US 12,587,550 B2Granted

Detecting compromised cloud users

AssigneeMicrosoft Technology Licensing, LLC

InventorsEran Goldstein, Idan Hen, Shalom Shay Shavit

Life of this patent

Estimating the term…

Loading patent…

Abstract

Compromised user accounts are identified by detecting anomalous cloud activities. Cloud activities are determined to be anomalous by comparing the behavior of a particular user with the previous behavior of that user as well as the previous behavior of other, related users. In some configurations, the related users are organized into one or more hierarchies, such as by geographic location or by a logical structure of a cloud service. The behavior of the related users is modeled at different levels in the hierarchy. Anomaly scores from different groups and levels of the hierarchy are compiled and filtered before being used to determine whether to send a security alert. In some configurations, the security alert indicates that the anomalous operation was detected, why the operation was determined to be anomalous, and in some cases, what harm the operation could lead to if the user is in fact compromised.

Claims18

Dependent claims

A method comprising:

storing records of operations of a plurality of users;
organizing the plurality of users into a hierarchy of groups of users, wherein users of a lower-level group of users of the hierarchy of groups of users are also included in a higher-level group of users of the hierarchy of groups of users, and wherein the higher level group of users includes a set of users that are not in the lower-level group of users;
training a first machine learning model to generate anomaly scores from parameters of operations performed by the lower-level group of users;
training a second machine learning model to generate anomaly scores from parameters of operations performed by the higher-level group of users;
receiving a request to perform an operation from a user, wherein the user is included in the lower-level group of users and the higher-level group of users;
providing a parameter of the requested operation to the first machine learning model and the second machine learning model;
receiving a first anomaly score from the first machine learning model, wherein the first anomaly score exceeds a first anomaly score threshold;
receiving a second anomaly score from the second machine learning model, wherein the second anomaly score does not exceed a second anomaly score threshold;
determining that the requested operation is anomalous based on the first anomaly score exceeding the first anomaly score threshold and the second anomaly score not exceeding the second anomaly score threshold;
and
not allowing the requested operation to be performed even though it was deemed not anomalous for the higher-level group of users.

8 more elements

A device comprising:

one or more processors;
and
a computer-readable storage medium having encoded thereon computer-executable instructions that cause the one or more processors to:
store records of operations of a plurality of users;
organize the plurality of users into a hierarchy of groups of users, wherein users of a lower-level group of users of the hierarchy of groups of users are also included in a higher-level group of users of the hierarchy of groups of users, and wherein the higher-level group of users includes a set of users that are not in the lower-level group of users;
train a first machine learning model to generate anomaly scores from parameters of operations performed by the lower-level group of users;
train a second machine learning model to generate anomaly scores from parameters of operations performed by the higher-level group of users;
receive a request to perform an operation from a user, wherein the user is included in the lower-level group of users and the higher-level group of users;
provide a parameter of the requested operation to the first machine learning model and the second machine learning model;
receive a first anomaly score from the first machine learning model, wherein the first anomaly score does not exceed a first anomaly score threshold;
receive a second anomaly score from the second machine learning model, wherein the second anomaly score exceeds a second anomaly score threshold;
determine that the requested operation is not anomalous based on the first anomaly score not exceeding the first anomaly score threshold and the second anomaly score exceeding the second anomaly score threshold;
and
allow the requested operation to be performed even though it was deemed anomalous for the higher-level group of users.

11 more elements

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:

store records of operations of a plurality of users;
organize the plurality of users into a hierarchy of groups of users, wherein users of a lower-level group of users of the hierarchy of groups of users are also included in a higher-level group of users of the hierarchy of groups of users, and wherein the higher-level group of users includes a set of users that are not in the lower-level group of users;
train a first machine learning model to generate anomaly scores from parameters of operations performed by the lower-level group of users;
train a second machine learning model to generate anomaly scores from parameters of operations performed by the higher-level group of users;
receive a request to perform an operation from a user, wherein the user is included in the lower-level group of users and the higher-level group of users;
provide a parameter of the requested operation to the first machine learning model and the second machine learning model;
receive, from the first machine learning model, a first anomaly score, wherein the first anomaly score exceeds a first anomaly score threshold;
receive a second anomaly score from the second machine learning model, wherein the second anomaly score does not exceed a second anomaly score threshold;
determine that the requested operation is anomalous based on the second anomaly score not exceeding the second anomaly score threshold and the first anomaly score exceeding the first anomaly score threshold;
and
not allow the requested operation to be performed even though it was deemed not anomalous for the higher-level group of users.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/689,330Filed 8 Mar 2022 · us provisional application
Priority: 30 Dec 2021
Published: US 2023/0216871 A16 Jul 2023
Granted: 24 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic
H04L
Digital communication