# US 12,764,129 B2 · Security breach detection and mitigation in a cloud-based environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,129 B2 - Document ID: US12764129B2 - Status: Granted - Kind: B2 - Application number: 18/525,261 - Filed: 2023-11-30 - Published: 2025-06-05 - Granted: 2026-10-13 - Earliest claimed: 2023-11-30 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Rishi Kishore Verma; Shruti Verma - Web page: https://patentgrep.com/patent/US12764129B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems for security breach detection and mitigation in a cloud-based environment are provided herein. Event data associated with client devices of a cloud-based environment are provided as input to a trained artificial intelligence (AI) model. The event data indicates activities performed with respect to the client devices. One or more outputs of the AI model are obtained, the one or more outputs indicating activities, of the event data, that is indicative of a security breach, one or more security actions to be taken at the cloud-based environment in response to the activities, and for each of the one or more security actions, a level of confidence that a respective security action will mitigate the security breach. A security action having a level of confidence that satisfies a confidence criterion is determined. A set of operations to initiate the determined security action at the cloud-based environment is performed. ## Claims ### Claim 1 A method comprising: providing event data associated with a plurality of client devices of a cloud-based environment as input to a trained artificial intelligence (AI) model, wherein the event data indicates activities performed with respect to the plurality of client devices; obtaining one or more outputs of the trained AI model, the one or more outputs indicating: a set of activities, of the activities indicated by the event data, performed with respect to at least one of the plurality of client devices that is indicative of a security breach, a plurality of security actions to be taken at the cloud-based environment in response to the set of activities, and for each of the plurality of security actions, a level of confidence indicating a likelihood that a respective security action will successfully mitigate the security breach; selecting, among the plurality of security actions, a security action based on a comparison of the respective levels of confidence of the plurality of security actions; and performing a set of operations to initiate the security action at the cloud-based environment. ### Claim 2 (depends on 1) The method of claim 1, further comprising: providing indicator of compromise (IOC) data as input to the trained AI model with the provided event data, wherein the IOC data indicates one or more activities pertaining to one or more other security breaches of other cloud-based environments, wherein the at least one of the set of activities corresponds to the one or more activities indicated by the IOC data. ### Claim 3 (depends on 2) The method of claim 2, further comprising: updating the IOC data to include information pertaining to the set of activities that is indicative of the security breach. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of operations to initiate the determined security action comprise an operation associated with one or more of: transmitting a security alert to a computing system associated with a security authority associated with the determined security action; executing one or more instructions to prevent at least one of the one or more client devices from performing one or more operations for a particular time period; executing one or more instructions to prevent at least one of the one or more client devices from accessing a particular type of data; or executing one or more instructions to prevent at least one of the one or more client devices from communicating with another client device. ### Claim 5 (depends on 1) The method of claim 1, wherein performing the set of operations to initiate the security action at the cloud-based environment comprises: determining whether the level of confidence of the security action exceeds a threshold level of confidence; and responsive to determining that the level of confidence of the security action exceeds the threshold level of confidence, executing one or more instructions of a security action protocol associated with the security action. ### Claim 6 (depends on 5) The method of claim 5, further comprising: responsive to determining that the level of confidence of the security action does not exceed the threshold level of confidence, transmitting a security alert to a computing system associated with a security authority associated with the security action. ### Claim 7 (depends on 1) The method of claim 1, wherein the activities indicated by the event data comprise one or more of processing activities, data access activities, or network-based activities performed with respect to at least one client device of the plurality of client devices. ### Claim 8 A system comprising: a memory; and a processing device coupled to the memory, the processing device to perform operations comprising: generating training data for an AI model, wherein generating the training data comprises: generating a training input comprising historical event data indicating one or more historical activities performed with respect to at least one of a plurality of client devices of a cloud-based environment; and generating a target output comprising: an indication of whether the one or more historical activities of the client devices were previously indicated by a security authority to be indicative of a historical security breach and, for the one or more historical activities, a corresponding mapping to one or more historical security actions initiated by the security authority at the cloud-based environment in response to the historical activity to mitigate the historical security breach; and providing the training data to train the AI model to predict activities