Patent Description:
To use a cloud, a customer typically purchases a subscription to use the services of the cloud. When purchasing a subscription, a customer may provide billing information and be provided an account that is accessible using logon information such as a user name and password. To encourage users to become customers, a cloud provider may offer various incentives that allow the users to subscribe and use the cloud for a limited time. Once logged on, a customer can then use the servers of the cloud to execute computer programs such as for hosting websites, performing accounting functions, performing data analyses, and so on. A cloud may use various billing models such as a model based on amount of core usage, memory usage, and other resource usage.

Cloud computing systems, like other computer systems, are susceptible to cyber-attacks. These cyber-attacks may include viruses, worms, denial-of-service attacks, and so on. Cloud computing systems are also susceptible to fraudulent use of resources resulting from exploitation of a vulnerability in the sign-up process of the cloud. For example, a cloud may offer free <NUM>-day subscriptions to new customers. As part of the sign-up process, the user may be provided with a Completely Automated Public Turing test to tell Computer and Humans Apart ("CAPTCHA"). If the user discovers a vulnerability in the sign-up process that allows the user to bypass or always pass the CAPTCHA, that user may be able to develop a computer program to create hundreds and thousands of new, but unauthorized, subscriptions. As another example, a user may have access to valid, but stolen, credit card numbers. Such a user can create hundreds of subscriptions using the stolen credit card numbers before the theft is identified. Such unauthorized users can then use the cloud computer resources at such a high rate that there are insufficient resources left to service the needs of authorized users. To help lessen the impact of such unauthorized and fraudulent uses, a cloud may be designed with a certain amount of capacity that is in excess of what is needed to support authorized users. The cost of purchasing and maintaining such excess capacity can be high. Due to the high cost of mitigating unauthorized and fraudulent users of a cloud, efforts are ongoing to identify and eradicate unauthorized and fraudulent users of the cloud.

It is with respect to these considerations and others that the disclosure made herein is presented. <CIT> relates to systems and methods for dynamically learning network environments to achieve adaptive security. A method for setting an adaptive threshold for a node includes: monitoring a data stream associated with the node to identify a characteristic of the node; monitoring an environmental factor capable of affecting the node; and determining the adaptive threshold based on at least one of the characteristic or the environmental factor. <NPL>) relates to Fraudulent Resource Consumption (FRC) attacks and the applicability of application-layer Distributed Denial-of-Service detection schemes to more subtle attacks. Metrics that together form the criteria for identifying a FRC attack from that of normal web activity are proposed.

According to aspects of the present invention there is provided a system and a computer-implemented method as defined in the accompanying claims.

Techniques described herein relate to cloud computing system (also referred to as a "cloud") threshold based fraud management. In some implementations, the cloud computing system may include a plurality of data centers (also referred to herein as "resources"), that offer computing resources for a plurality of authorized users or cloud subscribers. The cloud computing system may offer these computing resources at a very low cost on an attractive pay-as-you-go model. However, the resources of the cloud computing system may be compromised due to unauthorized and fraudulent users or subscribers of the cloud computing system. Specifically, unauthorized and fraudulent subscribers of resources associated with the cloud computing system may increase the cost of maintaining such resources. Furthermore, unauthorized and fraudulent subscribers of resources associated with the cloud computing system may compromise the underlying resources of the system in a manner that reduces the operational efficiency of those resources. Such a reduction in the operational efficiency of cloud computing system resources may compromise authorized use of the cloud computing system.

Unauthorized and fraudulent use of a cloud computing system, according to some implementations, may be reduced or mitigated with greater efficiency using a multi-threshold based method to identify fraudulent subscribers of the cloud. In some implementations, the cloud may include a plurality of resources. The multi-threshold based method may assign a fraud threshold to each resource of the plurality of resources. Each of the fraud thresholds assigned to the plurality of resources may be linked to a key performance indicator (KPI). In some implementations, the KPI may require the multi-threshold based method to identify a predetermined percentage of the unauthorized and fraudulent subscribers in the cloud computing system while ensuring that erroneously identified unauthorized and fraudulent subscribers does not exceed a predetermined percentage. Each of the indicated predetermined percentages may change over time. In various implementations, the fraud thresholds of the multi-threshold based method may be adjusted based on one or more characteristics associated with one or more of the plurality of resources in the cloud. The one or more characteristics may include capacity percentage associated with the plurality of resources, fraud distribution among the plurality of resources, cost of operation associated with the plurality of resources, anticipated or actual subscriber growth rate associated with the plurality of resources and/or anticipated or actual subscriber fraud risk associated with the plurality of resources.

In some implementations, the threshold based fraud management techniques establish a fraud threshold for each resource in a cloud computing system. Furthermore, the fraud management techniques may assign a fraud score to each subscriber of the cloud computing system. The fraud score associated with each of the subscribers may be a value calculated based on one or more usage features associated with the cloud. In some implementations, the fraud score associated with each of the subscribers is a value that indicates a statistical probability that a subscriber is an unauthorized or fraudulent user of the cloud. In some implementations, subscribers of the cloud computing system may be assigned to a first resource of a plurality of resources associated with the cloud computing system, while other subscribers of the cloud may be assigned to a second resource of the plurality of resources. The cloud computing system may compare the fraud scores associated with the subscribers of the first resource against the fraud threshold of the first resource to identify fraudulent subscribers of the first resource, while the cloud may compare the fraud scores associated with the subscribers of the second resource against the fraud threshold of the second resource to identify fraudulent users of the second resource.

