JPWO2020214587A5 - - Google Patents

Claims (20)

A method for detecting anomalous user behavior in a cloud environment, comprising:
receiving a count of actions taken during the current time interval in the cloud environment;
if the action is taken across peer groups, determining whether the count of the action is greater than a statistical characterization of the previous time by more than a threshold amount;
determining whether the action represents an outlier;
and generating an alert based on determining whether the action represents an outlier. 2. The method of claim 1, wherein the count of actions taken during the current time interval includes a count of single action types performed by a single user. 3. A method according to claim 1 or 2 , wherein said count of said actions taken during said current time interval comprises a count of a single action type performed on a single resource. of the actions taken during the current time interval by aggregating multiple actions by a single user or on a single resource from action logs recorded during the current time interval; A method according to any one of claims 1 to 3 , further comprising the step of generating said count. 5. Any one of claims 1 to 4, wherein said threshold amount comprises a predetermined number of standard deviations above said statistical characterization of said previous time when said action was taken across said peer group. The method described in . determining whether the count of the actions is greater than a threshold amount;
providing the count of the actions and the type of the action to a neural network;
receiving an output from the neural network indicating whether the action represents an outlier. 7. The method of claim 6, wherein said neural network is trained with said count of said actions, said type of said actions, and responses to said alerts. A computer program comprising instructions that, when executed by one or more processors, causes the one or more processors to perform an action, the action comprising:
an act of receiving a count of actions taken during a current time interval in a cloud environment;
an act of determining whether, if the action was taken across a peer group, the count of the action is greater than a statistical characterization of a previous time by more than a threshold amount;
an act of determining whether the action represents an outlier;
generating an alert based on determining whether the action represents an outlier. Said operation further comprises:
an act of calculating a first vector representing actions taken during a plurality of previous time intervals in the cloud environment;
calculating a similarity between said first vector and a second vector comprising counts of actions taken during a current time interval, said second vector being said counts of said actions. also comprising:
an act of comparing the similarity measure to a baseline threshold to determine if one or more anomalous actions have occurred;
generating an alert based, at least in part, on determining that the one or more anomalous actions have occurred in the cloud environment. 10. The computer program product of claim 9, wherein the similarity is calculated using cosine similarity. 11. The computer program product of claim 9 or 10 , wherein each entry in said first vector contains an average event score during said plurality of previous time intervals. A computer program according to any one of claims 9 to 11, wherein each of said plurality of previous time intervals comprises one day. The plurality of previous time intervals includes a sliding window of days, the sliding window of days adding the current time interval to the sliding window of days after each time interval, and Computer program according to any one of claims 9 to 12 , for removing the oldest time intervals from a sliding window of multiple days. 14. Any one of claims 9 to 13, wherein the first vector represents actions taken during the plurality of previous time intervals by storing a histogram of event counts for each of the plurality of previous time intervals. or a computer program according to claim 1 . a system,
one or more processors;
and one or more memory devices containing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
an act of receiving a count of actions taken during a current time interval in a cloud environment;
an act of determining whether, if the action was taken across a peer group, the count of the action is greater than a statistical characterization of a previous time by more than a threshold amount;
an act of determining whether the action represents an outlier;
generating an alert based on determining whether the action represents an outlier. The act of determining whether the action represents an outlier comprises:
16. The system of claim 15, comprising the act of performing a second determination as to whether the count for the action is greater than a global average of action counts multiplied by a scale factor for the action. The act of determining whether the action represents an outlier comprises:
17. The system of claim 16, comprising calculating the scale factor as a ratio of a local average of action counts to the global average of action counts. The act of determining whether the action represents an outlier comprises:
18. The system of claim 17, comprising replacing the existing scale factor if the scale factor is greater than an existing scale factor for the action. A system according to any one of claims 15 to 18 , wherein said actions comprise several emails sent by a particular user. A system according to any one of claims 15 to 19 , wherein said actions include a number of folders created by a particular user.