Patent ID: 12250238

DETAILED DESCRIPTION

In the following description, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration specific embodiments which may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the embodiments. It is to be understood that other embodiments may be utilized and that structural, logical, and/or electrical changes may be made without departing from the scope of the embodiments. The following description of embodiments is, therefore, not to be taken in a limited sense, and the scope of the embodiments is defined by the appended claims.

Cloud users often deploy multiple cloud resources to form a system of cloud resources or otherwise access resources for their purposes. These systems are vulnerable to attacks of a variety of attack types. To help mitigate security risks, cloud providers, such as Microsoft Corporation of Redmond, Washington, United States, as well as other third-party security solution vendors, offer attack detection systems. These attack detection systems provide a user with one or more alerts in response to detecting an attack on a cloud resource to which the cloud customer (e.g., user or organization) has access.

Many cyber security solutions focus on protecting an endpoint or computer resource from attacks. Not all attacks can be detected with a focus on endpoint protection. Endpoint protection can help protect a single resource attack by monitoring operations of the resource. Embodiments provide improvements that examine operations performed on the resources as opposed to operations performed by the resources. Operations performed by the resources are dependent on the type of resource. For example, a cloud resource can run an app, the operations of that cloud resource are the operations of the app. A cloud resource can include a database, for such a resource the operations are storing or providing data. Operations performed on a resource include resource configuration, policy management, deployment, or the like. In general, operations performed by the resource can be monitored using a resource monitor and operations performed on the resource can be monitored using a portal monitor. Embodiments can surface security related anomalies detectable by analysis of resource management logs. Embodiments can find access anomalies through analysis of cloud resource management logs (e.g., Azure Resource Management (ARM) logs). In ARM logs, each organization is associated with its own column of entries.

Embodiments can use machine learning (ML) to analyze operations performed on cloud resources. Cloud resource management log monitoring can help identify an anomalous action performed by analyzing an organization as a whole. This is distinct from monitoring an individual user or operation by a resource. Operations performed on cloud resources of an organization can be monitored across users to determine whether an operation by a user from a cloud portal and on a cloud resource is anomalous.

As cloud systems grow more complex, attacks become more sophisticated as well. Such attacks may use phishing to gain access to an account and use that account for reconnaissance (e.g., gathering info about the system architecture, network details, etc.). Once access to a user account is obtained, an attacker can target a specific user account that has access to data the attacker needs, hence this user can be targeted specifically. An attacker can then gain access to the data desired and performing the exfiltration. This is just one example of an attack and many others are possible. This type of attack is not detected by prior endpoint or individual user monitoring solutions because the actions performed are not monitored at level required to detect these types of attacks. For example, consider a distributed attack in which a group of users launch a large number of virtual machines (VMs) and running code on each of the VMs. From the perspective of the individual user, the action of launching a few VMs is not suspicious activity and from the perspective of each VM, their launch is not suspicious. However, from the viewpoint of the group of users (organization), the actions are suspicious. The Embodiments herein can help detect such an attack by analyzing actions detailed in a cloud resource management log.

FIG.1illustrates, by way of example, a diagram of an embodiment of a cloud service system100. The cloud service system100can provide cloud computing services to various computing systems such as desktops, laptops, tablets, smartphones, embedded computers, point-of-sale terminals, and so on. The cloud service system100can include cloud resources that includes for example, servers and storage devices as well as various software products such as operating systems, databases, and applications.

Rather than maintaining their own data centers, many enterprises (cloud customers) subscribe as customers of a database service of the cloud service system100to store and process their data. For example, a retail company can subscribe to a database service to store records of the sales transactions of the company and use an interface provided by the database service to run queries to help in analyzing the sales data. As another example, a utility company can subscribe to a database service for storing meter readings collected from the meters of its customers. As yet another example, a government entity can subscribe to a database service for storing and analyzing tax return data of millions of taxpayers.

Enterprises that subscribe to the cloud service system100want data privacy and security assurances. Although the cloud service system100can employ many techniques to help preserve the privacy of customer data, parties seeking to steal such customer data are continually devising new techniques to access the data.

The cloud infrastructure112is a network of servers and other computer resources that are accessible through the Internet and provides a variety of hardware and software services. These resources are designed to either store and manage data (e.g., storage/data110), run applications108, or deliver content or a service (e.g., through servers102). Services can include streaming videos, web mail, office productivity software, or social media, among others. Instead of accessing files and data from a local or personal computer, cloud data is accessed online from an Internet-capable device, such as client114.

