Cloud activity threat detection for sparse and limited user behavior data
View Patent ↗A cloud security system and method implements cloud activity threat detection using analysis of cloud usage user behavior. In particular, the cloud security system and method implements threat detection for users, cloud service providers, or tenants (enterprises) of the cloud security system who are new or unknown to the cloud security system and therefore lacking sufficient cloud activity data to generate an accurate behavior model for effective threat detection. In accordance with embodiments of the present invention, the cloud security system and method performs user behavior analysis to generate generalized user behavior models for user groups, where each user group includes users with similar cloud usage behavior. The user behavior models of the user groups are assigned to users with sparse cloud activity data. In this manner, the cloud security system and method of the present invention ensures effective threat detection by using accurate and reliable user behavior models.
1. A method of detecting anomalies in usage activities at one or more cloud-based service providers, the method comprising:
generating, using a hardware processor, a user behavior model, for each user of a plurality of users of the one or more cloud-based service providers, comprising one or more coefficients describing cloud usage behavior of the user;
analyzing, using the hardware processor, the user behavior models of the plurality of users to form user groups with similar user behavior;
generating, using the hardware processor, a generalized user behavior model for each user group of the user groups, each of the generalized user behavior model comprising one or more coefficients describing cloud usage behavior of a corresponding user group;
determining that another user does not have sufficient usage activity data to generate a user behavior model for the other user;
assigning, using the hardware processor, the other user to an assigned user group of the user groups;
assigning, using the hardware processor, the generalized user behavior model of the assigned user group as a user behavior model for the other user;
generating, using the hardware processor, a threat detection threshold for the other user using the coefficients of the user behavior model of the other user;
receiving, using the hardware processor, an event stream of cloud usage activity data of the other user for a current time period;
detecting, using the hardware processor, an anomaly in the cloud usage activity data of the other user in the event stream using the threat detection threshold of the other user, the anomaly indicating a potential security risk associated with usage activities at the cloud-based service providers; and
performing an action based on the detected anomaly.
2. The method of claim 1 , wherein performing an action based on the detected anomaly comprises ranking the detected anomaly among other detected anomalies based on risk levels.
3. The method of claim 1 , wherein performing an action based on the detected anomaly comprises filtering the detected anomaly and other detected anomalies to remove anomalies having a low risk rating.
4. The method of claim 1 , wherein performing an action based on the detected anomaly comprises generating a report including the detected anomaly.
5. The method of claim 1 , wherein analyzing, using the hardware processor, the user behavior models of the plurality of users to form user groups with similar user behavior further comprises:
identifying users with similar coefficient values in the user behavior models; and
grouping users with similar coefficient values in the user behavior models into a user group.
6. The method of claim 1 , wherein assigning, using the hardware processor, the other user to the assigned user group of the user groups comprises:
identifying the assigned user group as having similar cloud activity attribute values as the other user, the cloud activity attribute values relating to cloud usage activity data being measured; and
assigning the other user to the assigned user group.
7. The method of claim 6 , wherein identifying the assigned user group as having similar cloud activity attribute values as the other user comprises:
identifying the assigned user group as having similar cloud activity attribute values as the other user, the cloud activity attributes comprising a number of bytes of data in a service action, a number of times the one of the one or more cloud-based service providers has been visited, or a number of reports being accessed.
8. A system for detecting anomalies in usage activities at one or more cloud-based service providers, comprising:
a memory; and
a hardware processor coupled to the memory and configured to:
generate a user behavior model, for each user of a plurality of users of the one or more cloud-based service providers, comprising one or more coefficients describing cloud usage behavior of the user;
analyze the user behavior models of the plurality of users to form user groups with similar user behavior;
generate a generalized user behavior model for each user group of the user groups, each of the generalized user behavior model comprising one or more coefficients describing cloud usage behavior of a corresponding user group;
determine that another user does not have sufficient usage activity data to generate a user behavior model for the other user;
assign the other user to an assigned user group of the user groups;
assign the generalized user behavior model of the assigned user group as a user behavior model for the other user;
generate a threat detection threshold for the other user using the coefficients of the user behavior model of the other user;
receive an event stream of cloud usage activity data of the other user for a current time period;
detect an anomaly in the cloud usage activity data of the other user in the event stream using the threat detection threshold of the other user, the anomaly indicating a potential security risk associated with usage activities at the cloud-based service providers; and
perform an action based on the detected anomaly.