In some implementations, a cloud computing system may adjust one or more of the fraud thresholds associated with a plurality of resources of the cloud based on one or more characteristics associated with one or more of the plurality of resources. The one or more characteristics may include capacity percentage associated with the plurality of resources, fraud distribution among the plurality of resources, cost of operation associated with the plurality of resources, anticipated or actual subscriber growth rate associated with the plurality of resources and/or anticipated or actual subscriber fraud risk associated with the plurality of resources. In some implementations, it may be desirable to adjust the one or more of the fraud thresholds in a manner that ensures that a KPI linked to the entire cloud computing system is maintained or achieved.

In some implementations, a system is provided for managing subscriber fraud associated with a computing system. The computing system may include at least one processor. The system may further include at least one memory in communication with the at least one processor, the at least one memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to identify a first resource in the computing system, the first resource having a first plurality of subscribers linked thereto. Additionally, the computer-readable instructions may cause the at least one processor to identify a second resource in the computing system, the second resource having a second plurality of subscribers linked thereto, assign a first fraud threshold to the first resource in the computing system, and assign a second fraud threshold to the second resource in the computing system. Furthermore, the computer-readable instructions may cause the at least one processor to adjust at least one of the first and second fraud thresholds based on a characteristic associated with at least one of the first and second resources in the computing system, and suspend or terminate at least one subscriber associated with the computing system based on the adjusted at least one of the first and second fraud thresholds.

In some implementations, a computer-implemented method is provided for managing fraudulent use of a cloud computing system. The method may include assigning a first fraud threshold to a first data center associated with a cloud computing system, and assigning a second fraud threshold to second data center associated with the cloud computing system. Furthermore, the method may include adjusting at least one of the first and second fraud thresholds based on a characteristic associated with at least one of the first and second data centers associated with the cloud computing system, and suspending or terminating at least one subscriber associated with the cloud computing system based on the adjusted at least one of the first and second fraud thresholds.

In some implementations, a computer-readable storage medium is provided having computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the one or more processors of the computing device to manage fraudulent use of a cloud computing system. Managing fraudulent use of the cloud computing system may include assigning a first fraud threshold to a first resource in a cloud computing system, and assigning a second fraud threshold to a second resource in the cloud computing system. Furthermore, managing fraudulent use of the cloud computing system may include adjusting the first and second fraud thresholds based on a characteristic associated with at least one of the first and second resources in the cloud computing system, and suspending or terminating at least one subscriber associated with the computing system based on the adjusted at least one of the first and second fraud thresholds.

It should be appreciated that, although described in relation to a system, the above-described subject matter may also be implemented as a computer-controlled apparatus, a computer process, a computing system, or as an article of manufacture such as a computer-readable medium and/or dedicated chipset. Among many other benefits, the techniques herein improve efficiencies with respect to a wide range of computing resources. For instance, operations can be performed on two or more values, e.g., summing, multiplying or otherwise to perform a number of complex tasks, such as facial recognition, object recognition, image generation, classification detection, etc..

These and various other features will be apparent from a reading of the following Detailed Description and a review of the associated drawings.

This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended that this Summary be used to limit the scope of the claimed subject matter.

Techniques described herein relate to cloud computing system (also referred to as a cloud) threshold based fraud management. In some implementations, the cloud computing system may include a plurality of data centers (also referred to as resources) herein, that offer computing resources for a plurality of authorized users or cloud subscribers. The cloud computing system may offer these computing resources at a very low cost on an attractive pay-as-you-go model. However, the resources of the cloud computing system may be compromised due to unauthorized and fraudulent users or subscribers of the cloud computing system. Specifically, unauthorized and fraudulent subscribers of resources associated with the cloud computing system may increase the cost of maintaining such resources. Furthermore, unauthorized and fraudulent subscribers of resources associated with the cloud computing system may compromise the underlying resources of the system in a manner that reduces the operational efficiency of those resources. Such a reduction in the operational efficiency of cloud computing system resources may compromise authorized use of the cloud computing system.

Unauthorized and fraudulent use of a cloud computing system, according to some implementations, may be reduced or mitigated with greater efficiency using a multi-threshold based method to identify fraudulent subscribers of the cloud. In some implementations, the cloud may include a plurality of resources. The multi-threshold based method may assign a fraud threshold to each resource of the plurality of resources. Each of the fraud thresholds assigned to the plurality of resources may be linked to a key performance indicator (KPI). In some implementations, the KPI may require the multi-threshold based method to identify a predetermined percentage of the unauthorized and fraudulent subscribers in the cloud computing system while ensuring that erroneously identified unauthorized and fraudulent subscribers do not exceed a predetermined percentage. Each of the indicated predetermined percentages may change over time. In various implementations, the fraud thresholds of the multi-threshold based method may be adjusted based on one or more characteristics associated with one or more of the plurality of resources in the cloud. The one or more characteristics may include capacity percentage associated with the plurality of resources, fraud distribution among the plurality of resources, cost of operation associated with the plurality of resources, anticipated or actual subscriber growth rate associated with the plurality of resources and/or anticipated or actual subscriber fraud risk associated with the plurality of resources.

