plane operation being anomalous with respect to the entity comprises:

determining the malicious activity score is greater than an alert threshold.

20 . The computer-readable storage medium of claim 17 , wherein the first control plane operation is a create compute resource operation.