The system100as illustrated includes a cloud infrastructure112and a client114. The cloud infrastructure112includes computing resources124which the client114can access for their own computing needs. The computer devices as illustrated include servers102, virtual machines104, software platform106, applications108, storage/data110, portal122, and feedback/alerts116.

A user of the client114can access resources124of the cloud infrastructure112. To access the resources124, the user can log into a portal122. Logging into the portal122can include providing a username, password, two-factor authentication, or the like. The user can then generate one or more cloud resources124, move one or more cloud resources124, connect one or more cloud resources124to each other, alter an access or security policy for one or more cloud resources124, or the like.

As the user performs tasks in the portal122, a monitor126can generate entries in a resource management log118. The monitor126can include software, hardware, firmware, or a combination thereof. The entries in the resource management log118can include at least some of the following information: (i) a user identification (ID) that uniquely identifies the user that was logged in to the portal122to perform a management operation on the cloud resources124, (ii) a resource ID that uniquely identifies the cloud resource124that is a target of an operation performed by the user associated with the user ID (e.g., a uniform resource identifier (URI) or the like), (iii) an operation performed by the user associated with the user ID and on the resource associated with the resource ID, or (iv) a time at which the user associated with the user ID performed the operation on the resource associated with the resource ID. The entries can be organized in a table such that entries across a row or column can correspond to a same event, called an “action” herein. An example resource management log is provided:

TABLE 1Example Resource Management LogUser IDResourceIDOperationTimeDayNewtonDatabase1Connect server17:59Wedsto VMMaxwellServer8Install app9:17MonBohrDatabase4Create1:17Sat

Table 1 is simplified to aid in understanding of the subject matter described. Typically, the resource management log118includes more than 3 actions. The resource management log118includes all operations performed from the portal122on the cloud resources124. With hundreds of users, the resource management log118can get quite large.

The resource management log118is distinct from a resource operation log120. The resource operation log120regards operations by the cloud resources124while the resource management log118details operations for management of the cloud resources124(sometimes called operations performed on the resources). The resource operation log120records operations of the cloud resource124(e.g., memory reads, memory writes, app to app communications, application execution, or the like). The resource management log118records operations performed in the portal122initiated by a user (e.g., database110generation, connecting cloud resources124, deploying an app108, deleting or generating a virtual machine104, or the like). Operations performed in the portal122are operations on the cloud resource124. This distinction is important because typical security, like a security measure provided based on the resource operation log120, provides endpoint protection. In the example of cloud systems, such as the system100, the endpoint is the cloud resource124. The security measures provided by endpoint protection can be different from the security measures provided based on the resource management log118. The endpoint protection detects whether a particular cloud resource124is attacked. The security measures provided based on the resource management log118can include security for types of attacks that are not detectable based on the resource operation log120. For example, the security measures provided based on the resource management log118can include phishing-based or other exfiltration of data, or other attack that is staged across multiple cloud resources124.

Consider a scenario in which an attacker has received login information for a user, such as through phishing. That attacker can then login to the portal122and deploy a mechanism to perform reconnaissance and gather information about the structure of the cloud resources124deployed. The attacker can then target a specific user that has access to data the attacker desires. It is not possible to identify such an attack using the resource operation log120. However, such an attack can be identified using the resource management log118because the resource management log118takes a more wholistic view of the cloud resources, namely an organizational level that monitors all activity with the cloud resources124across the organization.

The servers102can provide results as a result of a request for computation. The server102can be a file server that provides a file in response to a request for a file, a web server that provides a web page in response to a request for website access, an electronic mail server (email server) that provides contents of an email in response to a request, a login server that provides an indication of whether a username, password, or other authentication data are proper in response to a verification request.

The virtual machine (VM)104is an emulation of a computer system. The VM104provides the functionality of a physical computer. VMs can include system VMs that provide the functionality to execute an entire operating system (OS) or process VMs that execute a computer application in an isolated, platform-independent environment. VMs can be more secure than a physical computer as an attack on the VM is merely an attack on an emulation. VMs can provide functionality of first platform (e.g., Linux, Windows, or another OS) on a second, different platform.

