Systems and methods for detecting security incidents across cloud-based application services
A method, a system, and an article are provided for identification of security-related activities based on usage of a plurality of independent cloud-based, hosted application platforms. An example method includes: receiving, from the application platforms, activity data and state data for a plurality of users of the application platforms; generating one or more predictive models configured to detect deviations from normal user behavior across the application platforms; providing, as input to the one or more predictive models, the activity data and the state data for at least one of the users; receiving, from the one or more predictive models, an indication that an activity of the at least one of the users deviates from the normal user behavior; and facilitating a remedial action to address the indicated deviation.
1. A computer-implemented method, comprising:
receiving, from a plurality of cloud-based application platforms provided by a plurality of service providers, activity data and state data for a plurality of users of the application platforms, the activity data being indicative of user activities within the application platforms, the state data being indicative of a status of the users within the application platforms, and the plurality of service providers using a plurality of naming conventions such that a first file is associated with multiple file names;
performing an entity resolution process to map the first file to the multiple file names, the entity resolution process including a first phase in which multiple entities are resolved to a single entity and a second phase in which the single entity is resolved against an application-agnostic dictionary such that entities having a similar type are identified using a common term;
providing, as input to one or more predictive models configured to detect deviations from normal user behavior across the application platforms, the activity data and the state data for at least one of the users;
receiving, as output from the one or more predictive models, an indication that an activity of the at least one of the users deviates from the normal user behavior; and
facilitating a remedial action to address the indicated deviation.
2. The method of claim 1 , wherein the status of the users comprises at least one of a user role, a user permission, and a user privilege.
3. The method of claim 1 , wherein generating one or more predictive models comprises:
constructing a graphical representation of the activity data and the state data, wherein each node of the graphical representation represents a respective user of the application platforms and each edge connecting the nodes represents an activity among the users in the application platforms.
4. The method of claim 1 , wherein the deviation from the normal user behavior comprises an abnormal number of login attempts and is indicative of account takeover.
5. The method of claim 1 , wherein the deviation from the normal user behavior is indicative of anomalous reconnaissance activity.
6. The method of claim 1 , wherein the deviation from the normal user behavior comprises behavior that is abnormal compared to behavior of other users who have similar roles within an organization that uses the application platforms.
7. The method of claim 1 , further comprising receiving, as output from the one or more predictive models, an indication that a privilege of the at least one of the users to access the application platforms deviates from a desired privilege.
8. The method of claim 1 , further comprising receiving, as output from the one or more predictive models, an indication that a data outflow from one of the application platforms is unauthorized.
9. The method of claim 1 , further comprising receiving, as output from the one or more predictive models, a risk score for each user from the plurality of users, wherein the risk score comprises an indication of a likelihood that the user will engage in unauthorized activity using the application platforms.
10. The method of claim 1 , further comprising receiving, as output from the one or more predictive models, an indication that a user is attempting to transmit a sensitive item of data to a computer outside of an organization using the application platforms.
11. The method of claim 1 , wherein the plurality of service providers further use the plurality of naming conventions such that a first activity is associated with multiple activity names, and performing the entity resolution process includes mapping the first activity to the multiple activity names.
12. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to:
receive, from a plurality of cloud-based application platforms provided by a plurality of service providers, activity data and state data for a plurality of users of the application platforms, the activity data being indicative of user activities within the application platforms, the state data being indicative of a status of the users within the application platforms, and the plurality of service providers using a plurality of naming conventions such that a first file is associated with multiple file names;
map the first file to the multiple file names;
provide, as input to one or more predictive models configured to detect deviations from normal user behavior across the application platforms, the activity data and the state data for at least one of the users;
receive, as output from the one or more predictive models, an indication that an activity of the at least one of the users deviates from the normal user behavior; and
facilitate a remedial action to address the indicated deviation.
13. The apparatus of claim 12 , wherein the status of the users comprises at least one of a user role, a user permission, and a user privilege.
14. The apparatus of claim 12 , wherein generating one or more predictive models comprises:
constructing a graphical representation of the activity data and the state data, wherein each node of the graphical representation represents a respective user of the application platforms and each edge connecting the nodes represents an activity among the users in the application platforms.
15. The apparatus of claim 12 , wherein the deviation from the normal user behavior comprises an abnormal number of login attempts and is indicative of account takeover.
16. The apparatus of claim 12 , wherein the deviation from the normal user behavior is indicative of anomalous reconnaissance activity.
17. The apparatus of claim 12 , wherein the deviation from the normal user behavior comprises behavior that is abnormal compared to behavior of other users who have similar roles within an organization that uses the application platforms.
18. The apparatus of claim 12 , wherein the processor is further configured to receive, as output from the one or more predictive models, an indication that a privilege of the at least one of the users to access the application platforms deviates from a desired privilege.
19. The apparatus of claim 12 , wherein the processor is further configured to receive, as output from the one or more predictive models, an indication that a data outflow from one of the application platforms is unauthorized.
20. The apparatus of claim 12 , wherein the processor is further configured to receive, as output from the one or more predictive models, a risk score for each user from the plurality of users, wherein the risk score comprises an indication of a likelihood that the user will engage in unauthorized activity using the application platforms.
21. The apparatus of claim 12 , wherein the processor is further configured to receive, as output from the one or more predictive models, an indication that a user is attempting to transmit a sensitive item of data to a computer outside of an organization using the application platforms.
22. The apparatus of claim 12 , wherein the plurality of service providers further use the plurality of naming conventions such that a first activity is associated with multiple activity names, the processor further configured to:
map the first activity to the multiple activity.
23. An article, comprising:
a non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the one or more computer processors to perform operations comprising:
receiving, from a plurality of cloud-based application platforms provided by a plurality of service providers, activity data and state data for a plurality of users of the application platforms, the activity data being indicative of user activities within the application platforms, and the state data being indicative of a status of the users within the application platforms;
performing an entity resolution process, the entity resolution process including a first phase in which multiple entities are resolved to a single entity and a second phase in which the single entity is resolved against an application-agnostic dictionary such that entities having a similar type are identified using a common term;
providing, as input to one or more predictive models configured to detect deviations from normal user behavior across the application platforms, the activity data and the state data for at least one of the users;
receiving, as output from the one or more predictive models, an indication that an activity of the at least one of the users deviates from the normal user behavior; and
facilitating a remedial action to address the indicated deviation.