Provenance based identification of policy deviations in cloud computing environments

1. A computer-implemented method of detecting policy deviations in cloud based distributed computing environments comprising:

creating an immutable ledger of transaction provenance performed in the cloud based distributed computing environment;

collecting persona data that includes an identity for an actor working in the cloud computing environment, and a list of authorized transactions for the identity, the list of authorized transactions indicating a level of the cloud based distributed computing environment that the identity is authorized to modify;

plotting persona data for transaction types from the immutable ledger of transaction as an bipartite graph, wherein edge weights of the bipartite graphs are correlated to trust levels between personas from the persona data and the transaction types from the immutable ledger;

employing rules to detect in real time when a policy deviation in the cloud based distributed computing environment is occurring;

correlating trust levels from the edge weights to the rules illustrating when the transaction provenance indicates the policy deviation in the cloud based distributed computing environment, wherein the policy deviation is indicative of an unauthorized change to infrastructure of the distributed computing environment based on the identity included in the persona data of the actor;

and

performing a corrective action to revert the change to the infrastructure in the cloud based distributed computing environment that triggered the policy deviation being detected by the rules.

2. The computer-implemented method of claim 1 , wherein the immutable ledger of transaction provenance comprises block chain memory.

3. The computer-implemented method of claim 1 further comprising creating a data repository including a database of cloud components, a persona database and a database for historical transactions, wherein the data repository provides the data for creating the immutable ledger of transaction provenance.

4. The computer-implemented method of claim 1 , wherein the transaction types indicate what modifications are made the cloud computing environment made by the identity for the persona data.

5. The computer-implemented method of claim 1 , wherein the edge weights of the bipartite graphs are correlated to the trust levels comprise high trust levels when the provenance indicates personas operating within their assigned responsibilities and low trust levels when the person personas are operating outside their assigned responsibilities.

6. The computer implemented method of claim 1 , wherein the policy deviation indicates that the actor corresponding to the identity included in the persona data has made a modification to an element of the distributed computing element outside their list of authorized transaction types.

7. A system for detecting policy deviations in cloud based distributed computing environments comprising:

a hardware processor; and

a memory that stores a computer program product, which when executed by the hardware processor, causes the hardware processor to:

create an immutable ledger of transaction provenance performed in the cloud based distributed computing environment;

collect persona data that includes an identity for an actor working in the cloud computing environment, and a list of authorized transactions for the identity, the list of authorized transactions indicating a level of the cloud based distributed computing environment that the identity is authorized to modify;

plot persona data for transaction types from the immutable ledger of transaction as an bipartite graph, wherein edge weights of the bipartite graphs are correlated to trust levels between personas from the persona data and the transaction types from the immutable ledger;

employ the rules to detect in real time when a policy deviation in the cloud based distributed computing environment is occurring;

correlate trust levels from the edge weights to rules illustrating when the transaction provenance indicate a policy deviation in the cloud based distributed computing environment, wherein the policy deviation is indicative of an unauthorized change to infrastructure of the distributed computing environment; and

perform a corrective action to revert the change to the infrastructure in the cloud based distributed computing environment that triggered the policy deviation being detected by the rules.

8. The system of claim 7 , wherein the immutable ledger of transaction provenance comprises block chain memory.

9. The system of claim 8 further comprising creating a data repository including a database of cloud components, a persona database and a database for for historical transactions, wherein the data repository provides the data for creating the immutable ledger of transaction provenance.

10. The system of claim 7 , wherein the transaction types indicate what modifications made on a level of the cloud computing environment made by the identity for the persona data.

11. The system of claim 7 , wherein the edge weights of the bipartite graphs are correlated to the trust levels comprise high trust levels when the provenance indicates personas operating within their assigned responsibilities and low trust levels when the person personas are operating outside their assigned responsibilities.

12. The system of claim 7 , wherein the policy deviation indicates that the actor corresponding to the identity included in the persona data has made a modification to an element of the distributed computing element outside their list of authorized transaction types.

13. A non-transitory computer program product for detecting policy deviations in a cloud based distributed computing environments comprising a computer readable storage medium having computer readable program code embodied therewith, the program instructions executable by a processor to cause the processor to:

create, using the processor, an immutable ledger of transaction provenance performed in the cloud based distributed computing environment;

collect, using the processor, persona data that includes an identity for an actor working in the cloud computing environment, and a list of authorized transactions for the identity, the list of authorized transactions indicating a level of the cloud based distributed computing environment that the identity is authorized to modify;

plot, using the processor, persona data for transaction types from the immutable ledger of transaction as an bipartite graph, wherein edge weights of the bipartite graphs are correlated to trust levels between personas from the persona data and the transaction types from the immutable ledger;

employ, using the processor, the rules to detect in real time when a policy deviation in the cloud based distributed computing environment is occurring;

correlate, using the processor, trust levels from the edge weights to rules illustrating when the transaction provenance indicate a policy deviation in the cloud based distributed computing environment, wherein the policy deviation is indicative of an unauthorized change to infrastructure of the distributed computing environment; and

perform a corrective action to revert the change to the infrastructure in the cloud based distributed computing environment that triggered the policy deviation being detected by the rules.