System and method for detecting directed cyber-attacks targeting a particular set of cloud based machines

A system for detecting a directed targeted attack by a first set of machines on a second set of machines, wherein the second set of machines are implemented in a cloud-based network of a service provider, the system comprising:

• a processor;
• a memory;
• and
• an application stored in the memory and including instructions, which are executable by the processor and that are configured to
• according to a first one or more parameters, group alerts for a first plurality of machines, wherein the first plurality of machines include the first set of machines, wherein each group of alerts corresponds to attacks performed by a respective one of the first plurality of machines, and wherein each of the alerts is indicative of a possible attack performed by one of the first plurality of machines on one or more cloud applications implemented by a second plurality of machines,
• according to a second one or more parameters, group metadata corresponding to the second plurality of machines implementing the cloud applications, wherein the second plurality of machines include the second set of machines,
• based on the group of metadata corresponding to the second set of machines, and one or more co-factors, evaluate one or more alerts corresponding to attacks performed by the first set of machines on the second set of machines relative to at least one of (i) alerts associated with attacks performed by the first set of machines on machines other than the second set of machines, or (ii) alerts associated with attacks performed by the first plurality of machines,
• while evaluating the one or more alerts, determining whether the second set of machines is more likely to be attacked than other ones of the second plurality of machines including determining whether at least one of (i) a higher probability exists that an attack on the second set of machines is to occur than an attack on the other ones of the second plurality of machines, or (ii) a number or level of attacks on the second set of machines is higher than a number or level of attacks on the other ones of the second plurality of machines, and
• alert a customer associated with the second set of machines of the directed targeted attack based on a result of the evaluation.

A non-transitory tangible computer readable medium storing instructions executable by a processor for detecting a directed targeted attack by a first machine on a second machine, wherein the second machine is implemented in a server computer, and wherein the server computer is implemented in a cloud-based network of a service provider, the instructions are for:

• according to a first one or more parameters, grouping alerts for a first plurality of machines, wherein the first plurality of machines include the first machine, wherein each group of alerts corresponds to attacks performed by a respective one of the first plurality of machines, and wherein each of the alerts is indicative of a possible attack performed by one of the first plurality of machines on one or more cloud applications implemented by a second plurality of machines;
• according to a second one or more parameters, grouping metadata corresponding to the second plurality of machines implementing the cloud applications, wherein the second plurality of machines include the second machine;
• based on the group of metadata corresponding to the second machine and one or more co-factors, evaluating one or more alerts corresponding to attacks performed by the first machine on the second machine relative to at least one of (i) alerts associated with attacks performed by the first machine on machines other than the second machine, or (ii) alerts associated with attacks performed by the first plurality of machines;
• while evaluating the one or more alerts, determining whether the second machine is more likely to be attacked than other ones of the second plurality of machines including determining whether at least one of (i) a higher probability exists that an attack on the second machine is to occur than an attack on the other ones of the second plurality of machines, or (ii) a number or level of attacks on the second machine is higher than a number or level of attacks on the other ones of the second plurality of machines;
• and
• alerting the second machine of the directed targeted attack based on a result of the evaluation.