In some implementations, the fraud threshold based fraud management techniques establish a fraud threshold for each resource in a cloud computing system. Furthermore, the fraud management techniques may assign a fraud score to each subscriber of the cloud computing system. The fraud score associated with each of the subscribers may be a value calculated based on one or more usage features associated with the cloud. In some implementations, the fraud score associated with each of the subscribers is a value that indicates a statistical probability that a subscriber is an unauthorized or fraudulent user of the cloud. In some implementations, subscribers of the cloud computing system may be assigned to a first resource of a plurality of resources associated with the cloud computing system, while other subscribers of the cloud may be assigned to a second resource of the plurality of resources. The cloud computing system may compare the fraud scores associated with the subscribers of the first resource against the fraud threshold of the first resource to identify fraudulent subscribers of the first resource, while the cloud may compare the fraud scores associated with the subscribers of the second resource against the fraud threshold of the second resource to identify fraudulent users of the second resource.

In some implementations, a computer-implemented method is provided for managing fraudulent use of a cloud computing system. The method may include assigning a first fraud threshold to a first data center associated with a cloud computing system, and assigning a second fraud threshold to a second data center associated with the cloud computing system. Furthermore, the method may include adjusting at least one of the first and second fraud thresholds based on a characteristic associated with at least one of the first and second data centers associated with the cloud computing system, and suspending or terminating at least one subscriber associated with the cloud computing system based on the adjusted at least one of the first and second fraud thresholds.

In some implementations, a computer-readable storage medium is provided having computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the one or more processors of the computing device to manage fraudulent use of a cloud computing system. Managing fraudulent use of the cloud computing system may include assigning a first fraud threshold to a first resource in a cloud computing system, and assigning a second fraud threshold to the second resource in the cloud computing system. Furthermore, managing fraudulent use of the cloud computing system may include adjusting the first and second fraud thresholds based on a characteristic associated with at least one of the first and second resources in the cloud computing system, and suspending or terminating at least one subscriber associated with the computing system based on the adjusted at least one of the first and second fraud thresholds.

<FIG> illustrates an exemplary a cloud computing system <NUM>. The cloud computing system <NUM> may be any suitable arrangement of resources, operated by a cloud operator, for execution of software applications on behalf of subscribers of the cloud computing system <NUM>. A cloud operator may be any suitable entity or collection of entities responsible for the cloud computing system <NUM>. The subscribers of the cloud computing system <NUM> may similarly be any suitable entity or collection of entities responsible for a software application to be executed by the cloud computing system <NUM>. For example, either or both of the cloud operator and the subscribers may be a human, a collection of humans, a commercial or non-commercial organization, a collection of commercial or non-commercial organizations, or any other suitable entity.

As illustrated in <FIG>, the cloud computing system <NUM> includes various elements, including a resource allocator <NUM> and resources <NUM>. The resource allocator <NUM> acts on behalf of the cloud operator to manage allocation of the resources <NUM> for execution of one or more software applications <NUM>. The software applications <NUM> are executed by allocated resources of the cloud computing system <NUM> on behalf of subscribers of the cloud computing system <NUM>. The resources <NUM> that may be allocated to software applications <NUM> include any suitable types of resources, including hardware resources, like processing resources <NUM>, networking resources <NUM>, information storage resources <NUM>, and software resources like software <NUM>. The processing resources <NUM> may include hardware processors (e.g., microprocessors). The networking resources <NUM> may include any suitable networking hardware, including input/output hardware like network interface cards (NICs) and transmission hardware like routers, hubs, switches, etc., and networking cable for conveying information that have properties. The networking resources <NUM> may include resources for use by software application(s) <NUM> as well as networking resources connecting other resources <NUM> via any suitable local, wide-area, and/or enterprise communication network. The information storage resources <NUM> may include any suitable devices or media on which information may be encoded. The software resources <NUM> may include copies of software that may be used by one or more software applications <NUM> and/or by the cloud computing system <NUM> while executing the software application(s) <NUM>, as well as any suitable licenses for such software. In some implementations, the resources <NUM> are data centers associated with the cloud computing system <NUM>. As will be described in further detail herein, such data centers may include a plurality of components that include processing cores, computing storage, sockets, node enclosures, racks, containers and virtual machines. Furthermore, each of the resources <NUM> may be located in a different geographic area. For example, one of the resources <NUM> may be located in Europe, another the resources <NUM> may be located in the United States, and so on. Users or subscribers of the cloud computing system <NUM> may access the resources <NUM> using, for example, a computing device, such as one of the computing devices 116A-116D. In some implementations, users or subscribers of the cloud computing system <NUM> may have access to just one of the resources <NUM> of the cloud <NUM>. In other implementations, users or subscribers of the cloud computing system <NUM> may have access to a plurality of the resources <NUM> of the cloud <NUM>.

While not illustrated in <FIG>, the resources <NUM> may also include any suitable utility resources associated with other resources <NUM> of the cloud computing system <NUM>. For example, the resources <NUM> may further include utility resources such as energy resources like electricity. As another example, the resources <NUM> may further include supporting resources like an air supply for cooling other resources (e.g., a cooling system for a processing resource <NUM>). Any suitable resources may be included as the resources <NUM> of the cloud computing system <NUM>.

The resources <NUM> may be allocated by the resource allocator <NUM> in any suitable manner. In some implementations, the resources <NUM> may be allocated as virtual machines or using any other conventional approach that uses virtualization.

The software applications <NUM> may include any suitable type of application. One type of application is a batch application, which performs predefined processing within a specified period of time. Another type of application is a user-interactive application. User-interactive applications are those applications that interact with a user and include functionality to perform user operations requested by the users, such as subscribers of the cloud computing system <NUM>. This may be any suitable type of functionality or user operations, as implementations described herein are not limited in this respect. Users of the software applications <NUM> may operate user computing devices, such as the user computing devices 116A, 116B, 116C and 116D to exchange information with the cloud computing system <NUM> and with the software applications <NUM> executing on the cloud computing system <NUM>. The exchanged information may be, for example, requests for information sent by the user computing devices 116A, 116B, 116C and 116D, and responses to the requests sent by the cloud computing system <NUM>. The user computing devices 116A, 116B, 116C and 116D may exchange information with the cloud computing system <NUM> via a communication network <NUM>, which may be any suitable one or more wired and/or wireless networks, including the Internet.

When the cloud computing system <NUM> is executing software applications <NUM>, some of the resources <NUM> of the cloud computing system <NUM> are allocated to each software application of the applications <NUM>. When resources <NUM> are allocated to the software application <NUM>, the resources <NUM> may execute instructions of the software application <NUM>, store information managed by the software application <NUM>, or perform any other functionality of hardware related to executing the software application <NUM>. For example, as part of executing the software application <NUM>, the resources <NUM> may receive a request for information from a user computing device 116A, process the request, retrieve the requested information, process the requested information, and respond to the user computing device 116A with the requested information.

The cloud computing system <NUM> may also include a fraud detection manager <NUM>. The fraud detection manager <NUM> may operate autonomously within the cloud computing system <NUM>. In other implementations, the fraud detection manager <NUM> is caused to operate by way of one or more fraud detection experts <NUM> associated with the cloud computing system <NUM>.

The fraud detection manager <NUM> is functional to detect fraudulent or unauthorized subscriber use of one or more of the resources <NUM> in the cloud computing system <NUM>. For example, high or exceptionally high use of one or more of the resources <NUM> by one or more subscribers may be an indicator of fraudulent or unauthorized subscriber use of the cloud computing system <NUM>. There may be other indicators of fraudulent or unauthorized subscriber use of the cloud computing system <NUM>. The fraud detection manager <NUM> is able to analyze such indicators and provide recourse if it is determined that one or more subscribers of the cloud computing system <NUM> is perpetrating fraudulent behavior. Such recourse may include suspending or terminating subscribers that are determined to be fraudulent or unauthorized subscribers of the cloud computing system <NUM>.

The fraud detection manager <NUM> includes a number of tools, such as subscriber fraud scores <NUM> and resource fraud thresholds <NUM>, that enable the fraud detection manager <NUM> to detect fraudulent or unauthorized subscriber use of one or more of the resources <NUM> in the cloud computing system <NUM>. In that regard, in some implementations, the fraud detection manager <NUM> determines and/or assigns a fraud score (e.g., S1) to each subscriber (e.g., Sub1) of the cloud computing system <NUM>. Furthermore, the fraud detection manager <NUM> may assign a fraud threshold (e.g., Thres1) to each of the resources <NUM> (e.g., R1) in the cloud computing system <NUM>.

The fraud detection manager <NUM> is functional to compare fraud scores of subscribers linked to a particular resource <NUM> of the cloud computing system <NUM> against the fraud threshold assigned to that resource <NUM>. If a subscriber of the resource <NUM> is found to have a fraud score that is greater than the fraud threshold assigned to the resource <NUM>, the fraud detection manager <NUM> may take action to suspend or terminate the suspected fraudulent subscriber's use of the cloud computing system <NUM>.

The fraud score associated with each of the subscribers may be a value calculated based on one or more subscriber usage features associated with the cloud computing system <NUM>. In some implementations, the fraud score associated with each of the subscribers is a value that indicates a statistical probability that a subscriber is an unauthorized or fraudulent user of the cloud computing system <NUM>. For example, a fraud score may be a value greater than or equal to <NUM> and less than or equal to <NUM>. A fraud score that is approaching <NUM> indicates that a subscriber is very unlikely to be a fraudulent user of the cloud computing system <NUM>, while a fraud score approaching <NUM> indicates that a subscriber is very likely to be a fraudulent user of the cloud computing system <NUM>.

Similarly, each of the fraud thresholds linked to the resources <NUM> may be a value greater than or equal to <NUM> and less than or equal to <NUM>. Therefore, assuming a fraud score value format as described in the foregoing, a resource <NUM> of the cloud computing system <NUM> that has an assigned fraud threshold that is approaching <NUM> indicates that the resource <NUM> has a low tolerance for subscribers that are suspected to be fraudulent or unauthorized users of the cloud computing system <NUM>, while an assigned fraud threshold that is approaching <NUM> indicates that the resource <NUM> has a high tolerance for subscribers that are suspected to be fraudulent or unauthorized users of the cloud computing system <NUM>.

In some implementations, subscribers of the cloud computing system <NUM> may be assigned to a first resource of the resources <NUM> associated with the cloud computing system <NUM>, while other subscribers of the cloud computing system <NUM> may be assigned to a second resource of the resources <NUM>, and so on. The cloud computing system <NUM> may compare the fraud scores associated with the subscribers of the first resource against the fraud threshold of the first resource to identify fraudulent subscribers of the first resource, while the cloud computing system <NUM> may compare the fraud scores associated with the subscribers of the second resource against the fraud threshold of the second resource to identify fraudulent users of the second resource.

