Operational prediction on user-based contextual sessions
Contextual session-based operational prediction greatly improves computer functioning. As a cloud service is provided, a current contextual session is generated using multiple events provided by the cloud service. The current contextual session is compared to a contextual session profile. The contextual session profile represents historical contextual sessions that have been historically logged in associated with the cloud service. If the current contextual session conforms to the contextual session profile, then the cloud service is normally operating as historically observed and may be predicted as normal operation. If, however, the current contextual session fails to conform to the contextual session profile, then the cloud service is not operating as historically observed and may be predicted as abnormal operation. Alerts and warning may be generated to notify of abnormal cloud service operation. The contextual session-based operational prediction produces a faster and more accurate detection of the abnormal operation.
1 . A method executed by a computer system that monitors a cloud service, comprising:
locally generating, by an endpoint agent monitoring the computer system, an endpoint user's personalized contextual session by chronologically arranging multiple events occurring within a timeframe representing time-based usage associated with an endpoint device and a user identity;
locally comparing, by the endpoint agent monitoring the computer system, the endpoint user's personalized contextual session to a contextual session profile representing the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and
locally generating, by the endpoint agent monitoring the computer system, a contextual session prediction based on the comparing of the endpoint user's personalized contextual session to the endpoint user's historical contextual sessions representing the historical contextual sessions.
2 . The method of claim 1 , further comprising determining the endpoint user's personalized contextual session conforms to the endpoint user's historical contextual sessions.
3 . The method of claim 2 , wherein in response to the determining that the endpoint user's personalized contextual session conforms to the endpoint user's historical contextual sessions, further comprising categorizing the endpoint user's personalized contextual session as a normal operation.
4 . The method of claim 1 , further comprising approving the cloud service.
5 . The method of claim 1 , further comprising determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions.
6 . The method of claim 5 , wherein in response to the determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions, further comprising categorizing the endpoint user's personalized contextual session as an abnormal operation.
7 . The method of claim 5 , wherein in response to the determining that the endpoint user's personalized contextual session fails to conform to the endpoint user's historical contextual sessions, further comprising at least one of denying the cloud service or terminating the cloud service.
8 . The method of claim 1 , further comprising generating an alert notification indicating the endpoint user's personalized contextual session represents an abnormal operation.
9 . At least one computer system that monitors a cloud service, comprising:
at least one central processing unit; and
at least one memory device storing instructions that, when executed by the at least one central processing unit, perform operations, the operations comprising:
detecting multiple events by an endpoint agent monitoring a host operating system;
locally generating, by the endpoint agent monitoring the host operating system, an endpoint user's personalized contextual session by chronologically arranging the multiple events associated with a user identity and the cloud service occurring within a timeframe;
locally comparing, by the endpoint agent monitoring the host operating system, the endpoint user's personalized contextual session to a contextual session profile generated by a machine learning model trained using the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and
locally generating, by the endpoint agent monitoring the host operating system, a contextual prediction based on the comparing of the endpoint user's personalized contextual session to the contextual session profile representing the endpoint user's historical strings of the multiple events occurring within the timeframe.
10 . The at least one computer system of claim 9 , wherein the operations further comprise determining the endpoint user's personalized contextual session conforms to the contextual session profile.
11 . The at least one computer system of claim 10 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as a normal operation.
12 . The at least one computer system of claim 10 , wherein the operations further comprise approving the cloud service.
13 . The at least one computer system of claim 9 , wherein the operations further comprise determining that the endpoint user's personalized contextual session fails to conform to the contextual session profile.
14 . The at least one computer system of claim 13 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as an abnormal operation.
15 . The at least one computer system of claim 13 , wherein the operations further comprise generating a contextual alert notification indicating the contextual session represents an abnormal operation.
16 . The at least one computer system of claim 9 , wherein the operations further comprise at least one of denying the cloud service or terminating the cloud service.
17 . A memory device storing instructions that, when executed by at least one central processing unit, perform operations that monitor a cloud service, the operations comprising: detecting multiple events by an endpoint agent monitoring a host operating system; locally generating, by the endpoint agent monitoring the host operating system, an endpoint user's personalized contextual session by chronologically arranging the multiple events associated with a user identity and the cloud service occurring within a timeframe; locally comparing, by the endpoint agent monitoring the host operating system, the endpoint user's personalized contextual session to a contextual session profile generated by a machine learning model trained using the endpoint user's historical contextual sessions representing the endpoint user's historical strings of the multiple events occurring within the timeframe; and locally generating, by the endpoint agent monitoring the host operating system, a contextual prediction based on the comparing of the endpoint user's personalized contextual session to the contextual session profile representing the endpoint user's historical strings of the multiple events occurring within the timeframe.
18 . The memory device of claim 17 , wherein the operations further comprise determining that the endpoint user's personalized contextual session fails to conform to the contextual session profile.
19 . The memory device of claim 18 , wherein the operations further comprise categorizing the endpoint user's personalized contextual session as an abnormal operation.
20 . The memory device of claim 17 , wherein the operations further comprise generating a contextual alert notification indicating the contextual session represents an abnormal operation.