Detecting abnormal user behavior via temporally regularized tensor factorization

1. A computer-implemented method for detecting abnormal user behavior via temporally regularized tensor factorization, at least a portion of the method being performed by a computer device comprising one or more processors, the method comprising:

establishing a first behavioral baseline corresponding to behavioral data of a plurality of users of cloud services;

establishing a second behavioral baseline corresponding to behavioral data for a particular user of the plurality of users;

determining an expected behavior by determining a first variation of behavior between the second behavioral baseline and the first behavioral baseline;

creating a tensor model for a succession of pre-determined time periods using the behavioral data of the plurality of users, the tensor model comprising multiple three-dimensional tensors;

determining a temporal dependence between the multiple three-dimensional tensors, the temporal dependence based on variation of behavior between the succession of pre-determined time periods from previously observed behavior;

determining a temporal smoothness between the multiple three-dimensional tensors, the temporal smoothness based on behavioral drift in behavior between the succession of pre-determined time periods;

predicting a future variation in behavior of the particular user based on a combination of the temporal dependence, the temporal smoothness, and the expected behavior, where the future variation in behavior indicates a potential security threat; and

performing a remedial security action on a client device associated with the particular user based on the predicted future variation in behavior.

2. The method of claim 1 , wherein performing the remedial security action further comprises:

sending a notification to the client device;

removing a malicious computer application from the client device;

quarantining the malicious computer application on the client device;

blocking the client device from a computer network;

blocking the particular user from accessing the client device;

automatically installing security software on the client device to prevent the malicious computer application from executing;

or a combination thereof.

3. The method of claim 1 , further comprising:

assigning a risk score to the particular user based on predicting the future variation in behavior.

4. The method of claim 3 , further comprising:

prioritizing a plurality of risk scores based on a level of the potential security threat, wherein performing the remedial security action further comprises performing the remedial security action on a pre-determined number of client devices associated with users satisfying a pre-determined number of the prioritized risk scores.

5. The method of claim 1 , wherein creating the tensor model further comprises:

creating a three-dimensional tensor comprising a first dimension equal to a number of users of the plurality of users, a second dimension equal to a second pre-determined time step within the first pre-determined time period, and a third dimension equal to a number of operations performed by each of the number of users of the plurality of users.

6. The method of claim 1 , wherein establishing the first behavioral baseline further comprises:

obtaining behavioral data over the first pre-determined time period.

7. The method of claim 1 , wherein establishing the second behavioral baseline further comprises:

obtaining behavioral data over the first pre-determined time period.

8. The method of claim 1 , wherein establishing the first behavioral baseline and the second behavioral baseline further comprises:

determining a pattern of regular behavior.

9. The method of claim 1 , wherein determining the expected behavior further comprises:

determining that a second variation of behavior of the particular user is within a predetermined acceptable range.

10. One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for detecting abnormal behavior via temporally regularized tensor factorization, the method comprising:

establishing a first behavioral baseline corresponding to behavioral data of a plurality of users of cloud services;

establishing a second behavioral baseline corresponding to behavioral data for a particular user of the plurality of users;

determining an expected behavior by determining a first variation of behavior between the second behavioral baseline and the first behavioral baseline;

creating a tensor model for a succession of pre-determined time periods using the behavioral data of the plurality of users, the tensor model comprising multiple three-dimensional tensors;

determining a temporal dependence between the multiple three-dimensional tensors, the temporal dependence based on variation of behavior between the succession of pre-determined time periods from previously observed behavior;

determining a temporal smoothness between the multiple three-dimensional tensors, the temporal smoothness based on behavioral drift in behavior between the succession of pre-determined time periods;

predicting a future variation in behavior of the particular user based on a combination of the temporal dependence, the temporal smoothness, and the expected behavior, where the future variation in behavior indicates a potential security threat; and

performing a remedial security action on a client device associated with the particular user based on the predicted future variation in behavior.

11. The one or more non-transitory computer-readable media of claim 10 , wherein performing the remedial security action further comprises:

sending a notification to the computer device;

removing a malicious computer application from the client device;

quarantining the malicious computer application on the client device;

blocking the client device from a computer network;

blocking the particular user from accessing the client device;

automatically installing security software on the client device to prevent the malicious computer application from executing;

or a combination thereof.

12. The one or more non-transitory computer-readable media of claim 10 , wherein the method further comprises:

assigning a risk score to the particular user based on predicting the future variation in behavior.

13. The one or more non-transitory computer-readable media of claim 12 , wherein the method further comprises:

prioritizing a plurality of risk scores based on a level of the potential security threat, wherein performing the remedial security action further comprises performing the remedial security action on a pre-determined number of client devices associated with users satisfying a pre-determined number of the prioritized risk scores.

14. The one or more non-transitory computer-readable media of claim 10 , wherein creating the tensor model further comprises:

creating a three-dimensional tensor comprising a first dimension equal to a number of users of the plurality of users, a second dimension equal to a second pre-determined time step within the first pre-determined time period, and a third dimension equal to a number of operations performed by each of the number of users of the plurality of users.

15. The one or more non-transitory computer-readable media of claim 10 , wherein establishing the first behavioral baseline further comprises:

obtaining behavioral data over the first pre-determined time period.

16. The one or more non-transitory computer-readable media of claim 10 , wherein establishing the first behavioral baseline and the second behavioral baseline further comprises:

obtaining behavioral data over the first pre-determined time period.

17. The one or more non-transitory computer-readable media of claim 10 , wherein establishing the first behavioral baseline and the second behavioral baseline further comprises:

determining a pattern of regular behavior.

18. The one or more non-transitory computer-readable media of claim 10 , wherein determining the expected behavior further comprises:

determining that a second variation of behavior of the particular user is within a predetermined acceptable range.

19. A computing device for detecting abnormal behavior via temporally regularized tensor factorization, comprising:

a processor;

a memory in electronic communication with the processor; and

instructions stored in the memory, the instructions being executable by the processor to:

establish a first behavioral baseline corresponding to behavioral data of a plurality of users of cloud services;

establish a second behavioral baseline corresponding to behavioral data for a particular user of the plurality of users;

determine an expected behavior by determining a first variation of behavior between the second behavioral baseline and the first behavioral baseline;

create a tensor model for a succession of pre-determined time periods using the behavioral data of the plurality of users, the tensor model comprising multiple three-dimensional tensors;

determine a temporal dependence between the multiple three-dimensional tensors, the temporal dependence based on variation of behavior between the succession of pre-determined time periods from previously observed behavior;

determine a temporal smoothness between the multiple three-dimensional tensors, the temporal smoothness based on behavioral drift in behavior between the succession of pre-determined time periods;

predict a future variation in behavior of the particular user based on a combination of the temporal dependence, the temporal smoothness, and the expected behavior, where the future variation in behavior indicates a potential security threat; and

perform a remedial security action on a client device associated with the particular user based on the predicted future variation in behavior.

20. The computing device of claim 19 , wherein the instructions are further executable by the processor to:

assign a risk score to the particular user based on predicting the future variation in behavior;

prioritize a plurality of risk scores based on a level of the potential security threat; and

perform the remedial security action on a pre-determined number of client devices associated with users satisfying a pre-determined number of the prioritized risk scores.