Threat detection using cloud resource management logs
Generally discussed herein are devices, systems, and methods for improving cloud resource security. A method can include obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed. The method can include determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.
1. A method for cloud resource security management, the method comprising:
obtaining a cloud resource management log that details actions performed by a group of users on cloud resources through accessing a cloud portal through which the group of users logs in and alters connections between and a security policy of the cloud resources, the actions each including entries comprising a user identification (ID) of a user of the group of users, an operation of operations performed on a cloud resource of the cloud resources, and (i) a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or (ii) a time the operation was performed, the operations including two or more of (i) generating one or more cloud resources, (ii) moving one or more cloud resources, (iii) connecting one or more cloud resources to each other, or (iv) altering an access or security policy for one or more cloud resources;
determining a respective score for each action in the cloud resource management log;
comparing the respective score to a specified criterion; and
providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.
2. The method of claim 1 , wherein determining the score includes using collaborative filtering.
3. The method of claim 2 , wherein determining the respective score includes combining a collaborative filtering score for at least two of (i) the user ID and the operation, (ii) the user ID and the resource, (iii) the operation and the resource, or (iv) the user ID and the time.
4. The method of claim 3 , further comprising generating a bipartite graph including (i) respective users of the group of users and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective user accessed the respective cloud resource, (ii) respective users of the group of users and respective operations of the operations as nodes and respective edges representing whether the respective user performed the respective operation; or (iii) respective operations of the operations and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective operation was performed on the respective cloud resource and wherein collaborative filtering is performed based on data representing the generated graph.
5. The method of claim 1 , further comprising, before determining the respective score, filtering the cloud resource management log to include only operations that are performed by an attacker and wherein the respective score is determined based on the filtered cloud resource management log.
6. The method of claim 5 , the operations performed by the attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, or changing permissions.
7. The method of claim 1 , wherein providing the indication of anomalous action includes providing an electronic mail, a pop-up message, or a text message indicating the action of the management log corresponding to the anomalous action.
8. A compute device comprising:
processing circuitry;
a memory coupled to the processing circuitry, the memory including instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations for cloud resource security management, the operations comprising:
obtaining a cloud resource management log that details actions performed by a group of users on cloud resources through accessing a cloud portal through which the group of users logs in and alters connections between and a security policy of the cloud resources, the actions including entries comprising a user identification (ID) of a user of the group of users, an operation of operations performed on a cloud resource of the cloud resources, and (i) a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or (ii) a time the operation was performed, the operations including two or more of (i) generating one or more cloud resources, (ii) moving one or more cloud resources, (iii) connecting one or more cloud resources to each other, or (iv) altering an access or security policy for one or more cloud resources;
determining a respective score for each action in the cloud resource management log;
comparing the respective score to a specified criterion; and
providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.
9. The device of claim 8 , wherein determining the score includes using collaborative filtering.
10. The device of claim 9 , wherein determining the respective score includes combining a collaborative filtering score for at least two of (i) the user ID and the operation, (ii) the user ID and the resource, (iii) the operation and the resource, or (iv) the user ID and the time.
11. The device of claim 10 , further comprising generating a bipartite graph including (i) respective users of the group of users and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective user accessed the respective cloud resource; (ii) respective users of the group of users and respective operations of the operations as nodes and respective edges representing whether the respective user performed the respective operation; or (iii) respective operations of the operations and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective operation was performed on the respective cloud resource and wherein collaborative filtering is performed based on data representing the generated graph.
12. The device of claim 8 , further comprising, before determining the respective score,
filtering the cloud resource management log to include only operations that are performed by an attacker and wherein the respective score is determined based on the filtered cloud resource management log.
13. The device of claim 12 , the operations performed by the attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, or changing permissions.
14. The device of claim 8 , wherein providing the indication of anomalous action includes providing an electronic mail, a pop-up message, or a text message indicating the action of the management log corresponding to the anomalous action.
15. A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for cloud resource security management, the operations comprising:
obtaining a cloud resource management log that details actions performed by users of a group of users on cloud resources through accessing a cloud portal through which the group of users logs in and alters connections between and a security policy of the cloud resources, the actions including entries comprising at least two of a user identification (ID) of a user of the group of users, an operation of operations performed on a cloud resource of the cloud resources, and (i) a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or (ii) a time the operation was performed, the operations including two or more of (i) generating one or more cloud resources, (ii) moving one or more cloud resources, (iii) connecting one or more cloud resources to each other, or (iv) altering an access or security policy for one or more cloud resources;
determining a respective score for each action in the cloud resource management log;
comparing the respective score to a specified criterion; and
providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.
16. The non-transitory machine-readable medium of claim 15 , wherein determining the score includes using collaborative filtering.
17. The non-transitory machine-readable medium of claim 16 , wherein determining the respective score includes combining a collaborative filtering score for at least two of (i) the user ID and the operation, (ii) the user ID and the resource, (iii) the operation and the resource, or (iv) the user ID and the time.
18. The non-transitory machine-readable medium of claim 17 , further comprising generating a bipartite graph including (i) respective users of the group of users and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective user accessed the respective cloud resource; (ii) respective users of the group of users and respective operations of the operations as nodes and respective edges representing whether the respective user performed the respective operation; or (iii) respective operations of the operations and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective operation was performed on the respective cloud resource and wherein collaborative filtering is performed based on data representing the generated graph.
19. The non-transitory machine-readable medium of claim 15 , further comprising, before determining the respective score, filtering the cloud resource management log to include only operations that are performed by an attacker and wherein the respective score is determined based on the filtered cloud resource management log.
20. The non-transitory machine-readable medium of claim 19 , the operations performed by the attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, or changing permissions.