In some implementations, the cloud computing system <NUM> may adjust one or more of the thresholds associated with the resources <NUM> based on one or more characteristics associated with one or more of the resources <NUM>. The one or more characteristics may include capacity percentage associated with the resources <NUM>, fraud distribution among the resources <NUM>, cost of operation associated with the resources <NUM>, anticipated or actual subscriber growth rate associated with the resources <NUM> and/or anticipated or actual subscriber fraud risk associated with the resources <NUM>. In some implementations, it may be desirable to adjust the one or more of the thresholds in a manner that ensures that a KPI linked to the entire cloud computing system <NUM> is maintained or achieved.

<FIG> illustrates an exemplary view of the cloud computing system <NUM> from <FIG>. The exemplary view of the cloud computing system <NUM> in <FIG> omits, for clarity, a number of components associated with the cloud computing system <NUM> illustrated in <FIG>.

The illustrated first resource <NUM> may include a plurality of components that include processing cores, computing storage, sockets, node enclosures, racks, containers and virtual machines. Consumption of a plurality of components by subscribers of the first resource <NUM> may increase the overall used capacity associated with the first resource <NUM>. Specifically, as processing cores, computing storage, sockets, node enclosures, and so forth, are used by the subscribers of the first resource <NUM>, the percentage of used capacity associated with the first resource <NUM> increases. The foregoing also applies to the second resource <NUM>.

The illustrated example of the cloud computing system <NUM> of <FIG> shows that the first resource <NUM> has a used capacity of <NUM>%, and that the second resource <NUM> has a used capacity of <NUM>%. The fraud detection manager <NUM> may manage a fraud threshold <NUM> associated with the first resource <NUM>. Furthermore, the fraud detection manager <NUM> may manage a fraud threshold <NUM> associated with the second resource <NUM>. In some implementations, the fraud detection manager <NUM> manages at least one of the fraud thresholds <NUM> and <NUM> based on usage capacity associated with the first resource <NUM> and/or the second resource <NUM>. For example, the fraud detection manager <NUM> may set the fraud threshold <NUM> to a lower threshold value compared to the fraud threshold <NUM> because the used capacity of the first resource <NUM> is greater than or significantly greater than the used capacity of the second resource <NUM>. Furthermore, in some implementations, the fraud detection manager <NUM> may correspondingly increase the fraud threshold <NUM> to a higher threshold value to balance the lowering of the fraud threshold <NUM>.

As described herein, when a subscriber of a particular resource <NUM> is found to have a fraud score that is greater than the fraud threshold assigned to the resource <NUM>, the fraud detection manager <NUM> may take action to suspend or terminate the suspected fraudulent subscriber's use of the cloud computing system <NUM>. Therefore, the lower fraud threshold <NUM> of the first resource <NUM> may increase the number of subscribers of the first resource <NUM> that are flagged by the fraud detection manager <NUM> as being likely or suspected fraudulent users <NUM> of the cloud computing system <NUM>. Such likely or suspected fraudulent users <NUM> of the cloud computing system <NUM> may have their subscriptions suspended or terminated by the fraud detection manager <NUM>. Comparatively, the second resource <NUM> may have fewer subscribers that are flagged by the fraud detection manager as being likely or suspected fraudulent users <NUM> of the cloud computing system <NUM>.

In some implementations, the fraud thresholds <NUM> and <NUM> are collectively linked to a KPI <NUM> associated with the cloud computing system <NUM>. The KPI <NUM> may establish or set a baseline requirement that the fraud detection manager <NUM> identify a predetermined percentage of the unauthorized and fraudulent subscribers in the cloud computing system <NUM>, while ensuring that erroneously identified unauthorized or fraudulent subscribers do not exceed a predetermined percentage.

<FIG> illustrates that the first resource <NUM> has a tolerance to fraud that is lower than a tolerance to fraud of the second resource <NUM>. In some implementations, the fraud detection manager <NUM> manages the tolerance to fraud for each of the first and second resources <NUM>. For example, the fraud detection manager <NUM> may determine that the first resource <NUM> is to have a lower fraud tolerance compared to the fraud tolerance of the second resource <NUM> based on: a geographic location of the first resource <NUM>, an overall capability or capacity of the first resource <NUM> compared to an overall capability or capacity of the second resource <NUM>, a number of subscribers linked to the first resource <NUM> compared to a number of subscribers linked to the second resource <NUM>, or the like. Therefore, in some implementations, the fraud detection manager <NUM> may set the fraud threshold <NUM> lower than the fraud threshold <NUM> in consideration of the lower tolerance to fraud associated with the first resource <NUM>. In some implementations, setting the fraud threshold <NUM> lower than the fraud threshold <NUM> may necessitate increasing the fraud threshold <NUM> so that the KPI <NUM> associated with the cloud computing system <NUM> is maintained.

As described herein, when a subscriber of a particular resource <NUM> is found to have a fraud score that is greater than the fraud threshold assigned to the resource <NUM>, the fraud detection manager <NUM> may take action to suspend or terminate the suspected fraudulent subscriber's use of the cloud computing system <NUM>. Therefore, the lower fraud threshold <NUM> of the first resource <NUM> may increase the number of subscribers of the first resource <NUM> that are flagged by the fraud detection manager <NUM> as being likely or suspected fraudulent users waiter of the cloud computing system <NUM>. Such likely or suspected fraudulent users <NUM> of the cloud computing system <NUM> may have their subscriptions suspended or terminated by the fraud detection manager <NUM>. Comparatively, the second resource <NUM> may have fewer subscribers that are flagged by the fraud detection manager <NUM> as being likely or suspected fraudulent users <NUM> of the cloud computing system <NUM>.

