US 11,888,870 B2Granted

Multitenant sharing anomaly cyberattack campaign detection

AssigneeMicrosoft Technology Licensing, LLC

InventorsYaakov Garyani, Moshe Israel, Hani Hana Neuvirth, Ely Abramovitch, Amir Keren, Timothy William Burrell

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments detect cyberattack campaigns against multiple cloud tenants by analyzing activity data to find sharing anomalies. Data that appears benign in a single tenant's activities may indicate an attack when the same or similar data is also found for additional tenants. Attack detection may depend on activity time frames, on how similar certain activities of different tenants are to one another, on how unusual it is for different tenants to share an activity, and on other factors. Sharing anomaly analysis may utilize hypergeometric probabilities or other statistical measures. Detection avoidance attempts using entity randomization are revealed and thwarted. Authorized vendors may be recognized, mooting anomalousness. Although data from multiple tenants is analyzed together for sharing anomalies while monitoring for attacks, tenant confidentiality and privacy are respected through technical and legal mechanisms. Mitigation is performed in response to an attack indication.

Claims20

Dependent claims

A computing system equipped for detecting a cybersecurity attack campaign against multiple customers of a service provider, the computing system comprising:

a digital memory;
a datasets search interface connectable to a first customer events dataset and to a second customer events dataset, the first customer events dataset representing activities that are ascribed to a first customer, the second customer events dataset representing activities that are ascribed to a second customer;
and
a processor in operable communication with the digital memory, the processor configured to enhance cybersecurity by performing cybersecurity attack campaign detection steps which include (a) identifying via at least the datasets search interface a shared activity subset of the datasets which represents a shared activity, the shared activity being an activity that is ascribed to each of the customers, (b) determining whether customers' sharing of the shared activity is anomalous, (c) characterizing the shared activity as an indicator of a campaign attack when the sharing is anomalous, and (d) characterizing the shared activity as a non-indicator when the sharing is not anomalous;
wherein the computing system resides in an environment having M customer events datasets which represent activities ascribed to M respective customers, the shared activity is an activity that is ascribed to exactly N of the M customers, N is an integer greater than one, and M is an integer greater than or equal to N;
the processor is configured to calculate a statistical measure based on at least N and M, and the processor is also configured to determine whether sharing of the shared activity is anomalous based at least in part on the calculated statistical measure;
and
wherein operation of the computing system reduces a security risk of overlooking an attack campaign whose footprint appears benign within any single customer's dataset.

5 more elements

A cybersecurity method, comprising:

electronically obtaining digital data that represents activities ascribed collectively to at least two customers of a service provider in an environment having M customer events datasets which represent activities ascribed to M respective customers;
computationally identifying, within the obtained data, a shared activity subset which represents a shared activity, the shared activity being an activity that is ascribed to exactly N of the customers, where N is an integer greater than one and M is an integer greater than or equal to N;
computationally determining that sharing of the shared activity among the customers is anomalous, the determining comprising calculating a statistical measure based on at least N and M, and determining that sharing of the shared activity is anomalous based at least in part on the calculated statistical measure;
and
treating the shared activity subset as an indicator of a cybersecurity attack campaign.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/493,060Filed 4 Oct 2021
Published: US 2023/0107335 A16 Apr 2023
Granted: 30 Jan 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic