###### Abstract  
Cloud platforms allow administrators or management applications with privileged accounts to remotely perform privileged operations for specific tasks, such as deleting virtual hosts. When privileged accounts are leaked and conduct dangerous privileged operations, severe security problems will appear on cloud platforms. To solve these problems, researchers focus on auditing privileged users' behaviors. However, it is difficult to automatically audit fine-grained privileged behaviors for graphical operating systems. Moreover, it is hard to prevent users from bypassing the audit system or to prevent hackers from attacking audit system. In this paper, we propose a Secure and Automatic Behavior Audit system named SA-UBA. It provides advanced deep learning models to automatically achieve fine-grained user behavior audits for graphical operating systems. Furthermore, it adopts cryptography-based account storage and sharing methods to securely manage privileged accounts. In particular, privileged accounts cannot be leaked even if SA-UBA is compromised by attackers. We built a threat model of a cloud platform to evaluate the security of the SA-UBA and conduct extensive experiments with SA-UBA in real scenarios. The results show SA-UBA introduces a small overhead on securely managing privileged accounts and accurately recognizes fine-grained user behaviors. usef behavior audit; privileged account management; cloud security +
Footnote †: journal: Applied  
the cloud platform that are difficult to identify accurately by the audit system; secondly, privileged users directly access the cloud platform bypassing the audit system when managing the privileged accounts themselves; finally, in the process of users accessing the cloud platform, attackers can invade the system and steal the password by parsing the application code and retrieving hard-coded credentials. To address the above security threats, several studies are auditing privileged user behaviors [5; 6; 7; 8] to prevent dangerous operations. They analyze privileged behaviors from RDP (Remote Desktop Protocol) videos [5; 6] or network traffic [7; 8]. However, it is difficult to automatically audit fine-grained privileged behaviors for graphical operating systems. Moreover, to prevent users from bypassing the audit system or tampering with the behavior logs, various privileged account management systems are proposed [9; 10; 11; 12; 13]. They are responsible for managing the remote desktop access of privileged accounts [10], privileged identities in enterprises [9], and database credentials for privileged accounts [11; 12; 13]. Although they achieve diversified management functionalities, they fail to consider preventing the leakage of privileged accounts when the privileged account management systems are compromised. In this paper, we propose a Securely and Automatically Privileged User Behavior Auditing for Cloud Platforms, named SA-UBA. It can automatically audit fine-grained user behaviors in graphical operating systems and securely manage privileged accounts. SA-UBA can audit privileged behaviors in a fine-grained way for graphical operating systems. It first collects operating images when the users access cloud resources and issue commands. After that, SA-UBA applies deep-learning-based text reading to extract text information from images. Particularly, we improved the deep learning models on processing text detection and recognition so that the complex background and small icons of graphical operating systems can be well handled. Finally, SA-UBA matches the extracted text information to specific user behaviors. Thus, SA-UBA can automatically achieve a fine-grained user behavior audit for graphical operating systems. To prevent users from bypassing the audit system or tampering with the behavior logs, SA-UBA introduces the account-password management module. It conducts resource access authentication for privileged accounts and achieves unified management.