<FIG> illustrates that the first resource <NUM> has a cost of operation that is higher than a cost of operation of the second resource <NUM>. The cost of operation of each of the resources <NUM> may be influenced by: a geographical location of a given resource <NUM>, the amount of hardware and software deployed by a given resource <NUM>, the type or number of subscribers associated with a given resource <NUM>, and so on. In some implementations, the fraud detection manager <NUM> analyzes the first and second resources <NUM> to determine the cost of operation associated with each of the resources <NUM>. In other implementations, the cost of operation associated with each of the first and second resources <NUM> are predetermined by another entity associated with the cloud computing system <NUM>. Nonetheless, in some implementations, the fraud detection manager <NUM> may set the fraud threshold <NUM> lower than the fraud threshold <NUM> in consideration of the high cost of operation associated with the first resource <NUM>. In some implementations, setting the fraud threshold <NUM> lower than the fraud threshold <NUM> may necessitate increasing the fraud threshold <NUM> so that the KPI <NUM> associated with the cloud computing system <NUM> is maintained.

<FIG> illustrates that the first resource <NUM> has an anticipated or actual subscriber growth rate that is higher than an anticipated or actual subscriber growth rate of the second resource <NUM>. The subscriber growth rate of each of the resources <NUM> may be influenced by: a geographical location of a given resource <NUM>, the amount of hardware and software deployed or to be deployed by a given resource <NUM>, the type or number of subscribers associated with a given resource <NUM>, and so on. In some implementations, the fraud detection manager <NUM> analyzes the first and second resources <NUM> to determine an anticipated or actual subscriber growth rate associated with each of the resources <NUM>. In other implementations, the anticipated or actual subscriber growth rate associated with each of the first and second resources <NUM> are predetermined by another entity associated with the cloud computing system <NUM>. Nonetheless, in some implementations, the fault detection manager <NUM> may set the fraud threshold <NUM> lower than the fraud threshold <NUM> in consideration of the high anticipated or actual growth rate associated with the first resource <NUM>. In some implementations, setting the fraud threshold <NUM> lower than the fraud threshold <NUM> may necessitate increasing the fraud threshold <NUM> so that the KPI <NUM> associated with the cloud computing system <NUM> is maintained.

<FIG> illustrates that the first resource <NUM> has an anticipated or actual subscriber fraud risk that is higher than an anticipated or actual subscriber fraud risk of the second resource <NUM>. The subscriber fraud risk of each of the resources <NUM> may be influenced by a geographical location of a given resource <NUM>, the type or number of subscribers associated with a given resource <NUM>, and so on. In some implementations, the fraud detection manager <NUM> analyzes the first and second resources <NUM> to determine an anticipated or actual subscriber fraud risk associated with each of the resources <NUM>. In other implementations, the anticipated or actual subscriber fraud risk associated with each of the first and second resources <NUM> are predetermined by another entity associated with the cloud computing system <NUM>. Nonetheless, in some implementations, the fault detection manager <NUM> may set the fraud threshold <NUM> lower than the fraud threshold <NUM> in consideration of the high anticipated or actual subscriber fraud risk associated with the first resource <NUM>. In some implementations, setting the fraud threshold <NUM> lower than the fraud threshold <NUM> may necessitate increasing the fraud threshold <NUM> so that the KPI <NUM> associated with the cloud computing system <NUM> is maintained.

Turning now to <FIG>, aspects of a routine <NUM> related to multi-threshold based management of subscriber fraud for cloud computing systems are described. It should be understood that the operations of the methods (e.g., routines) disclosed herein are not necessarily presented in any particular order and that performance of some or all of the operations in an alternative order(s) is possible and is contemplated. The operations have been presented in the demonstrated order for ease of description and illustration. Operations may be added, omitted, and/or performed simultaneously, without departing from the scope of the appended claims. Furthermore, it is to be understood that the routine <NUM> may be implemented by one or more of the elements and components illustrated in <FIG> and <NUM>-<NUM> and the related description of those figures.

It also should be understood that the illustrated methods can end at any time and need not be performed in their entireties. Some or all operations of the methods, and/or substantially equivalent operations, can be performed by execution of computer-readable instructions included on a computer-storage media, as defined below. The term "computer-readable instructions," and variants thereof, as used in the description and claims, is used expansively herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, and the like. Computer-readable instructions can be implemented on various system configurations, including single-processor or multiprocessor systems, minicomputers, mainframe computers, personal computers, hand-held computing devices, microprocessor-based, programmable consumer electronics, combinations thereof, and the like.

The operations of the routine <NUM> are described herein as being implemented, at least in part, by an application, component and/or circuit, such as one or more of the operational elements of the neural network environments described herein. In some configurations, the neural network environments may implement a compiled program, an interpreted program, a script or any other executable set of instructions. One or more of the implemented compiled program, interpreted program, script or any other executable set of instructions may be executed by at least one processor to cause one or more of the operations of the routine <NUM> to operate.

It should be appreciated that the logical operations described herein are implemented (<NUM>) as a sequence of computer implemented acts or program modules running on a computing system and/or (<NUM>) as interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice dependent on the performance and other requirements of the computing system. Accordingly, the logical operations described herein are referred to variously as states, operations, structural devices, acts, or modules. These operations, structural devices, acts, and modules may be implemented in software, in firmware, in special purpose digital logic, and any combination thereof.

