Techniques for monitoring privileged users and detecting anomalous activities in a computing environment
AssigneeOracle International Corporation
InventorsGanesh Kirti, Kamalendu Biswas, Merenne Sumedha Nalin Perera
Life of this patent
Estimating the term…
Abstract
A computer system of a security management system may obtain activity data from a service provider system, where the activity data may describe actions performed by users during use of a cloud service. The security management system may then provide the activity data to a model that is trained to receive the activity data and classify privileged users from among the users that performed the actions in the activity data. Both supervised and unsupervised models may be used. The security management system may generate a list of privileged users of the service provider system based on output from the model.
Claims11
A computer-implemented method comprising, at a computer system of a security management system:
- receiving previous activity data from a service provider system, wherein the previous activity data comprises actions performed by users during use of a cloud service;
- training a model as either:
- a supervised-learning classification model when the actions in the previous activity data are labeled as privileged actions or non-privileged actions, and the model is trained using the actions and labels;
- or
- an unsupervised-learning model when the actions in the previous activity data are unlabeled, and the model is trained by identifying patterns of user activity and identifying clusters of users who perform privileged actions;
- obtaining activity data from the service provider system, wherein the activity data describes actions performed by users during use of the cloud service;
- providing the activity data to the model as an input to the model;
- processing the activity data with the model to generate output from the model that classifies users as privileged or nonprivileged based on the activity data;
- and
- generating a list of privileged users of the service provider system based on the output from the model.
A computing system of a security management system, comprising:
- one or more processors;
- and
- one or more memories comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving previous activity data from a service provider system, wherein the previous activity data comprises actions performed by users during use of a cloud service;
- training a model as either:
- a supervised-learning classification model when the actions in the previous activity data are labeled as privileged actions or non-privileged actions, and the model is trained using the actions and labels;
- or
- an unsupervised-learning model when the actions in the previous activity data are unlabeled, and the model is trained by identifying patterns of user activity and identifying clusters of users who perform privileged actions;
- obtaining activity data from the service provider system, wherein the activity data describes actions performed by users during use of the cloud service;
- providing the activity data to the model as an input to the model;
- processing the activity data with the model to generate output from the model that classifies users as privileged or nonprivileged based on the activity data;
- and
- generating a list of privileged users of the service provider system based on the output from the model.
A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a computing system of a security management system, cause the computing system of a security management system to perform operations comprising:
- receiving previous activity data from a service provider system, wherein the previous activity data comprises actions performed by users during use of a cloud service;
- training a model as either:
- a supervised-learning classification model when the actions in the previous activity data are labeled as privileged actions or non-privileged actions, and the model is trained using the actions and labels;
- or
- an unsupervised-learning model when the actions in the previous activity data are unlabeled, and the model is trained by identifying patterns of user activity and identifying clusters of users who perform privileged actions;
- obtaining activity data from the service provider system, wherein the activity data describes actions performed by users during use of the cloud service;
- providing the activity data to the model as an input to the model;
- processing the activity data with the model to generate output from the model that classifies users as privileged or nonprivileged based on the activity data;
- and
- generating a list of privileged users of the service provider system based on the output from the model.
Dependencies are inferred from the claim text.