The software platform106is an environment in which a piece of software is executed. The software platform106can include hardware, OS, a web browser and associated application programming interfaces (APIs), or the like. The software platform106can provide tools for developing more computer resources, such as software. The software platform106can provide low-level functionality for a software developer.

The applications108can be accessible through one of the servers102, the VM104, a container (seeFIG.3), or the like. The applications108provide compute resources to a user such that the user does not have to download or execute the application on their own computer. The applications108, for example, can include a machine learning (ML) suite that provides configured or configurable ML software. The ML software can include artificial intelligence type software, such as a neural network (NN) or other technique. The ML or AI techniques can have memory or processor bandwidth requirements that are prohibitively expensive or complicated for some cloud customers to implement or support.

The storage/data110can include one or more databases, containers, or the like for? memory access. The storage/data110can be partitioned such that a given user has dedicated memory space. A service level agreement (SLA) generally defines an amount of uptime, downtime, maximum or minimum lag in accessing the data, or the like.

The client114is a compute device capable of accessing the functionality of the cloud infrastructure112. The client114can include a smart phone, tablet, laptop, desktop, a server, television or other smart appliance, a vehicle (e.g., a manned or unmanned vehicle), or the like. The client114accesses the resources provided by the cloud infrastructure112. Each request from the client114can be associated with an internet protocol (IP) address identifying the client114, a username identifying a user of the device, a customer identification indicating an entity that has permission to access the cloud infrastructure112, or the like.

The alert116can be provided to the client114responsive to a resource management log anomaly detection. The anomaly in the resource management log can be determined using a log analyzer130. The alert116can include a pop-up window, text message, email, or the like. The alert116can include information that lead to production of the alert116or a link that, when selected, navigates a user to the information that lead to production of the alert116.

The log analyzer130can include software, firmware, or hardware configured to perform operations of resource management log118analysis. The log analyzer130can receive or access the resource management log118. The log analyzer130can determine whether an anomaly is present in the resource management log118. An anomaly can indicate an attack, such as cannot be detected based on the resource operation log120. An anomaly in this context is an action, or related entries, that is determined be an unexpected cloud resource management operation. The log analyzer130can find the one or more unexpected actions of the user in the portal122by analyzing the resource management log118(e.g., and only the resource management log118). The log analyzer130is described in more detail inFIG.2.

The cloud infrastructure112is accessible by any client114with sufficient permission. Usually a customer will pay for or otherwise gain permission to access the cloud infrastructure112using one or more devices. Since multiple services and multiple clients114with different habits can access the cloud infrastructure112, it is difficult to provide a “one size fits all” security solution. Typically, an attack on the server102is different than an attack on the VM104, which is different than an attack on a container, etc. These different attack vectors are usually handled by instantiating different security techniques with monitoring at each device, such as by the monitor128. Also, these attack vectors can be related, as an attack on a container can be triggered by an impersonation attack, which can be detected by identifying an increase in failed login attempts or abnormal usage of a resource of the cloud infrastructure112(relative to the user permitted to access).

FIG.2illustrates, by way of example, a diagram of an embodiment of operations of the log analyzer130. The log analyzer130can receive the cloud resource management log118as input and provide an alert116as output (if the alert116is warranted). The cloud resource management log118can be filtered at operation220. The result of the operation220is a filtered cloud resource management log222. The filter action operation220can remove an action from the resource management log222that is not associated with a potential attack. For example, a user that provides documentation on how to use a cloud resource124(seeFIG.1) or how the cloud resource124functions is not part of an attack, a user that enables a protection mechanism (e.g., antimalware, firewall, or the like) for a first time can be considered to be not part of an attack, among others. The filter action operation220can remove such actions from the resource management log118. The result is a filtered resource management log222that includes actions226that, potentially, relate to an attack. Common actions that are performed by an attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, changing permissions, or the like.

At operation224, an action226can be extracted from the filtered resource management log222. The action226is multiple entries that are each associated with a specific instance of an operation performed by a user. For example, in Table 1, an action is a single row of entries. Each row of entries in Table 1 correspond to a single instance of an operation monitored while the user was using the portal122.

At operation228the extracted action226is processed. Consider the generalized action {userID, resourceID, operation, time, day of week}. The operation228can include splitting the generalized action into one or more pairs of entries. Pairs of entries for the example generalized action include (userID, resourceID), (userID, operation), (resourceID, operation), (userID, time), and (userID, day of week). The processed action230can include one or more pairs of the entries. The pair of entries can be provided to a collaborative filter232.

