# US 2025/0156207 A1 · Detecting anomalous behavior in a cloud computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0156207 A1 - Document ID: US20250156207A1 - Status: Published application - Kind: A1 - Application number: 18/509,287 - Filed: 2023-11-14 - Published: 2025-05-15 - Earliest claimed: 2023-11-14 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Ron KELLER; Idan HEN; Amit Magen MEDINA - Web page: https://patentgrep.com/patent/US20250156207A1 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Described herein are technologies related to analyzing behavioral data of an entity in a cloud computing environment and determining suitability of providing the behavioral data to a computer-executable model that is configured to identify anomalous behavior of the entity. The technologies described herein improve performance of computer-executable models that are configured to detect anomalous behavior in a cloud computing environment. ## Claims ### Claim 1 A computing system comprising: a processor; and memory storing instructions that, when executed by the processor, cause the processor to perform acts comprising: obtaining time-series data for a computer-executable entity that is being executed in a cloud computing environment, where the time-series data is based upon behavioral data for the entity, and further where the time-series data comprises: values assigned to time periods over a window of time, where a value assigned to a time period in the time periods is indicative of a number of processes that were executed by or on behalf of the computer-executable entity with respect to a feature during the time period that were not executed in any previous time period in the window of time; computing a metric value for the entity based upon the time-series data, where the metric value is indicative of suitability of the behavioral data for provision to a computer-executable model, and further where the computer-executable model is trained to identify anomalous behavior of the entity; and based upon the metric value, providing the behavioral data to the computer-executable model, where the computer-executable model generates an output based upon the behavioral data, and further where the output indicates whether the behavioral data is anomalous relative to previously observed behavior of the entity. ### Claim 2 (depends on 1) The computing system of claim 1, where the computer-executable entity is one of a virtual machine or a container. ### Claim 3 (depends on 1) The computing system of claim 1, where the feature comprises names processes that are executable by the computer-executable entity. ### Claim 4 (depends on 1) The computing system of claim 1, the acts further comprising: obtaining second time-series data for the computer-executable entity, where the second time-series data comprises: second values assigned to the time period over the window of time, where a second value assigned to the time period in the time periods is indicative of a number of second processes that were executed with respect to a second feature of the entity during the time period that were not executed in any previous time period during the window of time, where the metric value for the entity is computed based further upon the second time-series data. ### Claim 5 (depends on 1) The computing system of claim 1, where the behavioral data comprises: an identity of a process executed by the entity in a most recent time period; and a count value that indicates a number of times that the process was executed by the entity in the most recent time period. ### Claim 6 (depends on 1) The computing system of claim 1, the acts further comprising: comparing the metric value with a threshold, where the behavioral data is provided to the computer-executable model based upon the metric value being above the threshold. ### Claim 7 (depends on 1) The computing system of claim 1, where computing the metric value comprises: computing a confidence value for the feature, where the confidence value is indicative of a confidence that a next value for a next time period in the window of time is able to be accurately predicted, where the metric value is based upon the confidence value. ### Claim 8 (depends on 1) The computing system of claim 1, where computing the metric value comprises: computing a trend value for the time-series data based upon the values assigned to the time periods, where the metric value is based upon the trend value. ### Claim 9 (depends on 1) The computing system of claim 1, the acts further comprising: obtaining an importance value for the feature, where the importance value for the feature is based upon a weight assigned to the feature by the computer-executable model, and further where the metric is computed based upon the importance value. ### Claim 10 (depends on 1) The computing system of claim 1, the acts further comprising: computing a second metric value for the entity based upon the time-series data, where the second matric value is indicative of applicability of a second computer-executable model with respect to the behavioral data, and further where the second computer-executable model is trained to identify anomalous behavior of the entity; and based upon the second metric value, refraining from providing the behavioral data to the second computer-executable model. ### Claim 11 (depends on 1) The computing system of claim 1, where the entity comprises multiple virtual machines corresponding to a customer of the cloud computing system. ### Claim 12 A method for determining whether to provide data to a computer-executable model that is trained to identify anomalies in data corresponding to an entity that is executing in a cloud computing environment, the method comprising: obtaining time-series data for a feature of the entity, where the feature comprises multiple processes that are executable by the entity, and further where the time-series data comprises: values assigned to time periods within a time window, where a value in the values is representative of a number of processes in the processes that were executed by the entity a first time within the time window; computing a likelihood that a next value in the time-series data for a next time period following the time window is able to be correctly predicted, where the likelihood is computed based upon the values assigned to the time periods; providing the data corresponding to the entity to the computer-executable model based upon the likelihood, where the computer-executable model generates an output based upon the data, and further where an alert is transmitted to a computing device associated with the entity based upon the output of the computer-executable model. ### Claim 13 (depends on 12) The method of claim 12, where the alert indicates that the data corresponding to the entity includes an anomaly. ### Claim 14 (depends on 12) The method of claim 12, further comprising: computing a trend value based upon the values assigned to the time periods within the time window, where the data corresponding to the entity is provided to the computer-executable model based further upon the trend value. ### Claim 15 (depends on 12) The method of claim 12, where the computer-executable entity is a virtual machine executing in the cloud computing environment. ### Claim 16 (depends on 12) The method of claim 12, where the computer-executable entity is a container executing in the cloud computing environment. ### Claim 17 (depends on 12) The method of claim 12, further comprising: obtaining second time-series data for a second feature of the entity, where the second feature comprises second multiple processes that are executed by the entity, and further where the second time-series data comprises: second values assigned to the time periods within the time window, where a second value in the second values is representative of a second number of second processes in the multiple second processes that were executed by the entity a first time within the time window, where the data corresponding to the entity is provided to the computer-executable model based upon the second time-series data. ### Claim 18 (depends on 17) The method of claim 17, further comprising: computing a second likelihood that a next value in the second time-series data for the next time period following the time window is able to be correctly predicted, where the second likelihood is computed based upon the second values assigned to the time periods, and further where the data corresponding to the entity is provided to the computer-executable model based upon the second likelihood. ### Claim 19 (depends on 12) The method of claim 12, further comprising obtaining an importance value for the feature, where the importance value for the feature is indicative of a weight assigned to the feature by the computer-executable model, and further where the data corresponding to the entity is provided to the computer-executable model based upon the importance value. ### Claim 20 A computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform acts comprising: obtaining time-series data for a computer-executable entity that is being executed in a cloud computing environment, where the time-series data comprises: values assigned to time periods over a window of time, where a value assigned to a time period in the time periods is indicative of a number of processes that were executed with respect to a feature of the entity during the time period that were not executed in any previous time period in the window of time; computing a metric value for the entity based upon the time-series data, where the metric value is indicative of applicability of a computer-executable model with respect to data corresponding to the entity in a most recent period of time in the periods of time, and further where the computer-executable model is trained to identify anomalies in the data corresponding to the entity; and based upon the metric value, providing the data corresponding to the entity to the computer-executable model, where the computer-executable model generates an output that indicates whether the data includes an anomaly based upon the data corresponding to the entity.