Techniques for defending cloud platforms against cyber-attacks
A method and system for protecting a cloud computing platform against cyber-attacks are provided. The method includes gathering cloud logs from a cloud computing platform; analyzing, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator; sequencing suspect indicators into attack sequences; scoring each of the attack sequences with an attack score, wherein each attack is scored using a scoring model; and alerting on each attack sequence having a score higher than a predefined threshold.
1. A method for protecting a cloud computing platform against cyber-attacks, comprising:
gathering cloud logs from a cloud computing platform;
analyzing, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
sequencing suspect indicators into attack sequences;
scoring each of the attack sequences with an attack score, wherein each attack is scored using a scoring model; and
alerting on each attack sequence having a score higher than a predefined threshold.
2. The method of claim 1 , further comprising:
performing a mitigation action to mitigate a cyber-attack represented by each attack sequence having a score higher than a predefined threshold.
3. The method of claim 1 , wherein processing the cloud logs further comprises:
normalizing the cloud logs.
4. The method of claim 1 , wherein each of the plurality of detectors is configured to analyze the cloud logs to detect a different type of anomaly.
5. The method of claim 1 , wherein analyzing the cloud logs to detect suspicious behavior further comprises:
matching the cloud logs to threat intelligence information.
6. The method of claim 1 , wherein analyzing the cloud logs to detect suspicious behavior further comprises:
detecting suspicious behavior using a set of preconfigured rules.
7. The method of claim 1 , wherein analyzing the cloud logs to detect suspicious behavior further comprises:
detecting suspicious behavior based on deviation from a normal behavior, wherein the normal behavior is generated based on a machine learning technique.
8. The method of claim 1 , wherein the suspicious behavior is of or against a cloud entity.
9. The method of claim 8 , wherein sequencing suspect indicators into attack sequences further comprises:
grouping suspect indicators related to the same suspicious activity into an activity record.
10. The method of claim 9 , wherein the activity record includes information on the performed suspicious behaviors, the time period, and a reference to a respective suspect indicator indicative on the suspicious behavior.
11. The method of claim 1 , wherein the scoring model is determined based on example attack sequences.
12. The method of claim 11 , wherein the historic example attack sequences include historic attack sequences classified as legitimate and simulated attack sequences.
13. The method of claim 11 , wherein the scoring model is based on at least one of: a risk score, a likelihood score, and a maliciousness score.
14. The method of claim 13 , wherein the risk score relates to a sensitivity of a cloud entity, the likelihood entity defines likelihood of a suspect indicator or the whole sequence to occur in the cloud environment, the maliciousness score determines if a sequence represents a set of actions likely to be performed by an attacker.
15. The method of claim 11 , wherein the scoring model is a supervised machine learning scoring model generated based on attack sequence examples.
16. The method of claim 11 , wherein the attack sequence examples include labeled historic attacks sequences, wherein the labels may be any one of: malicious and legitimate.
17. The method of claim 11 , wherein the attack sequence examples include simulated attacks, generated by an attack simulator.
18. A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for cloud computing platform against cyber-attacks, the process comprising:
gather cloud logs from a cloud computing platform;
analyze, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
sequence suspect indicators into attack sequences;
score each of the attack sequences with an attack score, wherein each attack is scored using a scoring model; and
alert on each attack sequence having a score higher than a predefined threshold.
19. A system for cloud computing platform against cyber-attacks, comprising:
a processing system; and
a memory, the memory containing instructions that, when executed by the processing system, configure the system to:
gather cloud logs from a cloud computing platform;
analyze, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
sequence suspect indicators into attack sequences;
score each of the attack sequences with an attack score, wherein each attack is scored using a scoring model; and
alert on each attack sequence having a score higher than a predefined threshold.
20. The system of claim 19 , wherein the system is further configured to:
perform a mitigation action to mitigate a cyber-attack represented by each attack sequence having a score higher than a predefined threshold.
21. The system of claim 19 , wherein the system is further configured to:
normalize the cloud logs.
22. The system of claim 19 , wherein each of the plurality of detectors is configured to analyze the cloud logs to detect a different type of anomaly.
23. The system of claim 19 , wherein the system is further configured to:
match the cloud logs to threat intelligence information.
24. The system of claim 19 , wherein the system is further configured to:
detect suspicious behavior using a set of preconfigured rules.
25. The system of claim 19 , wherein the system is further configured to:
detect suspicious behavior based on deviation from a normal behavior, wherein the normal behavior is generated based on a machine learning technique.
26. The system of claim 19 , wherein the suspicious behavior is of or against a cloud entity.
27. The system of claim 26 , wherein the system is further configured to:
group suspect indicators related to the same suspicious activity into an activity record.
28. The system of claim 26 , wherein the activity record includes information on the performed suspicious behaviors, the time period, and a reference to a respective suspect indicator indicative on the suspicious behavior.
29. The system of claim 26 , wherein the scoring model is determined based on example attack sequences.
30. The system of claim 29 , wherein the scoring model is based on at least one of: a risk score, a likelihood score, and a maliciousness score.
31. The system of claim 30 , wherein the risk score relates to a sensitivity of a cloud entity, the likelihood entity define likelihood of a suspect indicator or the whole sequence to occur in the cloud environment, the maliciousness score determines if a sequence represents a set of actions likely to be performed by an attacker.
32. The system of claim 31 , wherein the scoring model is a supervised machine learning scoring model generated based on attack sequence examples.
33. The system of claim 31 , wherein the attack sequence examples include labeled historic attacks sequences, wherein the labels may be any one of: malicious and legitimate.
34. The system of claim 31 , wherein the attack sequence examples include simulated attacks, generated by an attack simulator.