Techniques for defending cloud platforms against cyber-attacks
AssigneeRadware, Ltd.
InventorsAmnon Lotem, Nissim Pariente
Life of this patent
Estimating the term…
Abstract
A method and system for protecting a cloud computing platform against cyber-attacks are provided. The method includes gathering cloud logs from a cloud computing platform; analyzing, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator; sequencing suspect indicators into attack sequences; scoring each of the attack sequences with an attack score, wherein each attack is scored using a scoring model; and alerting on each attack sequence having a score higher than a predefined threshold.
Claims34
A method for protecting a cloud computing platform against cyber-attacks, comprising:
- gathering cloud logs from a cloud computing platform;
- analyzing, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
- sequencing suspect indicators into attack sequences;
- scoring each of the attack sequences with an attack score, wherein each attack is scored using a scoring model;
- and
- alerting on each attack sequence having a score higher than a predefined threshold.
A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for cloud computing platform against cyber-attacks, the process comprising:
- gather cloud logs from a cloud computing platform;
- analyze, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
- sequence suspect indicators into attack sequences;
- score each of the attack sequences with an attack score, wherein each attack is scored using a scoring model;
- and
- alert on each attack sequence having a score higher than a predefined threshold.
A system for cloud computing platform against cyber-attacks, comprising:
- a processing system;
- and
- a memory, the memory containing instructions that, when executed by the processing system, configure the system to:
- gather cloud logs from a cloud computing platform;
- analyze, by a plurality of detectors, the cloud logs to detect at least one suspicious behavior, wherein each of the at least one suspicious behavior is identified by a suspect indicator;
- sequence suspect indicators into attack sequences;
- score each of the attack sequences with an attack score, wherein each attack is scored using a scoring model;
- and
- alert on each attack sequence having a score higher than a predefined threshold.
Dependencies are inferred from the claim text.