Back to results
US 12,008,222 B1Granted
Unsupervised detection of security incidents in a cloud environment
OwnerNitzan Niv, Gad Naorinventors
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods to implement a security platform providing cyberattack detection. The security platform may, with respect to a cloud compute environment, use audit log data that is associated with a particular domain of operational activity within the cloud compute environment. Based on a domain specific graph representative of factor data and dependencies between factor data, the security platform may determine a behavioral anomaly that is associated with a cyberattack.
Claims19
A method for detecting cyberattacks in a cloud compute environment, the method comprising:
- using one or more processors to perform:
- executing one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data;
- providing the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment;
- using the security platform to perform:
- determining, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
- determining, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
- determining, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack;
- and
- generating, based on the detection data, an alert indicative of the cyberattack.
6 more elements
A system for detecting cyberattacks in a cloud computing environment, the system comprising:
- a memory storing executable instructions;
- and
- one or more processors that execute the executable instructions to:
- execute one or more audit log services to collect event data generated by one or more services executing in the cloud compute environment to obtain audit log data;
- provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment;
- use the security platform to:
- determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
- determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
- determine, based on the domain specific probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack;
- and
- generate, based on the detection data, an alert indicative of the cyberattack.
8 more elements
One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause:
- the one or more processors to:
- execute one or more audit log services to collect event data generated by one or more services executing in a cloud compute environment to obtain audit log data;
- and
- provide the audit log data to a security platform executing in the cloud compute environment or another cloud compute environment;
- and
- the security platform to:
- determine, based on the audit log data, values for one or more observable factors, wherein the values indicate one or more counts associated with respective events in network traffic in the cloud compute environment, wherein a probabilistic graph has nodes and edges between the nodes, wherein the nodes correspond to factors including the one or more observable factors and one or more other factors, and the edges between the nodes represent probabilistic dependencies between the factors represented by the nodes;
- determine, based on the values for the one or more observable factors that indicate the one or more counts associated with the respective events in the network traffic in the cloud compute environment, one or more changes to state data associated with the one or more other factors in the probabilistic graph;
- determine, based on the probabilistic graph and the one or more changes to the state data associated with the one or more other factors in the probabilistic graph, detection data indicative of anomalous behavior associated with a cyberattack;
- and
- generate, based on the detection data, an alert indicative of the cyberattack.
8 more elements
Dependencies are inferred from the claim text.