Feature-agnostic behavior profile based anomaly detection

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause the one or more processors to:

• receive application log data for a cloud-based software service that provides access for at least two organizations having different corresponding users, wherein the software service comprises at least a user application executing in a software operating system;
• analyze the application log data to extract interaction characteristics corresponding to an entity in an organization, wherein the entity is either a resource or a user;
• group the extracted interaction characteristics into a first set of baseline low-variance interaction characteristics and a second set of other interaction characteristics;
• train one or more statistical models utilizing the first set of baseline low-variance interaction characteristics and the second set of other interaction characteristics to evaluate in app behavior of a first entity corresponding to the organization;
• generate an anomaly score based on the baseline behavior profile, the second set of other interaction characteristics and interaction characteristics with the software service by a second entity corresponding to the organization, wherein the baseline behavior profile comprises a user baseline behavior median (BBM), a user behavior variance median absolute deviation (MAD), and a user abnormal behavior median of abnormality (MoA).

A system comprising:

• a memory device;
• one or more hardware processors coupled with the memory device, the one or more hardware processors configurable to receive application log data for a cloud-based software service that provides access for at least two organizations having different corresponding users, wherein the software service comprises at least a user application executing in a software operating system, to analyze the application log data to extract interaction characteristics corresponding to an entity in an organization, wherein the entity is either a resource or a user, to group the extracted interaction characteristics into a first set of baseline low-variance interaction characteristics and a second set of other interaction characteristics to train one or more statistical models utilizing the first set of baseline low-variance interaction characteristics and the second set of other interaction characteristics to evaluate in-app behavior of a first entity corresponding to the organization, and to generate an anomaly score based on the baseline behavior profile, the second set of other interaction characteristics and interaction characteristics with the software service by a second entity corresponding to the organization, wherein the baseline behavior profile comprises a user baseline behavior median (BBM), a user behavior variance median absolute deviation (MAD), and a user abnormal behavior median of abnormality (MoA).