The operation228can include generating a graph based on the pairs of entries. The graph can include a bipartite graph in some embodiments. The bipartite graph can include nodes connected by edges. The nodes can represent respective entries in the pair of entries. An edge connecting nodes indicates that the nodes on each side of the edge are related in the graph. The graph can grow as more actions226are processed at operation228. The processed action230can include a representation of the graph.FIG.3shows an example of a bipartite graph.

The collaborative filter232can generate an action score234for each entry pair. The score234indicates whether the action226of the user is consistent with users that perform similar actions as the user. The output of the collaborative filter232can include the action score234. The collaborative filter232can separate the entry into multiple pairs and determine a score for each pair. The scores corresponding to an action can be combined (e.g., summed, weighted and summed, or the like) to generate a final score, the action score234.

During training, the collaborative filter232can compute a latent feature vector per entity. During evaluation the preliminary score can be calculated by performing a dot product between the two relevant vectors. In the final score this preliminary score can be normalized to have a mean of zero and a standard deviation of 1 and multiplied by −1 so that it represents an anomaly score rather than a predicted score.

Collaborative filtering, in a typical use case, is a method of making predictions (filtering) about the interests of the user by collecting preferences or taste information from many users (collaborating). The underlying assumption of the collaborative filtering approach is that if a person A has the same opinion as a person B an issue, A is more likely to have a same opinion as B on a different issue than that of a randomly chosen person. For example, a collaborative filtering recommendation system for preferences in television programming could make predictions about which television show a user should like given a partial list of that user's tastes (likes or dislikes). Note that these predictions are specific to the user, but use information gleaned from many users.

In the context of cloud security, the operations implemented by the collaborative filter232include a method of making predictions (filtering) about the actions of the user by collecting actions from many users (collaborating) (e.g., users within a same or similar organization). The underlying assumption of the collaborative filtering approach is that if a person A performs the same actions as a person B on the cloud resources124, A is more likely to perform B's actions on a different cloud resource than that of a randomly chosen person. The score234is thus an indication of the likelihood that the action performed by the user is anomalous or not. An anomalous action is more likely associated with an attack than other actions.

At operation236, the action score234can be compared to a criterion. The criterion can be determined using empirical data. A developer or other personnel can set the criterion, test the collaborative filter232with actions226that are anomalous and non-anomalous, record the accuracy of the collaborative filter232, and repeat. The criterion corresponding to the best test accuracy of the collaborative filter232or that provides sufficient collaborative filter232accuracy can be chosen as the criterion. Example criterion include one or more thresholds on individual pair scores, a threshold on the sum of individual pair scores, or the like.

If, at operation236, the action score234satisfies the criterion, an alert can be issued at operation238. The alert116can provide security personnel with information indicating why the alert116was generated. The information can include the action226of the filtered resource management log222that is deemed anomalous, a portion of the action226, the action score234, one or more actions in the filtered resource management log222or the resource management log118that are associated with the same user ID as the action226(e.g., one or more actions associated with the user ID that are immediately before or immediately after the action226in terms of time).

A normalized score can have a criterion specified in terms of number of standard deviations from the mean. A user can adjust the standard deviation to manage false positives and true positives. A lower standard deviation can result in more false positives, while a higher standard deviation can result in fewer true positives being detected.

The alert116can include a text description explaining why the alert was generated. For an anomalous credential access, for example, the alert116can indicate the anomaly relates to a user accessing a resource they do not usually access. This operation might indicate that an account in the organization was breached, and that the threat actor is trying to retrieve the credentials to access one of the cloud resources124. Alternatively, the operation might have been performed by a legitimate user in your organization. For a different anomalous credential access, the text can indicate that an account in the organization was breached, and that the threat actor is trying to retrieve the credentials to access one of the cloud resources124. Alternatively, the operation might have been performed by a legitimate user in the organization. For an example that includes anomalous detection of code, the alert116can indicate that the anomaly relates to a user performing an operation at an unusual time. The alert116might indicate that an account in the organization was breached, and that the threat actor is trying to execute code on one of the cloud resources124in the environment. Alternatively, it might have been performed by a legitimate user in the organization. In general, the text of the alert116can change based on the pairs of scores that were determined to indicate an anomaly.

