Multi-tenant security

Abstract

Described are techniques for multi-tenant security. The technique includes detecting malicious activity on a compromised application in a multi-tenant host. The technique further includes automatically performing real-time migration of each tenant in the multi-tenant host to a respective single-tenant host. The technique further includes mitigating malicious activities that migrate onto the compromised application of the single tenant host, and automatically performing another live migration of each benign tenant to a new multi-tenant host.

Description

Background Art

[0001] The present disclosure relates to computer security and, more particularly, to mitigating malicious activity in multi-tenant systems.

[0002] Server hosting is an information technology (IT) service (e.g., from a cloud service provider) that provides remote access to off-site virtual or physical servers and associated resources, either on a monthly subscription basis or on a per-usage basis. Server hosting allows IT teams to provision and use application and data servers without the upfront costs, delays, and labor of purchasing, setting up, managing, and maintaining physical server hardware themselves.

[0003] Server hosting can include multi-tenant (e.g., shared) hosting or single-tenant (e.g., dedicated) hosting. In multi-tenant hosting, the resources of one physical server are virtualized and made available to multiple tenants (e.g., users, clients, etc.). In contrast, in single-tenant hosting, a sole tenant has exclusive access to all resources of a single hardware server. Multi-tenant hosting is generally more cost-effective for smaller, simpler projects, while single-tenant hosting is generally more beneficial for projects that require more control and / or higher performance (or greater certainty of a certain level of performance).

[0004] Despite the benefits provided by multi-tenant systems, multi-tenant systems are still vulnerable to cybersecurity threats. In particular, when one tenant is compromised in a multi-tenant system, multiple other tenants may be at risk of infection given their proximity to the compromised tenant via shared underlying resources. Therefore, when a tenant is exploited in a multi-tenant system, all tenants in the multi-tenant system may lose availability during the mitigation of the exploited tenant. Summary of the invention

[0005] Aspects of the present disclosure relate to a computer-implemented method that includes detecting malicious activity on a compromised application in a multi-tenant host. The method also includes automatically performing a live migration of each tenant in the multi-tenant host to a corresponding single-tenant host. The method also includes mitigating the malicious activity on the compromised application migrated to the single-tenant host. The method also includes automatically performing another live migration of each benign tenant to a new multi-tenant host.

[0006] Advantageously, the above method mitigates malicious activity on a multi-tenant host while maintaining availability of tenant workloads by: (i) migrating tenants to single-tenant hosts capable of executing tenant workloads; and (ii) using live migration techniques to maintain availability during migration from a multi-tenant host to a single-tenant host.

[0007] Additional aspects of the present disclosure relate to a computer-implemented method, including detecting an unauthorized clone of a first tenant in a multi-tenant host and automatically isolating the tenants of the multi-tenant host in a sandbox container. The method also includes determining a secure image corresponding to the first tenant, and re-imaging the first tenant on a new multi-tenant host using the secure image. The method also includes verifying the security of each tenant in the sandbox container, and in response to verifying the security of each tenant in the sandbox container, migrating each tenant from the sandbox container to the new multi-tenant host.

[0008] Advantageously, the foregoing method mitigates malicious activity in the form of unauthorized cloning on multi-tenant hosts while maintaining the availability of tenant workloads. More specifically, by using sandbox containers, the foregoing method balances the availability of tenant workloads with the isolation of potentially malicious tenants.

[0009] Additional aspects of the present disclosure relate to systems and computer program products configured to perform the above methods.This summary is not intended to describe every aspect, every implementation, and / or every example of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings included in this application are incorporated into the specification and form a part of the specification. They illustrate embodiments of the present disclosure and are used to explain the principles of the present disclosure together with the specification. The accompanying drawings are only illustrations of certain embodiments and do not limit the present disclosure.

[0011] Figure 1 A block diagram of an example computing environment that implements multi-tenant security when identifying compromised tenants in accordance with some embodiments of the present disclosure is shown.

[0012] Figure 2 A block diagram of an example computing environment that implements multi-tenant security during live migration of multiple tenants to a single-tenant host according to some embodiments of the present disclosure is shown.

[0013] Figure 3 A block diagram of an example computing environment that implements multi-tenant security during live migration of benign tenants to new multi-tenant hosts in accordance with some embodiments of the present disclosure is shown.

[0014] Figure 4 A flow chart of an example method for implementing multi-tenant security using a single-tenant host according to some embodiments of the present disclosure is shown.

[0015] Figure 5 A flowchart of an example method for training and refining a threat detection model for multi-tenant security according to some embodiments of the present disclosure is shown.

[0016] Figure 6A block diagram of an example computing environment that implements multi-tenant security when identifying unauthorized clones of tenants in accordance with some embodiments of the present disclosure is shown.

[0017] Figure 7 A block diagram of an example computing environment that implements multi-tenant security while isolating multiple tenants in one or more sandbox containers according to some embodiments of the present disclosure is shown.

[0018] Figure 8 A block diagram of an example computing environment that implements multi-tenant security when re-imaging unauthorized clones and their associated tenants and implementing the re-imaged tenants and other benign tenants on a new multi-tenant host is shown in accordance with some embodiments of the present disclosure.

[0019] Fig. 9 A flowchart of an example method for implementing multi-tenant security using one or more sandbox containers according to some embodiments of the present disclosure is shown.

[0020] Fig.10 A block diagram of an example computing environment is shown in accordance with some embodiments of the present disclosure.

[0021] Although the present disclosure is suitable for various modifications and alternative forms, the details thereof have been shown by the examples in the drawings and will be described in detail. However, it should be understood that it is not intended to limit the present disclosure to the specific embodiments described. On the contrary, it is intended to cover all modifications, equivalents and substitutes that fall within the spirit and scope of the present disclosure. DETAILED DESCRIPTION

[0022] Aspects of the present disclosure relate to computer security, and more particularly, to mitigating malicious activity in multi-tenant systems.Although not limited to such applications, embodiments of the present disclosure may be better understood in light of the foregoing context.

[0023] Aspects of the present disclosure relate to identifying malicious activity on a multi-tenant host and isolating detected malicious activity. Malicious activity can be isolated by (i) migrating each tenant of the multi-tenant host to a single-tenant host, and / or (ii) isolating one or more tenants of the multi-tenant host in a sandbox container. Once isolated, aspects of the present disclosure can mitigate malicious activity (e.g., by terminating applications, deleting unauthorized clones, etc.). After verifying that benign tenants (e.g., those tenants that are not infected by a vulnerability (exploit)) are actually safe, aspects of the present disclosure can return benign tenants to a safe multi-tenant host.

[0024] Advantageously, aspects of the present disclosure enable malicious activity on a multi-tenant host to be isolated and mitigated. In addition, aspects of the present disclosure maintain the availability and functionality of benign tenants (e.g., by hosting benign tenants on single-tenant servers or in licensed sandbox containers). In addition, aspects of the present disclosure maintain the availability and functionality of benign tenants by using live migration techniques to maintain availability and functionality during the above-mentioned migration.

[0025] Now referring to the accompanying drawings, Figure 1 A block diagram of an example computing environment 100 for implementing multi-tenant security when identifying compromised tenants according to some embodiments of the present disclosure is shown. The example computing environment 100 includes a multi-tenant host 102, a plurality of single-tenant hosts 106 (e.g., single-tenant host 1 106-1, single-tenant host 2 106-2, single-tenant host N 106-N, where N is any integer greater than or equal to 1) communicatively coupled via a network 108, and a vulnerability analysis system 110.

[0026] The network 108 may be a local area network (LAN), a wide area network (WAN), an intranet, the Internet, or any other network 108 or group of networks 108 capable of connecting (directly or indirectly) the above components together continuously, semi-continuously, or intermittently.

[0027] The multi-tenant host 102, the single-tenant host 106, and the vulnerability analysis system 110 may be any computer, server, mainframe, virtual machine (VM), container, tablet, laptop, smart phone, other computer hardware (physical or virtualized), multiple of the above, and / or combination of the above. As will be appreciated by those skilled in the art, Figure 1 represents some embodiments of the present disclosure, but should not be construed as limiting. In other embodiments, there may be Figure 1 The components shown in FIG. 1 may be more or less similar or dissimilar components. In addition, in various embodiments, Figure 1 The components shown in , if they exist at all, can be combined together into a unified component or separated into discrete components.

[0028] The multi-tenant host 102 may include computing resources (e.g., computing resources, storage resources, networking resources, etc.) shared among multiple tenants 104 (e.g., tenant 1 104-1, compromised tenant 2 104-2, tenant N 104-N). In contrast, the single-tenant host 106 may include computing resources (e.g., computing resources, storage resources, networking resources, etc.) dedicated to individual tenants. The vulnerability analysis system 110 may use the threat detection model 112 to detect that the compromised tenant 2 104-2 has been compromised by a certain type of malicious network attack.

[0029] The threat detection model 112 may be any model now known or later developed for automatically identifying network threats, network intrusions, network attacks, or other malicious behavior from internal and / or external actors. In some embodiments, the threat detection model 112 maintains (or accesses) a database of known vulnerability signatures. Such known vulnerability signatures may be in the form of hashes, digests, or other identifiers of known vulnerabilities reduced to a sequence of alphanumeric characters. In some embodiments, such known vulnerability signatures may be in the form of recorded event sequences, hardware events, software events, and / or other events that can individually or collectively indicate a vulnerability.

[0030] In some embodiments, the threat detection model 112 utilizes machine learning to automate the threat detection process. In such embodiments, the threat detection model 112 may employ any number of machine learning algorithms, such as, but not limited to, natural language processing (NLP), decision tree learning, association rule learning, artificial neural networks, deep learning, inductive logic programming, support vector machines, clustering, Bayesian networks, reinforcement learning, representation learning, similarity / metric training, sparse dictionary learning, genetic algorithms, rule-based learning, and / or other machine learning techniques.

[0031] For example, threat detection model 112 may be configured to perform machine learning on data generated by one or more multi-tenant hosts 102 and / or one or more tenants 104. Such data may include, for example, activity logs, access logs, CPU usage, memory usage, network bandwidth usage, executed instruction set characteristics, and / or other data generated by applications, portals, interfaces, hypervisors, operating systems, virtual machines, containers, and / or other components of multi-tenant hosts 102 and / or tenants 104. The threat detection model 112 may be trained on the data using one or more of the following example techniques: K-nearest neighbor (KNN), learning vector quantization (LVQ), self-organizing map (SOM), logistic regression, ordinary least squares regression (OLSR), linear regression, stepwise regression, multivariate adaptive regression splines (MARS), ridge regression, least absolute shrinkage and selection operator (LASSO), elastic net, least angle regression (LARS), probabilistic classifier, naive Bayes classifier, binary classifier, linear classifier, hierarchical classifier, canonical correlation analysis (CCA), factor analysis, independent component analysis (ICA), linear discriminant analysis (LDA), multidimensional scaling (MDS), non-negative metric factorization (NMF), partial least squares regression (PLSR). Principal component analysis (PCA), principal component regression (PCR), Sammon map, t-distributed stochastic neighbor embedding (t-SNE), bootstrap aggregation, ensemble average, gradient boosted decision tree (GBRT), gradient boosting machine (GBM), inductive bias algorithm, Q-learning, state-action-reward-state-action (SARSA), temporal difference (TD) learning, apriori algorithm, equivalence class transformation (ECLAT) algorithm, Gaussian process regression, gene expression programming, group data processing method (GMDH), inductive logic programming, Instance-based learning, logistic model tree, information fuzzy network (IFN), hidden Markov model, Gaussian naive Bayes, multinomial naive Bayes, averaged single correlation estimator (AODE), Bayesian network (BN), classification and regression tree (CART), chi-square automatic interaction detection (CHAID), expectation maximization algorithm, feedforward neural network, logistic learning machine, self-organizing map, single link clustering, fuzzy clustering, hierarchical clustering, Boltzmann machine, convolutional neural network, recurrent neural network, hierarchical temporal memory (HTM), and / or other machine learning techniques. After training, the threat detection model 112 can ingest data from the multi-tenant host 102 and / or tenant 104 and output an identification of a compromised tenant (e.g., compromised tenant 2 104-2).

[0032] Figure 2 A block diagram of an example computing environment 200 for implementing multi-tenant security during live migration of multiple tenants 104 to a single-tenant host 106 according to some embodiments of the present disclosure is shown. In some embodiments, the example computing environment 200 is Figure 1 The example computing environment 200 includes the example computing environment 100 previously described. Figure 1 Single-tenant host 106, tenants 104, network 108, vulnerability analysis system 110, and threat detection model are described.

[0033] However, in Figure 2 , in response to detecting a compromised tenant 2 104-2, aspects of the present disclosure may perform a live migration of the tenants 104 from the multi-tenant host 102 to the corresponding single-tenant host 106. Thus, tenant 1 104-1 is migrated to single-tenant host 1 106-1, compromised tenant 2 104-2 is migrated to single-tenant host 2 106-2, and tenant N 104-N is migrated to single-tenant host N 106-N. At the same time, the multi-tenant host 102 is disabled (as shown by disabled multi-tenant host 202). Advantageously, by performing a live migration of the tenants 104 from the multi-tenant host 102 to the single-tenant host 106, aspects of the present disclosure may (i) limit the spread of the detected vulnerability (e.g., by isolating the compromised tenant 2 104-2 to the single-tenant host 106), and (ii) preserve the availability of workloads for most, if not all, tenants 104 (e.g., by allowing workloads associated with the tenants 104 to remain functional during and after the live migration).

[0034] Additionally, as shown in the example computing environment 200, the vulnerability analysis system 110 collects and archives a disabled multi-tenant host activity log 204. The disabled multi-tenant host activity log 204 can be retrieved from the disabled multi-tenant host 202 and includes event information associated with the multi-tenant host 102 that can be used to determine the nature of the vulnerability, the extent of the vulnerability, and / or retain tenant information.

[0035] The vulnerability analysis system 110 may also record the compromised tenant identifier 206 and the collocated tenant identifier 208. The compromised tenant identifier 206 and the collocated tenant identifier 208 may be application identifiers, instance identifiers, VM identifiers, container identifiers, and / or other identifiers used to distinguish a compromised tenant (e.g., compromised tenant 2 104-2 in the case of compromised tenant identifier 206) from benign tenants that are hosted on the same multi-tenant host 102 but are not themselves vulnerable (e.g., tenant 1 104-1 and tenant N 104-N in the case of collocated tenant identifier 208).

[0036] Figure 3 A block diagram of an example computing environment 300 is shown that implements multi-tenant security during live migration of a benign tenant to a new multi-tenant host 302 according to some embodiments of the present disclosure. In some embodiments, the example computing environment 300 occurs Figure 2After the example computing environment 200 of FIG. 300, the example computing environment includes the example computing environment 300 previously described in Figure 1 and Figure 2 The disabled multi-tenant host 202, tenant 104, single-tenant host N 106-N, network 108, vulnerability analysis system 110, threat detection model 112, disabled multi-tenant host activity log 204, compromised tenant identifier 206 and collocated tenant identifier 208 discussed in.

[0037] However, Figure 3 A new multi-tenant host 302 is also included. Benign tenants (e.g., Tenant 1 104-1 and Tenant N 104-N) can be live migrated from the single-tenant host 106 to the new multi-tenant host 302, thereby enabling the benign tenants to be hosted similarly to before the detection of the compromised Tenant 2 104-2. Although the new multi-tenant host 302 is shown as being different from the disabled multi-tenant host 202 (which is disabled relative to the multi-tenant host 102), in some embodiments, the new multi-tenant host 302 can be a new instance or otherwise protected version of the disabled multi-tenant host 202. In some embodiments, prior to live migration of the benign tenants to the new multi-tenant host 302, additional testing or monitoring is performed to verify that the benign tenants are in fact benign.

[0038] Figure 3 Further shown is a notification 304 generated by the vulnerability analysis system 110. The notification 304 may include information such as a vulnerability signature 306 (e.g., a hash, digest, sequence of events, and / or other information indicating a particular vulnerability) and vulnerability details 308 (e.g., information related to the disabled multi-tenant host activity log 204, the compromised tenant identifier 206, and / or the concatenated tenant identifier 206). In some embodiments, the notification 304 is sent to a security administrator who performs a final disposition of the security incident. For example, the security administrator may confirm the vulnerability and require that the single-tenant host 2 106-2 become a disabled single-tenant host 310, and thereby end the workload associated with the compromised tenant 2 104-2. As another example, the security administrator may deem the vulnerability to be a false positive, and in such a case, the compromised tenant 2 104-2 may be reclassified as benign and migrated to a new multi-tenant host 302. Regardless, the security administrator's feedback (e.g., the final disposition) may be fed back into the threat detection model 112 for the purpose of refining the parameters associated with the threat detection model. For example, feedback including vulnerability signature 306 and / or vulnerability details 308 may be used as new instances of training data for threat detection model 112 .

[0039] Figure 4A flowchart of an example method 400 for implementing multi-tenant security using a single-tenant host according to some embodiments of the present disclosure is shown. In some embodiments, the method 400 is implemented by a multi-tenant cloud security program, a vulnerability analysis system 110, a server, a computer, a processor, a combination of hardware and software, and / or any combination of the above.

[0040] Operation 402 includes detecting malicious activity on a compromised application in a multi-tenant host. A multi-tenant host may be associated with underlying computing resources (e.g., a server) to serve workloads from multiple tenants. Thus, a multi-tenant host may include one or more VMs, containers, hypervisors, and / or other virtualization technologies for sharing a single set of computing resources between multiple tenants. A threat detection model may be used to detect malicious activity. Malicious activity may occur on a single application of a single tenant, multiple applications of a single tenant, or multiple applications of multiple tenants.

[0041] Operation 404 includes automatically performing a live migration of each tenant in the tenant to a single-tenant host. Advantageously, the live migration maintains the availability of each tenant's application. Therefore, the tenant experiences little or no perceptible downtime during the live migration. The live migration may utilize a pre-copy memory migration technique, a post-copy memory migration technique, or another live migration technique now known or later developed. In the pre-copy memory migration technique, the hypervisor may copy memory pages from a source to a destination while the associated VM remains operational at the source. The memory pages are re-copied until the rate at which the pages are re-copied exceeds the rate at which the memory pages are changed. Subsequently, the VM is stopped at the source, any detected changed memory pages are electronically copied to the destination, and the VM is resumed at the destination. In the pre-copy memory migration, the VM may experience downtime in the range of milliseconds to seconds.

[0042] In the post-copy memory migration technique, the VM is suspended at the source, and a subset of the VM's execution state (e.g., CPU state, registers, non-pageable memory, etc.) is transferred to the destination. The VM is then resumed at the destination, while the source performs pre-paging (e.g., pushes the remaining memory pages of the VM from the source to the destination). While executing on the destination, if the VM accesses a memory page that has not yet been transferred from the source to the destination, a page fault occurs that is redirected to the source, and the source provides the fault page.

[0043] Operation 406 includes mitigating malicious activity on the compromised application in the migrated single-tenant host. Operation 406 may include generating a notification, terminating the compromised application, terminating (or isolating) the migrated single-tenant host, and / or other mitigation activities.

[0044] Operation 408 includes archiving activity logs of compromised applications and benign applications previously running on the multi-tenant system. Operation 408 can preserve information relevant to an investigation of the duration, extent, and / or nature of the vulnerability. In addition, operation 408 can preserve tenant data (e.g., in the event that a compromised application is subsequently terminated on a migrated single-tenant host).

[0045] Operation 410 includes automatically performing a live migration of each benign tenant to a new multi-tenant host. As previously discussed, the live migration can be a pre-copy memory migration, a post-copy memory migration, or another live migration technique now known or later developed. Advantageously, method 400 reduces the chance of a vulnerability on a first tenant infecting other tenants on a multi-tenant host. In addition, method 400 maintains the availability of applications associated with the benign tenants.

[0046] Figure 5 A flowchart of an example method 500 for training and refining a threat detection model for multi-tenant security according to some embodiments of the present disclosure is shown. In some embodiments, the method 500 is implemented by a multi-tenant cloud security program, a vulnerability analysis system 110, a server, a computer, a processor, a combination of hardware and software, and / or any combination of the above ... Figure 4 One or more operations of method 400 occur in series.

[0047] Operation 502 includes training a threat detection model. The threat detection model may be trained using any machine learning technique previously mentioned, otherwise known, or later developed.

[0048] Operation 504 includes detecting malicious activity using a trained threat detection model. As an example, operation 504 can detect malicious activity by matching a hash or digest of a known security vulnerability with a hash or digest of a running file, workload, and / or application in a multi-tenant host. As another example, operation 504 can detect malicious activity by matching a sequence of events and / or characteristics of a known security vulnerability with a sequence of events and / or characteristics observed on a running workload or application in a multi-tenant host. As yet another example, operation 504 can detect malicious activity by inputting a lot of data into a trained threat detection model and receiving an indication of a vulnerability in a multi-tenant host (e.g., the type of vulnerability, the location of the vulnerability, etc.) as an output from the trained threat detection model.

[0049] Operation 506 includes receiving feedback related to the malicious activity. For example, in response to sending a notification to a security administrator, the security administrator can identify the malicious activity as a real vulnerability or a false positive.

[0050] Operation 508 includes refining parameters associated with the threat detection model based on the feedback. For example, operation 508 may include retraining all or a portion of the threat detection model using the feedback included as additional training data. In other embodiments, parameters associated with the threat detection model may be adjusted manually or automatically based on the feedback.

