Patent ID: 11930024
Assignee: ORACLE INTERNATIONAL CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 6:
7. A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
calculating a first vector that is representative of average counts of actions taken by a user during a sliding window of a plurality of previous time intervals in a cloud environment;
calculating a second vector by aggregating counts of actions taken by the user during a current time interval;
calculating a similarity between the first vector and a second vector;
comparing the similarity to a baseline threshold to determine whether the second vector diverges from the first vector by more than the baseline threshold amount;
based at least in part on a determination that the second vector diverges from the first vector by more than the baseline threshold amount, accessing an activity score for an action in the first vector;
comparing the activity score to a threshold to determine whether one or more anomalous actions have occurred; and
generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.