Unsupervised detection of security incidents in a cloud environment
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on a domain specific graph representative of factor data and dependencies between factor data, the security platform may determine a behavioral anomaly that is associated with a cyberattack.
1. A method for detecting cyberattacks in a cloud compute environment, the method comprising:
using one or more processors to perform:
executing one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data;
providing the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment;
using the security platform to perform:
determining, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
determining, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
determining, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and
generating, based on the detection data, an alert indicative of the cyberattack.
2. The method of claim 1 , further comprising:
determining, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations.
3. The method of claim 1 , further comprising:
determining, based on the detection data and on the audit log data, one or more resources associated with the cyberattack.
4. The method of claim 1 , further comprising:
determining, based on the detection data, credential data that has been compromised by the cyberattack.
5. The method of claim 1 , further comprising:
determining, based on additional audit log data, one or more updates to the probabilistic graph.
6. The method of claim 1 , further comprising:
determining, based on suppressing additional detection data associated with additional anomalous behavior, one or more updates that result in the probabilistic graph to not be indicative of a cyberattack for operational activity similar to operational activity associated with the additional anomalous behavior.
7. The method of claim 1 , wherein the cyberattack comprises port scanning, endpoint scanning and/or DNS tunneling.
8. The method of claim 1 , wherein the values indicate a count of DNS packets of type TXT observed in the network traffic within a threshold period of time.
9. A system for detecting cyberattacks in a cloud computing environment, the system comprising:
a memory storing executable instructions; and
one or more processors that execute the executable instructions to:
execute one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data;
provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment;
use the security platform to:
determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
determine, based on the domain specific probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and
generate, based on the detection data, an alert indicative of the cyberattack.
10. The system of claim 9 , wherein the one or more processors further execute the executable instructions to:
determine, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations.
11. The system of claim 9 , wherein the one or more processors further execute the executable instructions to:
determine, based on the detection data and on the audit log data, one or more resources associated with the cyberattack.
12. The system of claim 9 , wherein the one or more processors further execute the executable instructions to:
determine, based on the detection data, credential data that has been compromised by the cyberattack.
13. The system of claim 9 , wherein the one or more processors further execute the executable instructions to:
determine, based on additional audit log data, one or more updates to the probabilistic graph.
14. The system of claim 9 , wherein the one or more processors further execute the executable instructions to:
determine, based on suppressing additional detection data associated with additional anomalous behavior, one or more updates that result in the probabilistic graph to not be indicative of a cyberattack for operational activity similar to operational activity associated with the additional anomalous behavior.
15. One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause:
the one or more processors to:
execute one or more audit log services to collect event data generated by one or more services executing in a cloud compute environment to obtain audit log data; and
provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment; and
the security platform to:
determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
determine, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack; and
generate, based on the detection data, an alert indicative of the cyberattack.
16. The non-transitory computer-accessible storage media of claim 15 , wherein the executable instructions, when executed by the one or more processors, further cause the security platform to:
determine, based on the anomalous behavior, one or more operations that are associated with the cyberattack, wherein the alert is indicative of the one or more operations.
17. The non-transitory computer-accessible storage media of claim 15 , wherein the executable instructions, when executed by the one or more processors, further cause the security platform to:
determine, based on the detection data and on the audit log data, one or more resources associated with the cyberattack.
18. The non-transitory computer-accessible storage media of claim 15 , wherein the executable instructions, when executed by the one or more processors, further cause the security platform to:
determine, based on the detection data, credential data that has been compromised by the cyberattack.
19. The non-transitory computer-accessible storage media of claim 15 , wherein the executable instructions, when executed by the one or more processors, further cause the security platform to:
determine, based on additional audit log data, one or more updates to the probabilistic graph.