[0051] Figure 6 A block diagram of an example computing environment 600 for implementing multi-tenant security when identifying unauthorized clones of tenants according to some embodiments of the present disclosure is shown. The example computing environment 600 includes a multi-tenant host 602, one or more sandbox containers 606, and a vulnerability analysis system 610 that are communicatively coupled to each other via a network 608. In some embodiments, the multi-tenant host 602 and the vulnerability analysis system 610 are connected to each other. Figure 1 The multi-tenant host 102 is consistent with the network 608 Figure 1 The network 108 is consistent with the vulnerability analysis system 610 and / or the vulnerability analysis system 610 is consistent with the network 108 Figure 1 The multi-tenant host 602 hosts a plurality of tenants 604, such as tenant 1 604-1, tenant 2 604-2, and tenant N 604-N, where N is any integer greater than or equal to 1.

[0052] Vulnerability analysis system 610 may include clone detection model 612, wherein clone detection model 612 may detect unauthorized clones of tenants 604 in multi-tenant host 602. In some embodiments, clone detection model 612 utilizes the previously described Figure 1 The machine learning algorithm discussed in the threat detection model 112 of the present disclosure may be used. In some embodiments, the clone detection model 612 may utilize a spot image 614 to identify unauthorized clones of a tenant. The spot image 614 may refer to intermittent snapshots of the tenants 604 that may be compared to each other to distinguish the original tenants 604 from unauthorized clones of these tenants. For example, the clone detection model 612 may detect unauthorized clones of Tenant 2 604-3. Upon detecting an unauthorized clone of Tenant 2 604-3, aspects of the present disclosure may utilize one or more sandbox containers 606 to limit the spread of malicious activity associated with the unauthorized clone of Tenant 2 604-3.

[0053] Figure 7 A block diagram of an example computing environment 700 is shown that implements multi-tenant security when isolating multiple tenants 604 in one or more sandbox containers 606 according to some embodiments of the present disclosure. In some embodiments, the computing environment 700 occurs in Figure 6 After 600 computing environments.

[0054] In computing environment 700, multi-tenant host 602 is disabled, as shown by disabled multi-tenant host 702. In addition, tenants 604 are migrated (e.g., using live migration technology) to one or more sandbox containers 606. Sandbox container 606 can refer to a network container with pre-configured controls that are configured to limit the spread of malicious activities or vulnerability attacks while enabling tenants 604 to continue to execute workloads. For example, when tenants 604 are placed in sandbox container 606, they may have restrictions such as limited remote login capabilities, limited size of file uploads or downloads, limited access (e.g., read-only access only), not accepting unknown connection requests, and / or other restrictions for reducing the attack surface available to malicious entities. When tenants 604 are in sandbox container 606, they can be subject to increased monitoring to identify and resolve any detected malicious activities. Such monitoring can be related to configuration, application behavior, file behavior, user behavior, registry keys, traffic analysis, binary file analysis, etc.

[0055] The sandbox container 606 can be implemented as a new instance of the multi-tenant host 602 or on a completely different host. Although a single sandbox container 606 is shown hosting all tenants 604, in other embodiments, multiple sandbox containers 606 are used, each of which hosts at least one tenant 604 but less than all tenants 604.

[0056] In some embodiments, the tenant 604 remains in the sandbox container 606 for a preconfigured amount of time (e.g., 24 hours, 48 ​​hours, etc.), with enhanced monitoring, testing, and / or remediation protocols in place to mitigate any detected malicious activity. For example, in some embodiments, the vulnerability analysis system 610 can utilize the spot image 614 to distinguish the original tenant 2 604-2 from the unauthorized clone of tenant 2 604-3. As a result of the distinction, aspects of the present disclosure can (i) delete the unauthorized clone of tenant 2 604-3 and retain the original tenant 2 604-2 if the original tenant 2 604-2 does not appear to be otherwise compromised; or (ii) delete both the original tenant 2 604-2 and the unauthorized clone of tenant 2 604-3 and create a reimaged tenant 2.

[0057] Figure 8 A block diagram of an example computing environment 800 is shown that implements multi-tenant security when re-imaging unauthorized clones and their associated tenants and implementing the re-imaged tenants and other benign tenants on a new multi-tenant host 802 in accordance with some embodiments of the present disclosure. In some embodiments, the example computing environment 800 occurs Figure 7 Following is the example computing environment 700 .

[0058] In the example computing environment 800, a new multi-tenant host 802 is created. The new multi-tenant host 802 may be a new instance of the original multi-tenant host 602 or a completely different multi-tenant host. Aspects of the present disclosure may migrate (e.g., using live migration techniques) benign tenants (e.g., Tenant 1 604-1 and Tenant N 604-N) to the new multi-tenant host 802. In addition, aspects of the present disclosure may instantiate a re-imaged Tenant 2 804-2 on the new multi-tenant host 802. The re-imaged Tenant 2 804-2 may replace the unauthorized clones of the original Tenant 2 604-2 and Tenant 2 604-3. The re-imaged Tenant 2 804-2 may be re-imaged based on information related to the original Tenant 2 604-2 in the spot image 614. For example, the re-imaged Tenant 2 804-2 may be based on a snapshot associated with the original Tenant 2 604-2 contained in the spot image 614 that has not been attacked by a vulnerability.

