Data protection in a networked computing environment

A system for monitoring data traffic in a networked computing environment, comprising:

• a bus;
• a processor coupled to the bus;
• and
• a memory medium coupled to the bus, the memory medium comprising instructions to perform a method comprising:
• gathering data traffic characteristics associated with a cloud resource, wherein the gathering is consistent with a privacy agreement of a cloud provider;
• removing a subset of the gathered data traffic characteristics based on the gathered data traffic characteristics in the subset in accordance with a user configurable normal traffic criteria criterion;
• analyzing a remaining subset of the gathered data traffic characteristics to determine whether the remaining subset of the data traffic characteristics is indicative of unusual activity, based on one or more characteristics of the remaining subset of the data traffic characteristics, wherein the one or more characteristics are determined from information about a resource received from a cloud provider database, and the unusual activity is associated with a malicious activity;
• creating a list of cloud recourses suspected of the malicious activity based on the analyzing, wherein the list comprises an identifier of a suspected cloud resource and a points counter associated with the suspected cloud resource, wherein the points counter indicates a need to remediate the suspected cloud resource when the points counter exceeds a predefined threshold number of points;
• determining a probability that the suspected cloud resource is participating in the malicious activity, and assigning a predefined value associated with the malicious activity to the suspected cloud resource based on the determined probability and the malicious activity;
• increment the points counter by the predefined value, wherein the points counter is associated with the cloud resource and the predefined value is associated with the malicious activity;
• and
• performing a remediation action when the incremented points counter exceeds the predefined threshold number of points.

A computer program product for monitoring data traffic in a networked computing environment, the computer program product comprising a computer readable storage media device, and program instructions stored on the computer readable storage media device, to perform a method comprising:

• gathering characteristics associated with a cloud resource, wherein the gathering is consistent with a privacy agreement of a cloud provider;
• removing a subset of the gathered data traffic characteristics based on the gathered data traffic characteristics in the subset in accordance with a user configurable normal traffic criterion;
• analyzing a remaining subset of the gathered data traffic characteristics to determine whether the remaining subset of the data traffic characteristics is indicative of unusual activity, based on one or more characteristics of the remaining subset of the data traffic characteristics, wherein the one or more characteristics are determined from information about a resource received from a cloud provider database, and the unusual activity is associated with a malicious activity;
• creating a list of cloud recourses suspected of the malicious activity based on the analyzing, wherein the list comprises an identifier of a suspected cloud resource and a points counter associated with the suspected cloud resource, wherein the points counter indicates a need to remediate the suspected cloud resource when the points counter exceeds a predefined threshold number of points;
• determining a probability that the suspected cloud resource is participating in the malicious activity, and assigning a predefined value associated with the malicious activity to the suspected cloud resource based on the determined probability and the malicious activity;
• increment the points counter by the predefined value, wherein the points counter is associated with the cloud resource and the predefined value is associated with the malicious activity;
• and
• performing a remediation action when the points counter exceeds the predefined threshold number of points.