Detecting unauthorized cloud access by detecting malicious velocity incidents

A computing device for identifying unauthorized cloud access by distinguishing malicious velocity incidents from benign velocity incidents, comprising:

• one or more processors;
• a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon which, when executed by the one or more processors, cause the computing device to:
• receive an event that is part of a velocity incident, wherein the event is associated with features, and wherein the velocity incident occurs when a distance between the event and another event divided by a time elapsed between the event and the other event is greater than a threshold velocity;
• determine a weighted probability by:
• summing, for each feature of the event, the product of:
• a probability that past events having the feature were part of velocity incidents calculated by multiplying a probability that past events that were part of past velocity incidents have the feature by a probability that past events have the feature and dividing by a probability that past events have the feature, and
• a relative frequency of past events having the feature, and
• dividing by a sum of the relative frequencies of past events having the feature;
• determine the velocity incident is malicious when the weighted probability is less than a defined probability threshold;
• and
• in response to determining the velocity incident is malicious, provide a security alert that an unauthorized cloud access event may have occurred.

A computer-implemented method for identifying unauthorized cloud access by distinguishing malicious velocity incidents from benign velocity incidents, comprising:

• receiving an event that is part of a velocity incident, wherein the event is associated with features, and wherein the velocity incident occurs when a distance between the event and another event divided by a time elapsed between the event and the other event is greater than a threshold velocity;
• determining a weighted probability by:
• summing, for each feature of the event, the product of:
• a probability that past events having the feature were part of velocity incidents, and
• a relative frequency of past events having the feature calculated by multiplying a number of past events having the feature by a number of distinct values of the feature and dividing by a total number of past events, and
• dividing by a sum of the relative frequencies of past events having the feature;
• determining the velocity incident is malicious when the weighted probability is less than a defined probability threshold;
• and
• in response to determining the velocity incident is malicious, providing a security alert that an unauthorized cloud access event may have occurred.