US 2026/0100965 A1 · CONTEXT-BASED THREAT DETECTION

Abstract

A system and methods are disclosed for personalized threat detection. The method includes identifying in an event log of a cloud environment, a set of log records matching a simulated attack path of a plurality of simulated attack paths that are applicable to the cloud environment by security analytics platform. Each simulated attack path of the plurality of simulated attack paths comprises a respective plurality of expected operations to be performed in order to gain unauthorized access to a resource of a plurality of resources of the cloud environment. Responsive to identifying the set of log records matching the simulated attack path, the method notifies an entity associated with the cloud environment of an attack on the resource of the cloud environment.

Claims20

Dependent claims

A method comprising:

identifying, by a processing device of a security analytics platform, in an event log of a cloud environment, a set of log records matching a simulated attack path of a plurality of simulated attack paths that are applicable to the cloud environment, wherein each simulated attack path of the plurality of simulated attack paths comprises a respective plurality of expected operations to be performed in order to gain unauthorized access to a resource of a plurality of resources of the cloud environment;
and
responsive to identifying the set of log records matching the simulated attack path, notifying an entity associated with the cloud environment of an attack on the resource of the cloud environment.

A system, comprising:

a memory device, coupled to the memory, configured to perform operations comprising:
identifying in an event log of a cloud environment, a set of log records matching a simulated attack path of a plurality of simulated attack paths that are applicable to the cloud environment, wherein each simulated attack path of the plurality of simulated attack paths comprises a respective plurality of expected operations to be performed in order to gain unauthorized access to a resource of a plurality of resources of the cloud environment;
and
responsive to identifying the set of log records matching the simulated attack path, notifying an entity associated with the cloud environment of an attack on the resource of the cloud environment.

1 more element

A non-transitory computer-readable medium comprising instructions that, responsive to execution by a processing device, cause the processing device to perform operations comprising:

identifying in an event log of a cloud environment, a set of log records matching a simulated attack path of a plurality of simulated attack paths that are applicable to the cloud environment, wherein each simulated attack path of the plurality of simulated attack paths comprises a respective plurality of expected operations to be performed in order to gain unauthorized access to a resource of a plurality of resources of the cloud environment;
and
responsive to identifying the set of log records matching the simulated attack path, notifying an entity associated with the cloud environment of an attack on the resource of the cloud environment.

Dependencies are inferred from the claim text.

Context-based threat detection

Life of this patent

Context-based threat detection

Life of this patent

Abstract

Claims20