Distributed detection of malicious cloud actors

A method for distributed detection of malicious cloud actors, the method comprising:

• intercepting a plurality of outgoing cloud packets from a plurality of cloud servers that are processed by a plurality of intrusion detection modules to determine if a preliminary threshold is exceeded, wherein the plurality of outgoing cloud packets is used to identify a customer of a plurality of customers, and wherein each cloud server includes at least one of the plurality of intrusion detection modules;
• generating, by the intrusion detection modules, a potential outgoing intrusion event of a plurality of potential outgoing intrusion events when the preliminary threshold is exceeded;
• providing, by the intrusion detection modules, each of the potential outgoing intrusion events to a malice aggregator associated with a device other than the plurality of cloud servers;
• and
• updating, by the malice aggregator, an aggregate log based on the plurality of potential outgoing intrusion events, wherein the aggregate log tracks a customer subset of the plurality of cloud servers that is associated with the customer;
• in response to analyzing the aggregate log to determine that cloud traffic by the customer to a destination address exceeds an intrusion threshold, providing, by the malice aggregator, a notification of malicious activity by the customer, wherein the intrusion threshold is satisfied at a higher cloud activity level than the preliminary threshold;
• tracking, by the malice aggregator, statistics for the plurality of cloud servers as associated with each customer from the aggregate log;
• identifying multiple cloud devices being utilized by each customer across multiple ones of the plurality of cloud servers within the aggregate log;
• maintaining, by the malice aggregator, a profile for each customer over time based on the corresponding statistics to detect anomalous behavior of each customer while maintaining a privacy for each customer through utilization of non-sensitive data included with network protocols without deep packet inspection;
• and
• maintaining, by the intrusion detection modules, a current total number of intrusion detection modules that are processing to be proportional to a quantity of the outgoing cloud packets residing in a server queue with a subset of the intrusion detection modules designated as permanent.

A non-transitory machine-readable storage medium encoded with instructions executable by a processor for distributed detection of malicious cloud actors, the machine-readable storage medium comprising instructions to:

• intercept a plurality of outgoing cloud packets from each cloud server of a plurality of cloud servers, each cloud packet is processed in each server queue of a plurality of server quests by one of a plurality of intrusion detection modules to determine if a preliminary threshold is exceeded, wherein the plurality of outgoing cloud packets is used to identify a customer of a plurality of customers;
• in response to determining that any of the server queues exceed a threshold queue size, request that an additional intrusion detection module be instantiated to process the plurality of outgoing cloud packets from a corresponding server queue;
• generate, by each intrusion detection module, a potential outgoing intrusion event of a plurality of potential outgoing intrusion events when the preliminary threshold is exceeded;
• provide, by each of the intrusion detection modules, the potential outgoing intrusion event to a malice aggregator associated with a device other than the plurality of cloud servers;
• and
• update, by the malice aggregator, an aggregate long based on the plurality of potential outgoing intrusion events, wherein the aggregate log tracks a customer subset of the plurality of cloud servers that is associated with the customer;
• in response to analyzing the aggregate log to determine that cloud traffic by the customer to a destination address exceeds an intrusion threshold, provide, by the malice aggregator, a notification of malicious activity by the customer, wherein the intrusion threshold is satisfied at a higher cloud activity level than the preliminary threshold;
• track statistics for the plurality of cloud servers as associated with each customer from the aggregate log;
• identify multiple cloud devices being utilized by each customer across multiple ones of the plurality of cloud servers within the aggregate log;
• maintain a profile for each customer over time based on the corresponding statistics to detect anomalous behavior of each customer while maintaining a privacy for each customer through utilization of non-sensitive data included with network protocols without deep packet inspection and
• maintain a current total number of intrusion detection modules that are processing to be proportional to a quantity of the outgoing cloud packets residing in the corresponding server queue with a subset of the intrusion detection modules designated as permanent.