Cloud security system implementing service action categorization
A service action category based cloud security system and method implement cloud security by categorizing service actions of cloud service providers into a set of service action categories. The service action categorization is performed agnostic to the applications or functions provided by the cloud service providers and also agnostic to the cloud service providers. With the service actions of cloud service providers thus categorized, cloud security monitoring and threat detection can be performed based on service action categories. Thus, cloud security can be implemented without requiring knowledge of the applications supported by the cloud service providers and without knowing all of the individual service actions supported by the cloud service providers.
1. A method of implementing cloud security in an enterprise, the method comprising:
receiving, at a processor, cloud activity data associated with the enterprise;
storing the cloud activity data in an activity database;
accessing, using the processor, a service action category mapping database, the service action category mapping database containing mapping data for service actions to a first set of service action categories, wherein each of the first set of service action categories describes a permitted and intended function that is performed by each of a plurality of service actions in the service action category;
identifying, using the processor, an uncategorized service action associated with a first cloud service provider in the cloud activity data;
performing, using the processor, categorization of the uncategorized service action using at least one contextual categorization prediction method to map the uncategorized service action to a service action category in the first set of service action categories; and
storing the category mapping of the uncategorized service action in the service action category mapping database,
wherein the service action category mapping database and the activity database are accessed to evaluate cloud security risk of cloud activities based on the first set of service action categories and to detect cloud security threats using the first set of service action categories.
2. The method of claim 1 , further comprising:
applying security enforcement policy to cloud activities of the enterprise based on the first set of service action categories.
3. The method of claim 1 , wherein performing, using the processor, categorization of the uncategorized service action using at least one contextual categorization prediction method to map the uncategorized service action to a service action category in the first set of service action categories comprises:
performing categorization of the uncategorized service action by identifying a role of the user associated with the uncategorized service action.
4. The method of claim 3 , wherein performing categorization of the uncategorized service action by identifying a role of the user associated with the uncategorized service action comprises:
performing categorization of the uncategorized service action by identifying a role of the user within the enterprise and evaluating the cloud activity of the user around the time of the uncategorized service action.
5. The method of claim 3 , wherein performing categorization of the uncategorized service action by identifying a role of the user associated with the uncategorized service action comprises:
performing categorization of the uncategorized service action by identifying a job title or a job function of the user within the enterprise.
6. The method of claim 1 , wherein performing, using the processor, categorization of the uncategorized service action using at least one contextual categorization prediction method to map the uncategorized service action to a service action category in the first set of service action categories comprises:
performing categorization of the uncategorized service action by identifying an intent and sequence of a connection session containing the uncategorized service action.
7. The method of claim 6 , wherein performing categorization of the uncategorized service action by identifying an intent and sequence of a connection session containing the uncategorized service action comprises:
evaluating the sequence of service actions within the connection session including the uncategorized service action;
identifying service actions with previously mapped service action categories; and
generating a predicted service action category for the uncategorized service action based on the previously mapped service action categories for the service actions within the connection session.
8. The method of claim 6 , wherein performing categorization of the uncategorized service action by identifying an intent and sequence of a connection session containing the uncategorized service action comprises:
evaluating the sequence of service actions within the connection session including the uncategorized service action;
identifying a signature of service actions in the sequence of service actions; and
generating a predicted service action category for the uncategorized service action based on the signature of service actions.
9. A method of implementing cloud security in an enterprise, the method comprising:
receiving, at a processor, cloud activity data associated with the enterprise;
storing the cloud activity data in an activity database;
accessing, using the processor, a service action category mapping database, the service action category mapping database containing mapping data for service actions to a first set of service action categories, wherein each of the first set of service action categories describes a permitted and intended function that is performed by each of a plurality of service actions in the service action category;
identifying, using the processor, an uncategorized service action associated with a first cloud service provider in the cloud activity data;
performing, using the processor, categorization of the uncategorized service action using at least one contextual categorization prediction method to map the uncategorized service action to a service action category in the first set of service action categories, by at least:
transforming using the processor a name of the uncategorized service action into a core phrase;
dividing the core phrase into core words;
analyzing the core words using the contextual categorization prediction method to generate a plurality of predicted category labels for the uncategorized service action, each predicted category label being associated with a confidence estimate;
determining a weight to apply to each of the plurality of predicted category labels, the weight increasing or decreasing the confidence estimate for each of the plurality of predicted category labels; and
selecting the service action category to map to the uncategorized service action from the plurality of predicted category labels based on the confidence estimates; and
storing the category mapping of the uncategorized service action in the service action category mapping database,
wherein the service action category mapping database and the activity database are accessed to evaluate cloud security risk of cloud activities based on the first set of service action categories and to detect cloud security threats using the first set of service action categories.
10. The method of claim 9 , wherein determining a weight to apply to each of the plurality of predicted category labels, the weight increasing or decreasing the confidence estimate for each of the plurality of predicted category labels comprises:
determining the weight for each predicted category label using one or more weighing methods selected from subject matter expert assigned weights, training data based weights, and inverse confidence weights.
11. The method of claim 9 , wherein selecting the service action category to map to the uncategorized service action from the plurality of predicted category labels based on the confidence estimates comprises:
selecting the predicted category label with the highest confidence estimate as the service action category to map to the uncategorized service action.
12. A system for implementing cloud security for an enterprise, the system comprising:
a memory; and
a processor in communication with the memory, the processor being programmed to:
receive cloud activity data associated with the enterprise;
store the cloud activity data in an activity database;
access a service action category mapping database, the service action category mapping database containing mapping data for service actions to a first set of service action categories, wherein each of the first set of service action categories describes a permitted and intended function that is performed by each of a plurality of service actions in the service action category;
identify an uncategorized service action associated with a first cloud service provider in the cloud activity data;
perform categorization of the uncategorized service action using at least one contextual categorization prediction method to map the uncategorized service action to a service action category in the first set of service action categories;
store the category mapping of the uncategorized service action in the service action category mapping database,
wherein the service action category mapping database and the activity database are accessed to evaluate cloud security risk of cloud activities based on the first set of service action categories and to detect cloud security threats using the first set of service action categories.
13. The system recited in claim 12 , wherein the processor is further programmed to:
perform categorization of the uncategorized service action by identifying a role of the user associated with the uncategorized service action.
14. The system recited in claim 13 , wherein the processor is further programmed to:
perform categorization of the uncategorized service action by identifying a role of the user within the enterprise and evaluating the cloud activity of the user around the time of the uncategorized service action.
15. The system recited in claim 13 , wherein the processor is further programmed to:
perform categorization of the uncategorized service action by identifying a job title or a job function of the user within the enterprise.
16. The system recited in claim 12 , wherein the processor is further programmed to:
perform categorization of the uncategorized service action by identifying an intent and sequence of a connection session containing the uncategorized service action.
17. The system recited in claim 16 , wherein the processor is further programmed to:
evaluate the sequence of service actions within the connection session including the uncategorized service action;
identify service actions with previously mapped service action categories; and
generate a predicted service action category for the uncategorized service action based on the previously mapped service action categories for the service actions within the connection session.
18. The system recited in claim 16 , wherein the processor is further programmed to:
evaluate the sequence of service actions within the connection session including the uncategorized service action;
identify a signature of service actions in the sequence of service actions; and
generate a predicted service action category for the uncategorized service action based on the signature of service actions.