For example, the operations of the routine <NUM> are described herein as being implemented, at least in part, by an application, component and/or circuit, such as the one or more of the elements associated with the described neural network environments. Although the following illustration may refer to the components or elements of <FIG> and <FIG> it can be appreciated that the operations of the routine <NUM> may also be implemented in many other ways. In addition, one or more of the operations of the routine <NUM> may alternatively or additionally be implemented, at least in part, by a chipset working alone or in conjunction with other software modules. Any service, circuit or application suitable for providing the techniques disclosed herein can be used in operations described herein.

At block <NUM>, a plurality of resources <NUM> associated with a cloud computing system <NUM> are identified. In some implementations, the plurality of resources <NUM> are data centers of the cloud computing system <NUM>. The data centers may be co-located in a general geographic location. Alternatively, one or more of the data centers associated with the cloud computing system <NUM> may be located in diverse geographical areas across the globe. Each of the data centers may host subscribers or users of the cloud computing system <NUM>. Some of the hosted subscribers or users may be fraudulent or unauthorized users of the cloud computing system <NUM>.

At block <NUM>, a fraud threshold (e.g., fraud threshold <NUM>, fraud threshold <NUM>) is assigned to each of the plurality of resources <NUM>. In some implementations, each of the fraud thresholds may be adjusted by the cloud computing system <NUM> based on a characteristic associated with each of the plurality of resources <NUM>. Furthermore, each of the fraud thresholds may be a value that is greater than or equal to <NUM> and less than or equal to <NUM>. A fraud threshold value approaching <NUM> signifies a low tolerance of unauthorized and fraudulent subscriber use of one or more resources in the cloud computing system <NUM> and a fraud threshold value approaching <NUM> signifies a high tolerance of unauthorized and fraudulent subscriber use of one or more resources in the cloud computing system <NUM>.

At block <NUM>, at least one of the fraud thresholds assigned to the plurality of resources is adjusted based on a characteristic associated with at least one of the plurality of resources of the cloud computing system <NUM>. In some implementations, at least one of the fraud thresholds assigned to the plurality of resources is lowered based on a characteristic associated with at least one of the plurality of resources of the cloud computing system <NUM>. In some implementations, the characteristic associated with at least one of the plurality of resources is at least one of: a capacity percentage associated with one or more of the plurality of resources, a fraud distribution associated with one or more of the plurality of resources, a cost of operation associated with one or more of the plurality of resources, an anticipated or actual subscriber growth rate associated with one or more of the plurality of resources, or an anticipated or actual subscriber fraud risk associated with one or more of the plurality of resources.

At block <NUM>, at least one subscriber associated with the cloud computing system <NUM> is suspended or terminated based on the adjusted at least one of the fraud thresholds.

<FIG> illustrates an exemplary computer architecture <NUM> for a computer(s) capable of executing the herein described methods. The computer architecture <NUM> illustrated in <FIG> includes at least one computing environment <NUM> that may include a central processing unit <NUM> ("CPU"), a system memory <NUM>, including a random-access memory <NUM> ("RAM") and a read-only memory ("ROM") <NUM>, and a system bus <NUM> that couples the memory <NUM> to the CPU <NUM>. A basic input/output system containing the basic routines that help to transfer information between elements within the computer architecture <NUM>, such as during startup, is stored in the ROM <NUM>. The computer architecture <NUM> further includes a mass storage device <NUM> for storing an operating system <NUM>, other data, and one or more application programs. A plurality of computing environments <NUM> are illustrated in <FIG>.

The mass storage device <NUM> is connected to the CPU <NUM> through a mass storage controller (not shown) connected to the bus <NUM>. The mass storage device <NUM> and its associated computer-readable media provide non-volatile storage for the computer architecture <NUM>. Although the description of computer-readable media contained herein refers to a mass storage device, such as a solid-state drive, a hard disk or CD-ROM drive, it should be appreciated by those skilled in the art that computer-readable media can be any available computer storage media or communication media that can be accessed by the computer architecture <NUM>.

Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any delivery media. The term "modulated data signal" means a signal that has one or more of its characteristics changed or set in a manner so as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above should also be included within the scope of computer-readable media.

By way of example, and not limitation, computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. For example, computer media includes, but is not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state memory technology, CD-ROM, digital versatile disks ("DVD"), HD-DVD, BLU-RAY, or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computer architecture <NUM>. For purposes of the claims, the phrase "computer storage medium," "computer-readable storage medium" and variations thereof, does not include waves, signals, and/or other transitory and/or intangible communication media, per se.

According to various techniques, the computer architecture <NUM> may operate in a networked environment using logical connections the computing environments <NUM> through a network <NUM> and/or another network (not shown). The computer architecture <NUM> may connect to the network <NUM> through a network interface unit <NUM> connected to the bus <NUM>. It should be appreciated that the network interface unit <NUM> also may be utilized to connect to other types of networks and remote computer systems. The computer architecture <NUM> also may include an input/output controller <NUM> for receiving and processing input from a number of other devices, including a keyboard, mouse, or electronic stylus (not shown in <FIG>). Similarly, the input/output controller <NUM> may provide output to a display screen, a printer, or other type of output device (also not shown in <FIG>). It should also be appreciated that via a connection to the network <NUM> through a network interface unit <NUM>, the computing architecture may communicate with other computing devices.