performed with respect to the plurality of client devices that are indicative of a security breach and one or more security actions to mitigate the security breach, wherein the training data comprises (i) a set of training inputs comprising the training input and (ii) a set of target outputs comprising the target output. ### Claim 9 (depends on 8) The system of claim 8, wherein the one or more historical activities comprise one or more of historical processing activities, historical data access activities, or historical network-based activities performed with respect to at least one client device of the plurality of client devices. ### Claim 10 (depends on 8) The system of claim 8, wherein the one or more historical security actions comprise at least one of: executing one or more instructions to prevent at least one of the plurality of client devices from performing one or more operations for a particular time period; executing one or more instructions to prevent at least one of the plurality of client devices from accessing a particular type of data; or executing one or more instructions to prevent at least one of the plurality of client devices from communicating with another client device. ### Claim 11 (depends on 8) The system of claim 8, wherein at least one of the training input or the target output is further generated based on one or more of security rule data associated with a user of the plurality of client devices or indicator of compromise data collected for the cloud-based environment or another cloud-based environment. ### Claim 12 (depends on 8) The system of claim 8, wherein the operations further comprise: identifying a security log comprising an indication of historical activities previously initiated by the security authority in response to the one or more historical activities of the client devices; and extracting the one or more historical activities from the identified security log. ### Claim 13 (depends on 12) The system of claim 12, wherein the AI model is associated with a platform, and wherein the security log is associated with at least one of the platform or another platform. ### Claim 14 A non-transitory computer readable storage medium comprising instructions for a server that, when executed by a processing device, cause the processing device to perform operations comprising: providing event data associated with a plurality of client devices of a cloud-based environment as input to a trained artificial intelligence (AI) model, wherein the event data indicates activities performed with respect to the plurality of client devices; obtaining one or more outputs of the trained AI model, the one or more outputs indicating: a set of activities, of the activities indicated by the event data, performed with respect to at least one of the plurality of client devices that is indicative of a security breach, a plurality of security actions to be taken at the cloud-based environment in response to the set of activities, and for each of the plurality of security actions, a level of confidence indicating a likelihood that a respective security action will successfully mitigate the security breach; selecting, among the plurality of security actions, a security action based on a comparison of the respective levels of confidence of the plurality of security actions; and performing a set of operations to initiate the security action at the cloud-based environment. ### Claim 15 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein the operations further comprise: providing indicator of compromise (IOC) data as input to the trained AI model with the provided event data, wherein the IOC data indicates one or more activities pertaining to one or more other security breaches of other cloud-based environments, wherein the at least one of the set of activities corresponds to the one or more activities indicated by the IOC data. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the operations further comprise: updating the IOC data to include information pertaining to the set of activities that is indicative of the security breach. ### Claim 17 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein the set of operations to initiate the determined security action comprise an operation associated with one or more of: transmitting a security alert to a computing system associated with a security authority associated with the determined security action; executing one or more instructions to prevent at least one of the one or more client devices from performing one or more operations for a particular time period; executing one or more instructions to prevent at least one of the one or more client devices from accessing a particular type of data; or executing one or more instructions to prevent at least one of the one or more client devices from communicating with another client device. ### Claim 18 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein performing the set of operations to initiate the security action at the cloud-based environment comprises: determining whether the level of confidence of the security action exceeds a threshold level of confidence; responsive to determining that the level of confidence of the security action exceeds the threshold level of confidence, executing one or more instructions of a security action protocol associated with the security action. ### Claim 19 (depends on 18) The non-transitory computer readable storage medium of claim 18, wherein the operations further comprise: responsive to determining that the level of confidence of the security action does not exceed the threshold level of confidence, transmitting a security alert to a computing system associated with a security authority associated with the security action. ### Claim 20 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein the activities indicated by the event data comprise one or more of processing activities, data access activities, or network-based activities performed with respect to at least one client device of the plurality of client devices.