Techniques for protecting against excessive utilization of cloud services

A method for protecting against excessive utilization of at least one cloud service for operation of a cloud-hosted application, comprising:

• receiving, at a defense platform deployed out-of-path of traffic between a plurality of end user devices and the cloud-hosted application, telemetries from a plurality of sources, wherein each source is configured to collect telemetries related to at least one of the at least one cloud service, wherein the telemetries are out-of-path information with respect to traffic to and from the cloud-hosted application;
• developing a set of at least one rate-based and at least one rate-invariant features based on the collected telemetries;
• detecting, based on the collected telemetries and a learned normal utilization behavior for the cloud-hosted application, excessive utilization of at least one of the at least one cloud service by the cloud-hosted application, wherein the detecting further comprises evaluating each feature in the set of at least one rate-based and at least one rate-invariant features to determine whether a behavior of each feature and a behavior of the set of rate-based and rate-invariant features indicate the excessive utilization of at least one of the at least one cloud service;
• and
• causing mitigation, at the defense platform, of the excessive utilization of each cloud service upon detection of the excessive utilization of the at least one cloud service by the cloud-hosted application.

A system for protecting against excessive utilization of at least one cloud service for operation of a cloud-hosted application, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• receive, at a defense platform deployed out-of-path of traffic between a plurality of end user devices and the cloud-hosted application, telemetries from a plurality of sources, wherein each source is configured to collect telemetries related to at least one of the at least one cloud service, wherein the telemetries are out-of-path information with respect to traffic to and from the cloud-hosted application;
• develop a set of at least one rate-based and at least one rate-invariant features based on the collected telemetries;
• detect, based on the collected telemetries and a learned normal utilization behavior for the cloud-hosted application, excessive utilization of at least one of the at least one cloud service by the cloud-hosted application, the system being further configured to evaluate each feature in the set of at least one rate-based and at least one rate-invariant features to determine whether a behavior of each feature and a behavior of the set of rate-based and rate-invariant features indicate the excessive utilization of at least one of the at least one cloud service;
• and
• cause mitigation, at the defense platform, of the excessive utilization of each cloud service upon detection of the excessive utilization of the at least one cloud service by the cloud-hosted application.