[0059] Fig. 9 A flowchart of an example method 900 for implementing multi-tenant security using one or more sandbox containers according to some embodiments of the present disclosure is shown. In some embodiments, the method 900 is implemented by a multi-tenant cloud security program, a vulnerability analysis system 610, a server, a computer, a processor, a combination of hardware and software, and / or any combination of the above.

[0060] Operation 902 includes detecting unauthorized clones of a first tenant in a multi-tenant system. In some embodiments, operation 902 detects unauthorized clones using a clone detection model and / or one or more spot images (e.g., a collection of snapshots of various tenants over time). For example, operation 902 may randomly compare the current state of a tenant with a previous snapshot of the tenant in the spot image to detect possible unauthorized clones. Similarly, operation 902 may analyze security file configuration, registry changes, traffic behavior, memory allocation, storage capacity, automatic deletion capabilities, CPU usage, running services, password changes, executed scripts, application history, startup services, disabled policies, file renaming, host names, storage locations, created files, file paths, binary libraries, modified dates and / or times, toolkits (e.g., vmkfstools), silence, creation date / time, modification date / time, access date / time, and / or other information as part of detecting unauthorized clones. In some embodiments, operation 902 utilizes a scoring function including some or all of the above characteristics to cumulatively determine the risk, likelihood, or probability of unauthorized clones.

[0061] Operation 904 includes automatically isolating tenants of a multi-tenant system in one or more sandbox containers. The sandbox container may be implemented as a new instance on a multi-tenant host or on a completely different host. In some embodiments, operation 904 involves performing a live migration of a tenant from a multi-tenant host to a sandbox container. The sandbox container may limit the functionality of the tenant to limit further malicious activity stemming from a vulnerability attack leading to unauthorized cloning. However, the sandbox container still enables continuous availability of workloads associated with the tenant.

[0062] Operation 906 includes determining a security image corresponding to the first tenant. Operation 906 may utilize the spot image to identify an unexploited snapshot of the first tenant that may be used to reimage the first tenant.

[0063] Operation 908 includes re-imaging the first tenant on a new multi-tenant host using the secure image determined in operation 906. The new multi-tenant host may be a new instance of the original multi-tenant host or a new host entirely.

[0064] Operation 910 includes verifying the security of each tenant in the sandbox container. Operation 910 includes verifying that each tenant remaining in the sandbox container is actually a benign tenant (e.g., not exploited by a vulnerability that results in unauthorized cloning). In some embodiments, operation 910 includes implementing mitigation measures to remove any vulnerabilities on any other tenant in the sandbox container.

[0065] Operation 912 includes migrating each tenant from the sandbox container to the new multi-tenant host. In some embodiments, operation 912 performs a live migration as described above.

[0066] Advantageously, Figures 6 to 8 An embodiment of the present disclosure is shown, which can automatically detect malicious activities (e.g., unauthorized cloning), isolate tenants of a multi-tenant host including malicious behavior in a sandbox container, resolve the malicious activities in the sandbox container while maintaining the utility of the tenant, and migrate the tenant to a new multi-host system after resolving the malicious activities.

[0067] Various aspects of the present disclosure are described by narrative text, flow charts, block diagrams of computer systems, and / or block diagrams of machine logic included in computer program product (CPP) embodiments. With respect to any flow chart, depending on the technology involved, the operations may be performed in an order different from the order shown in a given flow chart. For example, again depending on the technology involved, two operations shown in successive flow chart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that at least partially overlaps in time.

[0068] Computer program product embodiments ("CPP embodiments" or "CPP") are terms used in this disclosure to describe any collection of one or more storage media (also referred to as "media") collectively included in a set of one or more storage devices that collectively include machine-readable code corresponding to instructions and / or data for performing the computer operations specified in a given CPP claim. A "storage device" is any tangible device that can retain and store instructions for use by a computer processor. Without limitation, a computer-readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include: magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanical encoding devices (such as punch cards or pits / land formed in a major surface of a disk), or any suitable combination of the foregoing. The term computer-readable storage medium as used in this disclosure should not be interpreted as storage in the form of a transitory signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide, a light pulse through a fiber optic cable, an electrical signal transmitted through an electric wire and / or other transmission medium. As will be understood by those skilled in the art, during normal operation of a storage device, such as during access, defragmentation, or garbage collection, data is typically moved at some occasional point in time, but this does not make the storage device transitory because the data is not transitory when it is stored.

[0069] Fig.10A block diagram of an example computing environment according to some embodiments of the present disclosure is shown. The computing environment 1000 includes an example of an environment for executing at least some of the computer codes involved in performing the methods of the present invention, such as the multi-tenant security code 1200. In addition to the multi-tenant security code 1200, the computing environment 1000 also includes, for example, a computer 1001, a wide area network (WAN) 1002, an end-user device (EUD) 1003, a remote server 1004, a public cloud 1005, and a private cloud 1006. In this embodiment, the computer 1001 includes a processor set 1010 (including a processing circuit 1020 and a cache 1021), a communication structure 1011, a volatile memory 1012, a persistent storage device 1013 (including an operating system 1022 and the multi-tenant security code 1200, as described above), a peripheral device set 1014 (including a user interface (UI), a device set 1023, a storage device 1024, and an Internet of Things (IoT) sensor set 1025) and a network module 1015. The remote server 1004 includes a remote database 1030. The public cloud 1005 includes a gateway 1040, a cloud orchestration module 1041, a host physical machine set 1042, a virtual machine set 1043, and a container set 1044.