If, at operation236, the action score234does not satisfy the criterion, operation240can be performed. The operation240can include determining if more actions in the filtered resource management log222are to be processed. If at least one more action226is to be processed, the log analyzer130can perform operation224. If no more actions226are to be processed, the operations of the log analyzer130can terminate at operation242.

FIG.3illustrates, by way of example, a conceptual block diagram of training the collaborative filter232. Training samples330can be provided as input to the collaborative filter232. The training samples330can include actions similar to the processed actions230along with a label indicating whether the training sample330corresponds to anomalous or normal behavior. The collaborative filter232can, based on the training samples330, generate a (vector, action score) pair332. The vector is an encoding of the training sample330and the action score is similar to the action score234. Then, during operation, the collaborative filter can use the generated (vector, action score) pair332to determine the action score234.

FIG.4illustrates, by way of example, a conceptual block diagram of a bipartite graph400. The graph400can be generated at operation228(seeFIG.2). The graph400as illustrated includes nodes440A,440B,440C connected by one or more edges442A,442B,442C,442D to second nodes444A,444B,444C.

Each of the first nodes440A-440C represents a specific instance of an entry type of the resource management log222and each of the second nodes444A-444C represents a specific instance of another entry type. Example entry types include user ID, cloud resource URI, operation, time, day of the week, among others. Each node440A-440C,442A-442C represents a specific instance of the entry type. Each specific instance can be represented by a single node. If entry type 1 is user ID, then each node442A-442C can represent a specific user ID. An edge442A-442D between two nodes440A-440C indicates that an action226(seeFIG.2) in the cloud resource management log118includes both nodes as separate entries.

A representation of one or graphs like the bipartite graph400can be used by the collaborative filter232to determine the action score234. The collaborative filter232can, provided a new input pair, such as (user ID, cloud resource URI), (user ID, operation), (cloud resource URI, operation), (user ID, time) and based on the representation of the graph, determine the action score234, or a portion of the action score234in cases where multiple input pairs are used to the determine the action score234

FIG.5illustrates, by way of example, a block diagram of an embodiment of a method500for cloud resource security management. The method500as illustrated includes obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, at operation550; determining a respective score for each action in the cloud resource management log, at operation552; comparing the respective score to a specified criterion, at operation554; and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion, at operation556. The actions can each include entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed.

The operation552can include determining the score includes using collaborative filtering. The operation552can include combining a collaborative filtering score for at least two of (i) the user ID and the operation, (ii) the user ID and the resource, (iii) the operation and the resource, or (iv) the user ID and the time.

The method500can further include generating a bipartite graph including (i) respective users of the users and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective user accessed the respective cloud resource; (ii) respective users of the users and respective operations of the operations as nodes and respective edges representing whether the respective user performed the respective operation; or (iii) respective operations of the operations and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective operation was performed on the respective cloud resource and wherein collaborative filtering is performed based on data representing the generated graph.

The method500can further include, before performing operation552, filtering the cloud resource management log to include only operations that are performed by an attacker and wherein the respective score is determined based on the filtered cloud resource management log. The method500can further include wherein, the operations performed by the attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, or changing permissions. The method500can further include, wherein providing the indication of anomalous action includes providing an electronic mail, a pop-up message, or a text message indicating the action of the management log corresponding to the anomalous action.

FIG.6illustrates, by way of example, a block diagram of an embodiment of a machine600(e.g., a computer system) to implement one or more embodiments. The machine600can implement a technique for improved cloud resource security. The client111, cloud infrastructure112, cloud resource124, monitor126,128, log analyzer130, or a component thereof can include one or more of the components of the machine600. One or more of the client111, cloud infrastructure112, cloud resource124, monitor126,128, log analyzer130, monitor200, method500, or a component or operations thereof can be implemented, at least in part, using a component of the machine600. One example machine600(in the form of a computer), may include a processing unit602, memory603, removable storage610, and non-removable storage612. Although the example computing device is illustrated and described as machine600, the computing device may be in different forms in different embodiments. For example, the computing device may instead be a smartphone, a tablet, smartwatch, or other computing device including the same or similar elements as illustrated and described regardingFIG.6. Devices such as smartphones, tablets, and smartwatches are generally collectively referred to as mobile devices. Further, although the various data storage elements are illustrated as part of the machine600, the storage may also or alternatively include cloud-based storage accessible via a network, such as the Internet.

