Detecting behavior anomalies of cloud users for outlier actions

1. A method of detecting anomalous user behavior in cloud environments, the method comprising:

receiving a count of an action taken during a current time interval in a cloud environment;

accessing a history of previous counts of the action taken across a peer group and generating a statistical characterization of the previous counts of the action based on a sliding window of the history of previous counts of the action across the peer group;

performing a first determination of whether the count of the action taken during the current time interval is greater by more than a threshold amount than the statistical characterization of the previous counts of the action taken across the peer group;

calculating a scale factor as a ratio of a local mean of action counts over a global mean of action counts;

performing a second determination of whether the count of the action is greater than the global mean of action counts multiplied by the scale factor for the action;

determining that the action represents an outlier based on the first determination and the second determination; and

generating an alert based on determining that the action represents an outlier.

2. The method of claim 1 , wherein the count of the action taken during the current time interval comprises a count of a single action type performed by a single user.

3. The method of claim 1 , wherein the count of the action taken during the current time interval comprises a count of a single action type performed on a single resource.

4. The method of claim 1 , further comprising generating the count of the action taken during the current time interval by aggregating actions by a single user or on a single resource from an action log recorded during the current time interval.

5. The method of claim 1 , wherein the threshold amount comprises a predetermined number of standard deviations above the statistical characterization of the previous times when the action was taken across the peer group.

6. The method of claim 1 , wherein determining whether the count of the action is greater by more than a threshold amount comprises:

providing the count of the action and a type of the action to a neural network; and

receiving an output from the neural network indicating whether the action represents an outlier.

7. The method of claim 6 , wherein the neural network is trained using the count of the action, the type of the action, and a response to the alert.

8. A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving a count of an action taken during a current time interval in a cloud environment;

accessing a history of previous counts of the action taken across a peer group and generating a statistical characterization of the previous counts of the action based on a sliding window of the history of previous counts of the action across the peer group;

performing a first determination of whether the count of the action taken during the current time interval is greater by more than a threshold amount than the statistical characterization of the previous counts of the action taken across the peer group;

calculating a scale factor as a ratio of a local mean of action counts over a global mean of action counts;

performing a second determination of whether the count of the action is greater than the global mean of action counts multiplied by the scale factor for the action;

determining that the action represents an outlier based on the first determination and the second determination; and

generating an alert based on determining that the action represents an outlier.

9. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:

calculating a first vector that is representative of actions taken during a plurality of previous time intervals in the cloud environment;

calculating a similarity between the first vector and a second vector that comprises counts of actions taken during a current time interval, wherein the second vector also comprises the count of the action;

comparing the similarity to a baseline threshold to determine whether one or more anomalous actions have occurred; and

generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.

10. The non-transitory computer-readable medium of claim 9 , wherein the similarity is calculated using a cosine similarity.

11. The non-transitory computer-readable medium of claim 9 , wherein each entry in the first vector comprises an average event score during the plurality of previous time intervals.

12. The non-transitory computer-readable medium of claim 9 , wherein each of the plurality of previous time intervals comprises one day.

13. The non-transitory computer-readable medium of claim 9 , wherein the plurality of previous time intervals comprises a sliding window of days, wherein the sliding window of days adds the current time interval to the sliding window of days and removes a least-recent time interval from the sliding window of days after each time interval.

14. The non-transitory computer-readable medium of claim 9 , wherein the first vector is representative of actions taken during the plurality of previous time intervals by storing a histogram of event counts for each of the plurality of previous time intervals.

15. A system comprising:

one or more processors; and

one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving a count of an action taken during a current time interval in a cloud environment;

accessing a history of previous counts of the action taken across a peer group and generating a statistical characterization of the previous counts of the action based on a sliding window of the history of previous counts of the action across the peer group;

performing a first determination of whether the count of the action taken during the current time interval is greater by more than a threshold amount than the statistical characterization of the previous counts of the action taken across the peer group;

calculating a scale factor as a ratio of a local mean of action counts over a global mean of action counts;

performing a second determination of whether the count of the action is greater than the global mean of action counts multiplied by the scale factor for the action;

determining that the action represents an outlier based on the first determination and the second determination; and

generating an alert based on determining that the action represents an outlier.

16. The system of claim 15 , wherein determining whether the action represents an outlier comprises:

replacing an existing scale factor for the action when the scale factor is greater than the existing scale factor.

17. The system of claim 15 , wherein the action comprises a number of emails that are sent by a particular user.

18. The system of claim 15 , wherein the action comprises a number of folders created by a particular user.

19. The system of claim 15 , wherein the operations further comprise:

calculating a first vector that is representative of actions taken during a plurality of previous time intervals in the cloud environment;

calculating a similarity between the first vector and a second vector that comprises counts of actions taken during a current time interval, wherein the second vector also comprises the count of the action;

comparing the similarity to a baseline threshold to determine whether one or more anomalous actions have occurred; and

generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.

20. The system of claim 15 , wherein determining whether the count of the action is greater by more than a threshold amount comprises:

providing the count of the action and a type of the action to a neural network; and

receiving an output from the neural network indicating whether the action represents an outlier.