[0070] Computer 1001 may take the form of a desktop computer, laptop computer, tablet computer, smart phone, smart watch or other wearable computer, mainframe computer, quantum computer, or any other form of computer or mobile device now known or developed in the future that is capable of running programs, accessing a network, or querying a database (such as remote database 1030). As is well understood in the field of computer technology, and depending on the technology, the execution of the computer-implemented method may be distributed among multiple computers and / or among multiple locations. On the other hand, in this presentation of computing environment 1000, the detailed discussion focuses on a single computer, particularly computer 1001, to keep the presentation as simple as possible. Computer 1001 may be located in the cloud, even though the computer 1001 is located in the cloud. Fig.10 On the other hand, except to any extent that can be indicated with certainty, there is no requirement that computer 1001 be in the cloud.

[0071] Processor set 1010 includes one or more computer processors of any type now known or developed in the future. Processing circuit 1020 may be distributed over multiple packages, for example, multiple coordinated integrated circuit chips. Processing circuit 1020 may implement multiple processor threads and / or multiple processor cores. Cache 1021 is a memory located in (one or more) processor chip packages, and is typically used for data or code that should be available for quick access by threads or cores running on processor set 1010. Cache memory is typically organized into multiple levels based on relative proximity to the processing circuit. Alternatively, some or all of the caches for the processor set may be located "off-chip". In some computing environments, processor set 1010 may be designed to work with qubits and perform quantum computing.

[0072] Computer-readable program instructions are typically loaded onto computer 1001 to cause processor set 1010 of computer 1001 to perform a series of operating steps to implement a computer-implemented method, such that the instructions so executed will instantiate the method specified in the flowchart and / or the narrative description of the computer-implemented method included in this document (collectively referred to as "the method of the present invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 1021 and other storage media discussed below. The program instructions and associated data are accessed by processor set 1010 to control and direct the execution of the method of the present invention. In computing environment 1000, at least some of the instructions for executing the method of the present invention may be stored in multi-tenant security code 1200 in persistent storage 1013.

[0073] The communication fabric 1011 is the signal conduction paths that allow the various components of the computer 1001 to communicate with each other. Typically, the fabric is made of switches and conductive paths, such as those that make up a bus, a bridge, physical input / output ports, etc. Other types of signal communication paths may be used, such as fiber optic communication paths and / or wireless communication paths.

[0074] The volatile memory 1012 is any type of volatile memory now known or developed in the future. Examples include dynamic type random access memory (RAM) or static type RAM. Typically, volatile memory is characterized by random access, but this is not required unless expressly indicated. In the computer 1001, the volatile memory 1012 is located in a single package and is internal to the computer 1001, but alternatively or additionally, the volatile memory can be distributed over multiple packages and / or located externally relative to the computer 1001.

[0075] Persistent storage 1013 is any form of non-volatile storage for computers known now or developed in the future. The non-volatility of the storage means that the stored data is maintained regardless of whether power is supplied to computer 1001 and / or directly to persistent storage 1013. Persistent storage 1013 may be a read-only memory (ROM), but typically at least a portion of the persistent storage allows data to be written, deleted, and rewritten. Some familiar forms of persistent storage include disks and solid-state storage devices. Operating system 1022 may take several forms, such as various known proprietary operating systems or operating systems of the open source portable operating system interface type using a kernel. The code included in multi-tenant security code 1200 typically includes at least some of the computer code involved in performing the method of the present invention.

[0076] The peripheral device set 1014 contains a collection of peripheral devices of the computer 1001. The data communication connection between the peripheral devices and other components of the computer 1001 can be implemented in various ways, such as a Bluetooth connection, a near field communication (NFC) connection, a connection by a cable (such as a universal serial bus (USB) type cable), a plug-in type connection (e.g., a secure digital (SD) card), a connection through a local area communication network, and even a connection through a wide area network (such as the Internet). In various embodiments, the UI device set 1023 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smart watches), keyboards, mice, printers, touchpads, game controllers, and tactile devices. The storage device 1024 is an external storage device, such as an external hard drive, or a pluggable storage device, such as an SD card. The storage device 1024 can be persistent and / or volatile. In some embodiments, the storage device 1024 can take the form of a quantum computing storage device for storing data in the form of quantum bits. In embodiments where it is necessary for computer 1001 to have a large amount of storage (e.g., where computer 1001 locally stores and manages a large database), the storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. IoT sensor group 1025 consists of sensors that can be used in IoT applications. For example, one sensor may be a thermometer, while another sensor may be a motion detector.

[0077] The network module 1015 is a collection of computer software, hardware, and firmware that allows the computer 1001 to communicate with other computers via the WAN 1002. The network module 1015 may include hardware (such as a modem or Wi-Fi signal transceiver), software for packetizing and / or depacketizing data transmitted over a communication network, and / or web browser software for transmitting data over the Internet. In some embodiments, the network control function and the network forwarding function of the network module 1015 are executed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing software defined networks (SDN)), the control function and forwarding function of the network module 1015 are executed on physically separated devices so that the control function manages several different network hardware devices. Computer-readable program instructions for executing the method of the present invention can typically be downloaded to the computer 1001 from an external computer or an external storage device via a network adapter card or a network interface included in the network module 1015.

