Cloud activity threat detection for sparse and limited user behavior data
A cloud security system and method implements cloud activity threat detection using analysis of cloud usage user behavior. In particular, the cloud security system and method implements threat detection for users, cloud service providers, or tenants (enterprises) of the cloud security system who are new or unknown to the cloud security system and therefore lacking sufficient cloud activity data to generate an accurate behavior model for effective threat detection. In accordance with embodiments of the present invention, the cloud security system and method performs user behavior analysis to generate generalized user behavior models for user groups, where each user group includes users with similar cloud usage behavior. The user behavior models of the user groups are assigned to users with sparse cloud activity data. In this manner, the cloud security system and method of the present invention ensures effective threat detection by using accurate and reliable user behavior models.
1. A method of detecting anomalies in usage activities at one or more cloud-based service providers associated with users of an enterprise, the method comprising:
receiving, using a hardware processor, cloud usage activity data from activity logs of users accessing the one or more cloud-based service providers on behalf of the enterprise;
aggregating, using the hardware processor, the cloud usage activity data of the users over predetermined time intervals;
analyzing, using the hardware processor, the aggregated cloud usage activity data to generate a user behavior model for each user comprising one or more coefficients describing the user's cloud usage behavior;
analyzing, using the hardware processor, the user behavior models of the users to form user groups with similar user behavior;
generating, using the hardware processor, a generalized user behavior model for each user group, the generalized user behavior model comprising one or more coefficients describing the user group's cloud usage behavior;
for a user having sparse cloud usage activity data, assigning, using the hardware processor, the user to a user group and assigning, using the hardware processor, the generalized user behavior model of the user group as the user behavior model for the user;
generating, using the hardware processor, a threat detection threshold for each user using the coefficients of the user behavior model of the user and prior cloud usage data of the user belonging to a prior time period;
receiving, using the hardware processor, an event stream of cloud usage activity data of the users for a current time period;
detecting, using the hardware processor, anomalies in the cloud usage activities data of each user in the event stream using the threat detection threshold of the respective user, the anomalies indicating potential security risk associated with usage activities at the cloud-based service providers; and
performing an action based on the detected anomalies.
2. The method of claim 1 , further comprising:
storing, using the hardware processor, the cloud usage activity data and the aggregated cloud usage activity data in a database, the cloud usage activity data being stored as a time series of data for each user,
wherein the prior cloud usage data is provided from the database.
3. The method of claim 2 , wherein storing, using the hardware processor, the cloud usage activity data and the aggregated cloud usage activity data in a database comprises:
storing a set of cloud activity attributes associated with each service action at a cloud-based service provider, the set of cloud activity attributes comprising a number of bytes of data in the service action, a number of times the cloud-based service provider has been visited, or a number of reports being accessed.
4. The method of claim 1 , further comprising:
storing, using the hardware processor, the coefficients describing the user behavior models of the users in a database.
5. The method of claim 1 , wherein performing an action based on the detected anomalies comprises ranking the detected anomalies based on risk levels.
6. The method of claim 1 , wherein performing an action based on the detected anomalies comprises filtering the detected anomalies to remove anomalies having a low risk rating.
7. The method of claim 1 , wherein performing an action based on the detected anomalies comprises generating a report of the detected anomalies.
8. The method of claim 1 , wherein aggregating, using the hardware processor, the cloud usage activity data of the users over predetermined time intervals further comprises:
classifying, using the hardware processor, the aggregated cloud usage activity data into a first category of office-hour activity data and a second category of non-office-hour activity data.
9. The method of claim 1 , wherein analyzing, using the hardware processor, the user behavior models of the users to form user groups with similar user behavior further comprises:
identifying users with similar coefficient values in the user behavior models; and
grouping users with similar coefficient values in the user behavior models into a user group.
10. The method of claim 1 , wherein for a user having sparse cloud usage activity data, assigning, using the hardware processor, the user to a user group comprises:
identifying a user group having similar cloud activity attribute values as the user, the cloud activity attribute values relating to cloud usage activity data being measured; and
assigning the user to a user group with similar cloud activity attribute values.
11. The method of claim 10 , wherein identifying a user group having similar cloud activity attribute values as the user comprises:
identifying a user group having similar cloud activity attribute values as the user, the cloud activity attributes comprising a number of bytes of data in a service action, a number of times the one of the one or more cloud-based service providers has been visited, or a number of reports being accessed.
12. The method of claim 10 , wherein the steps of analyzing the aggregated cloud usage activity data to generate a user behavior model for each user to assigning the user to a user group and assigning the generalized user behavior model of the user group as the user behavior model for the user are repeated at a periodic interval to update the coefficients of the user behavior models of each user.
13. The method of claim 1 , wherein generating, using the hardware processor, the threat detection threshold for each user using the coefficients of the user behavior model of the user and prior cloud usage data of the user belonging to a prior time period comprises:
generating the threat detection threshold as a parameter level to indicate normal or abnormal cloud usage behavior.
14. The method of claim 1 , wherein generating, using the hardware processor, the threat detection threshold for each user using the coefficients of the user behavior model of the user and prior cloud usage data of the user belonging to a prior time period comprises:
generating the threat detection threshold as a criterion to indicate normal or abnormal cloud usage behavior.