Detecting a malicious cloud tenant using spatialized activity data
Methods and systems for identifying malicious tenants using machine learning (ML) models and spatialized activity data within a cloud platform. A method includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, training an ML model based on the spatial data, and deploying the trained ML model in the cloud platform to detect tenants engaged in malicious activities. A method also includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, inputting the spatial data into a trained ML model, and initiating a remedial action against the tenant based on an output indicating that activity data for the tenant has a threshold probability of being malicious.
1 . A method implemented in a computer system that includes a processor system, for deploying a machine learning (ML) model to detect malicious tenants based on spatialized activity data, comprising:
accessing sequential activity data for a tenant within a cloud platform, the sequential activity data comprising:
a first set of time-sequential data points corresponding to a first type of activity within the tenant; and
a second set of time-sequential data points corresponding to a second type of activity within the tenant;
converting the sequential activity data into spatial data, including;
generating a first multi-dimensional representation of the first set of time-sequential data points, wherein the first multi-dimensional representation expresses the first set of time-sequential data points within at least a first dimension representing a first timescale and a second dimension representing a second timescale; and
generating a second multi-dimensional representation of the second set of time-sequential data points, wherein the second multi-dimensional representation expresses the second set of time-sequential data points within at least the first dimension and the second dimension;
generating a trained ML model based on using the spatial data as a training input for an ML model; and
deploying the trained ML model within the cloud platform for detecting tenants associated with malicious activity.
2 . The method of claim 1 , wherein the first timescale is hours and the second timescale is days.
3 . The method of claim 1 , wherein the first type of activity and the second type of activity are each a type of activity selected from a group consisting of user creation, user deletion, service principal creation, service principal deletion, group creation, group deletion, and group modification.
4 . The method of claim 1 , wherein the first multi-dimensional representation of the first set of time-sequential data points is an image comprising a plurality of pixels.
5 . The method of claim 4 , wherein a value of each pixel in the plurality of pixels represents an aggregate number of occurrences of the first type of activity over a period of time corresponding to an intersection of the first dimension and the second dimension at the pixel.
6 . The method of claim 5 , wherein the value of each pixel represents the aggregate number of occurrences of the first type of activity over the period of time as a scaled value between zero and 255.
7 . The method of claim 5 , wherein each period of time is one hour.
8 . The method of claim 5 , wherein generating the trained ML model comprises generating a trained convolutional neural network (CNN) model.
9 . The method of claim 8 , wherein using the spatial data as the training input for the ML model comprises using the image as the training input for the ML model.
10 . The method of claim 8 , wherein:
the image is a first image comprising a first plurality of pixels;
converting the sequential activity data into spatial data also includes generating a second multi-dimensional representation of a second set of time-sequential data points corresponding to a second type of activity within the tenant, wherein the second multi-dimensional representation of the second set of time-sequential data points is a second image comprising a second plurality of pixels; and
using the spatial data as the training input for the ML model comprises using the first image and the second image as the training input for the ML model, including using the first image as a first image channel and using the second image as a second image channel.
11 . A method implemented in a computer system that includes a processor system, for detecting malicious tenants based on spatialized activity data, comprising:
accessing sequential activity data for a tenant within a cloud platform, the sequential activity data comprising:
a first set of time-sequential data points corresponding to a first type of activity within the tenant; and
a second set of time-sequential data points corresponding to a second type of activity within the tenant;
converting the sequential activity data into spatial data, including;
generating a first multi-dimensional representation of the first set of time-sequential data points, wherein the first multi-dimensional representation expresses the first set of time-sequential data points within at least a first dimension representing a first timescale and a second dimension representing a second timescale; and
generating a second multi-dimensional representation of the second set of time-sequential data points, wherein the second multi-dimensional representation expresses the second set of time-sequential data points within at least the first dimension and the second dimension;
inputting the spatial data to a trained machine learning (ML) model; and
initiating a remedial action against the tenant based on the trained ML model outputting an indication that activity data for the tenant has a threshold probability of being malicious.
12 . The method of claim 11 , wherein the first timescale is hours and the second timescale is days.
13 . The method of claim 11 , wherein the remedial action is an action selected from a group consisting of disabling the tenant, deleting the tenant, initiating a message to a contact associated with the tenant, and blocking network activity by a service within the tenant.
14 . The method of claim 11 , wherein the trained ML model is a trained convolutional neural network (CNN) model.
15 . The method of claim 11 , wherein the first multi-dimensional representation of the first set of time-sequential data points is an image comprising a plurality of pixels.
16 . The method of claim 15 , wherein a value of each pixel in the plurality of pixels represents an aggregate number of occurrences of the first type of activity over a period of time corresponding to an intersection of the first dimension and the second dimension at the pixel.
17 . The method of claim 16 , wherein the value of each pixel represents the aggregate number of occurrences of the first type of activity over the period of time as a scaled value between a minimum pixel value and a maximum pixel value.
18 . A computer system comprising:
a processor system; and
a computer storage medium that stores computer-executable instructions that are executable by the processor system to at least:
access sequential activity data for a tenant within a cloud platform, the sequential activity data comprising:
a first set of time-sequential data points corresponding to a first type of activity within the tenant; and
a second set of time-sequential data points corresponding to a second type of activity within the tenant;
convert the sequential activity data into spatial data, including:
generating a first multi-dimensional representation of the first set of time-sequential data points, wherein the first multi-dimensional representation expresses the first set of time-sequential data points within at least a first dimension representing a first timescale and a second dimension representing a second timescale; and
generating a second multi-dimensional representation of the second set of time-sequential data points, wherein the second multi-dimensional representation expresses the second set of time-sequential data points within at least the first dimension and the second dimension;
input the spatial data to a trained machine learning (ML) model; and
initiate a remedial action against the tenant based on the trained ML model outputting an indication that activity data for the tenant has a threshold probability of being malicious.
19 . The computer system of claim 18 , wherein the first timescale is hours and the second timescale is days.
20 . The computer system of claim 18 , wherein the first multi-dimensional representation of the first set of time-sequential data points is an image comprising a plurality of pixels.