It should be appreciated that the software components described herein may, when loaded into the CPU <NUM> and executed, transform the CPU <NUM> and the overall computer architecture <NUM> from a general-purpose computing system into a special-purpose computing system customized to facilitate the functionality presented herein. The CPU <NUM> may be constructed from any number of transistors or other discrete circuit elements and/or chipset, which may individually or collectively assume any number of states. More specifically, the CPU <NUM> may operate as a finite-state machine, in response to executable instructions contained within the software modules disclosed herein. These computer-executable instructions may transform the CPU <NUM> by specifying how the CPU <NUM> transitions between states, thereby transforming the transistors or other discrete hardware elements constituting the CPU <NUM>.

As another example, the computer-readable media disclosed herein may be implemented using magnetic or optical technology. In such implementations, the software presented herein may transform the physical state of magnetic or optical media, when the software is encoded therein. These transformations may include altering the magnetic characteristics of particular locations within given magnetic media. These transformations also may include altering the physical features or characteristics of particular locations within given optical media, to change the optical characteristics of those locations. Other transformations of physical media are possible without departing from the scope of the present description, with the foregoing examples provided only to facilitate this discussion.

In light of the above, it should be appreciated that many types of physical transformations take place in the computer architecture <NUM> in order to store and execute the software components presented herein. It also should be appreciated that the computer architecture <NUM> may include other types of computing devices, including hand-held computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that the computer architecture <NUM> may not include all of the components shown in <FIG>, may include other components that are not explicitly shown in <FIG>, or may utilize an architecture completely different than that shown in <FIG>.

Computing system <NUM>, described above, can be deployed as part of a computer network. In general, the above description for computing environments applies to both server computers and client computers deployed in a network environment.

<FIG> illustrates an exemplary illustrative networked computing environment <NUM>, with client and/or server computers in communication via a communications network, in which the herein described apparatus and methods may be employed. As shown in <FIG>, one or more computing devices may be interconnected via a communications network <NUM> (which may be either of, or a combination of, a fixed-wire or wireless LAN, WAN, intranet, extranet, peer-to-peer network, virtual private network, the Internet, Bluetooth communications network, proprietary low voltage communications network, or other communications network) with a number of client computing environments such as a tablet personal computer <NUM>, a mobile telephone <NUM>, a telephone <NUM>, a personal computer(s)<NUM>, a personal digital assistant <NUM>, a smart phone watch/personal goal tracker (e.g., Apple Watch, Samsung, FitBit, etc. ) <NUM>, and a smart phone <NUM>. In a network environment in which the communications network <NUM> is the Internet, for example, server(s) in the network <NUM> can be dedicated computing environment servers operable to process and communicate data to and from client computing environments <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> via any of a number of known protocols, such as, hypertext transfer protocol (HTTP), file transfer protocol (FTP), simple object access protocol (SOAP), or wireless application protocol (WAP). Additionally, the networked computing environment <NUM> can utilize various data security protocols such as secured socket layer (SSL) or pretty good privacy (PGP). Each of the client computing environments <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> can be equipped with operating system <NUM> operable to support one or more computing applications or terminal sessions such as a web browser (not shown), or other graphical user interface (not shown), or a mobile desktop environment (not shown) to gain access to the server computing environment(s).

Server(s) of the network <NUM> may be communicatively coupled to other computing environments (not shown) and receive data regarding the participating user's interactions/resource network. In an illustrative operation, a user (not shown) may interact with a computing application running on a client computing environment(s) to obtain desired data and/or computing applications. The data and/or computing applications may be stored on server computing environment(s) and communicated to cooperating users through client computing environments <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, over an exemplary communications network <NUM>. A participating user (not shown) may request access to specific data and applications housed in whole or in part on computing environment(s) <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>. These data may be communicated between client computing environments <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and server computing environment(s) for processing and storage. Server computing environment(s) may host computing applications, processes and applets for the generation, authentication, encryption, and communication of data and applications and may cooperate with other server computing environments (not shown), third party service providers (not shown), network attached storage (NAS) and storage area networks (SAN) to realize application/data transactions.

Claim 1:
A system (<NUM>) for managing subscriber fraud associated with a cloud computing system (<NUM>), the system (<NUM>) comprising:
at least one processor (<NUM>);
at least one memory (<NUM>) in communication with the at least one processor (<NUM>), the at least one memory (<NUM>) having computer-readable instructions (<NUM>) stored thereupon that, when executed by the at least one processor (<NUM>), cause the at least one processor (<NUM>) to:
identify a first data center (<NUM>), comprising a first plurality of components, in the cloud computing system (<NUM>), the first data center (<NUM>) having a first plurality of subscribers linked thereto;
identify a second data center (<NUM>), comprising a second plurality of components, in the cloud computing system (<NUM>), the second data center (<NUM>) having a second plurality of subscribers linked thereto;
assign a first fraud threshold (R1) to the first data center (<NUM>) in the cloud computing system (<NUM>);
assign a second fraud threshold (R2) to the second data center (<NUM>) in the cloud computing system (<NUM>);
adjust at least one of the first fraud threshold, based on one or more characteristics associated with the first data center in the cloud computing system (<NUM>), and the second fraud threshold based on one or more characteristics associated with the second data center in the cloud computing system (<NUM>), wherein the one or more characteristics associated with the first and second data centers includes a used capacity of the components used in the first and second data centers respectively; and
calculate a fraud score associated with at least one subscriber of at least one of the first and second data centers;
suspend or terminate at least one subscriber associated with the cloud computing system based on a comparison of the fraud score associated with the at least one subscriber with the adjusted at least one of the first and second fraud thresholds.