9. The system of claim 8 , wherein the hardware processor, in performing an action based on the detected anomaly, ranks the detected anomaly among other detected anomalies based on risk levels.
10. The system of claim 8 , wherein the hardware processor, in performing an action based on the detected anomaly, filters the detected anomaly and other detected anomalies to remove anomalies having a low risk rating.
11. The system of claim 8 , wherein the hardware processor, in performing an action based on the detected anomaly, generates a report including the detected anomaly.
12. The system of claim 8 , wherein the hardware processor, in analyzing the user behavior models of the plurality of users to form user groups with similar user behavior:
identifies users with similar coefficient values in the user behavior models; and
groups users with similar coefficient values in the user behavior models into a user group.
13. The system of claim 8 , wherein the hardware processor, in assigning the other user to the assigned user group of the user groups:
identifies the assigned user group as having similar cloud activity attribute values as the other user, the cloud activity attribute values relating to cloud usage activity data being measured; and
assigns the other user to the assigned user group.
14. The system of claim 13 , wherein the hardware processor, in identifying the assigned user group as having similar cloud activity attribute values as the other user:
identifies the assigned user group as having similar cloud activity attribute values as the other user, the cloud activity attributes comprising a number of bytes of data in a service action, a number of times the one of the one or more cloud-based service providers has been visited, or a number of reports being accessed.
15. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method of detecting anomalies in usage activities at one or more cloud-based service providers, the method comprising :
generating a user behavior model, for each user of a plurality of users of the one or more cloud-based service providers, comprising one or more coefficients describing cloud usage behavior of the user;
analyzing the user behavior models of the plurality of users to form user groups with similar user behavior;
generating a generalized user behavior model for each user group of the user groups, each of the generalized user behavior model comprising one or more coefficients describing cloud usage behavior of a corresponding user group;
determining that another user does not have sufficient usage activity data to generate a user behavior model for the other user;
assigning the other user to an assigned user group of the user groups;
assigning the generalized user behavior model of the assigned user group as a user behavior model for the other user;
generating a threat detection threshold for the other user using the coefficients of the user behavior model of the other user;
receiving an event stream of cloud usage activity data of the other user for a current time period;
detecting an anomaly in the cloud usage activity data of the other user in the event stream using the threat detection threshold of the other user, the anomaly indicating a potential security risk associated with usage activities at the cloud-based service providers; and
performing an action based on the detected anomaly.
16. The non-transitory computer-readable medium of claim 15 , wherein performing an action based on the detected anomaly comprises ranking the detected anomaly among other detected anomalies based on risk levels.
17. The non-transitory computer-readable medium of claim 15 , wherein performing an action based on the detected anomaly comprises filtering the detected anomaly and other detected anomalies to remove anomalies having a low risk rating.
18. The non-transitory computer-readable medium of claim 15 , wherein performing an action based on the detected anomaly comprises generating a report including the detected anomaly.
19. The non-transitory computer-readable medium of claim 15 , wherein analyzing the user behavior models of the plurality of users to form user groups with similar user behavior further comprises:
identifying users with similar coefficient values in the user behavior models; and
grouping users with similar coefficient values in the user behavior models into a user group.
20. The non-transitory computer-readable medium of claim 15 , wherein assigning the other user to the assigned user group of the user groups comprises:
identifying the assigned user group as having similar cloud activity attribute values as the other user, the cloud activity attribute values relating to cloud usage activity data being measured; and
assigning the other user to the assigned user group.