Memory603may include volatile memory614and non-volatile memory608. The machine600may include—or have access to a computing environment that includes—a variety of computer-readable media, such as volatile memory614and non-volatile memory608, removable storage610and non-removable storage612. Computer storage includes random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM) & electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD ROM), Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices capable of storing computer-readable instructions for execution to perform functions described herein.

The machine600may include or have access to a computing environment that includes input606, output604, and a communication connection616. Output604may include a display device, such as a touchscreen, that also may serve as an input device. The input606may include one or more of a touchscreen, touchpad, mouse, keyboard, camera, one or more device-specific buttons, one or more sensors integrated within or coupled via wired or wireless data connections to the machine600, and other input devices. The computer may operate in a networked environment using a communication connection to connect to one or more remote computers, such as database servers, including cloud-based servers and storage. The remote computer may include a personal computer (PC), server, router, network PC, a peer device or other common network node, or the like. The communication connection may include a Local Area Network (LAN), a Wide Area Network (WAN), cellular, Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), Bluetooth, or other networks.

Computer-readable instructions stored on a computer-readable storage device are executable by the processing unit602(sometimes called processing circuitry) of the machine600. A hard drive, CD-ROM, and RAM are some examples of articles including a non-transitory computer-readable medium such as a storage device. For example, a computer program618may be used to cause processing unit602to perform one or more methods or algorithms described herein.

The operations, functions, or algorithms described herein may be implemented in software in some embodiments. The software may include computer executable instructions stored on computer or other machine-readable media or storage device, such as one or more non-transitory memories (e.g., a non-transitory machine-readable medium) or other type of hardware based storage devices, either local or networked. Further, such functions may correspond to subsystems, which may be software, hardware, firmware, or a combination thereof. Multiple functions may be performed in one or more subsystems as desired, and the embodiments described are merely examples. The software may be executed on a digital signal processor, ASIC, microprocessor, central processing unit (CPU), graphics processing unit (GPU), field programmable gate array (FPGA), or other type of processor operating on a computer system, such as a personal computer, server or other computer system, turning such computer system into a specifically programmed machine. The functions or algorithms may be implemented using processing circuitry, such as may include electric and/or electronic components (e.g., one or more transistors, resistors, capacitors, inductors, amplifiers, modulators, demodulators, antennas, radios, regulators, diodes, oscillators, multiplexers, logic gates, buffers, caches, memories, GPUs, CPUs, field programmable gate arrays (FPGAs), or the like).

ADDITIONAL NOTES AND EXAMPLES

Example 1 can include a method for cloud resource security management, the method comprising obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed, determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.

In Example 2, Example 1 can further include, wherein determining the score includes using collaborative filtering.

In Example 3, Example 2 can further include, wherein determining the respective score includes combining a collaborative filtering score for at least two of (i) the user ID and the operation, (ii) the user ID and the resource, (iii) the operation and the resource, or (iv) the user ID and the time.

In Example 4, Example 3 can further include generating a bipartite graph including (i) respective users of the users and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective user accessed the respective cloud resource; (ii) respective users of the users and respective operations of the operations as nodes and respective edges representing whether the respective user performed the respective operation; or (iii) respective operations of the operations and respective cloud resources of the cloud resources as nodes and respective edges representing whether the respective operation was performed on the respective cloud resource and wherein collaborative filtering is performed based on data representing the generated graph.

In Example 5, at least one of Examples 1-4 can further include, before determining the respective score, filtering the cloud resource management log to include only operations that are performed by an attacker and wherein the respective score is determined based on the filtered cloud resource management log.

In Example 6, Example 5 can further include wherein, the operations performed by the attacker include running a command, installing a custom script, changing firewall rules, listing keys, adding users, or changing permissions.

In Example 7, at least one of Examples 1-6 can further include, wherein providing the indication of anomalous action includes providing an electronic mail, a pop-up message, or a text message indicating the action of the management log corresponding to the anomalous action.

Example 8 can include a device for performing the method of at least one of Examples 1-7.

Example 9 can include a non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations comprising the method of at least one of Examples 1-7.

Although a few embodiments have been described in detail above, other modifications are possible. For example, the logic flows depicted in the figures do not require the order shown, or sequential order, to achieve desirable results. Other steps may be provided, or steps may be eliminated, from the described flows, and other components may be added to, or removed from, the described systems. Other embodiments may be within the scope of the following claims.