[0078] WAN 1002 is any wide area network (e.g., the Internet) capable of transmitting computer data over non-local distances by any technology now known or developed in the future for transmitting computer data. In some embodiments, the WAN may be replaced and / or supplemented by a local area network (LAN) (such as a Wi-Fi network) designed to transmit data between devices located in a local area. WANs and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0079] End-user device (EUD) 1003 is any computer system used and controlled by an end-user (e.g., a customer of an enterprise operating computer 1001), and may take any of the forms discussed above in connection with computer 1001. EUD 1003 typically receives helpful and useful data from the operation of computer 1001. For example, in the hypothetical case where computer 1001 is designed to provide recommendations to an end-user, the recommendations would typically be transmitted from network module 1015 of computer 1001 to EUD 1003 via WAN 1002. In this manner, EUD 1003 may display or otherwise present the recommendations to the end-user. In some embodiments, EUD 1003 may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, or the like.

[0080] Remote server 1004 is any computer system that provides at least some data and / or functionality to computer 1001. Remote server 1004 may be controlled and used by the same entity that operates computer 1001. Remote server 1004 represents a machine that collects and stores useful and useful data for use by other computers, such as computer 1001. For example, in the hypothetical case where computer 1001 is designed and programmed to provide recommendations based on historical data, then this historical data may be provided to computer 1001 from remote database 1030 of remote server 1004.

[0081] The public cloud 1005 is any computer system that can be used by multiple entities, which provides on-demand availability of computer system resources and / or other computer capabilities, especially data storage (cloud storage) and computing capabilities, without the need for direct active management by users. Cloud computing generally uses resource sharing to achieve consistency and economies of scale. The direct and active management of the computing resources of the public cloud 1005 is performed by the computer hardware and / or software of the cloud orchestration module 1041. The computing resources provided by the public cloud 1005 are generally implemented by virtual computing environments running on various computers that constitute the host physical machine set 1042, which is the range of physical computers in and / or available for the public cloud 1005. The virtual computing environment is generally in the form of a virtual machine from a virtual machine set 1043 and / or a container from a container set 1044. It should be understood that these VCEs can be stored as images and can be transmitted among and between various physical machine hosts as images or after instantiation of the VCE. Cloud orchestration module 1041 manages the transfer and storage of images, deploys new instantiations of VCEs and manages active instantiations of VCE deployments. Gateway 1040 is a collection of computer software, hardware and firmware that allows public cloud 1005 to communicate over WAN 1002 .

[0082] Some further explanation of virtualized computing environments (VCEs) will now be provided. A VCE can be stored as an "image." A new active instance of a VCE can be instantiated from an image. Two common types of VCEs are virtual machines and containers. Containers are VCEs that use operating system-level virtualization. This refers to an operating system feature in which the kernel allows the existence of multiple isolated user space instances (called containers). From the perspective of the programs running in them, these isolated user space instances typically behave like real computers. Computer programs running on a normal operating system can utilize all of the resources of the computer, such as connected devices, files and folders, network shares, CPU capabilities, and quantifiable hardware capabilities. However, programs running within a container can only use the contents of the container and the devices assigned to the container, a feature known as containerization.

[0083] Private cloud 1006 is similar to public cloud 1005, except that the computing resources are only available to a single enterprise. Although private cloud 1006 is depicted as communicating with WAN 1002, in other embodiments, the private cloud can be completely disconnected from the Internet and accessible only through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private cloud, community cloud, or public cloud types), typically implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the multiple constituent clouds. In this embodiment, both public cloud 1005 and private cloud 1006 are part of a larger hybrid cloud.

[0084] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram may represent a module, a segment or a subset of instructions, which includes one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions marked in the box may not occur in the order marked in the figure. For example, the two boxes shown in succession can actually be executed substantially simultaneously, or these boxes can sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each box illustrated in the block diagram and / or flow chart and the combination of boxes in the block diagram and / or flow chart can be implemented by a system based on dedicated hardware that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0085] Although it should be understood that the processing software (e.g., any software configured to perform any part of the previously described method and / or to implement any function previously described) can be deployed by loading it directly manually in the client, server, and agent computers via a storage medium such as a CD, DVD, etc., the processing software can also be automatically or semi-automatically deployed to the computer system by sending the processing software to a central server or a group of central servers. The processing software is then downloaded to the client computer that will execute the processing software. Alternatively, the processing software is sent directly to the client system via email. The processing software is then separated into a directory or loaded into a directory by executing a set of program instructions that separate the processing software into a directory. Another option is to send the processing software directly to a directory on the client computer hard drive. When there is a proxy server, the process will select the proxy server code, determine which computers to place the proxy server code on, send the proxy server code, and then install the proxy server code on the agent computer. The processing software will be sent to the proxy server, and then it will be stored on the proxy server.

[0086] Embodiments of the invention may also be delivered as part of a service engagement with a client company, non-profit organization, government entity, internal organizational structure, etc. These embodiments may include configuring a computer system to perform some or all of the methods described herein, and deploying software, hardware, and web services that implement some or all of the methods described herein. These embodiments may also include analyzing the operations of a client, creating recommendations in response to the analysis, building a system that implements a subset of the recommendations, integrating the system into existing processes and infrastructure, metering usage of the system, allocating costs to users of the system, and billing, invoicing (e.g., generating invoices), or otherwise receiving payment for usage of the system.

[0087] The terms used herein are only used for the purpose of describing specific embodiments and are not intended to limit various embodiments. As used herein, the singular forms "one", "an" and "the" are intended to also include plural forms unless the context clearly states otherwise. It will be further understood that when used in this specification, the terms "include" and / or "comprise" specify the existence of stated features, integers, steps, operations, elements and / or components, but do not exclude the existence or addition of one or more other features, integers, steps, operations, elements, components and / or their groups. In the previous detailed description of the example embodiments of various embodiments, reference is made to the accompanying drawings (where the same numbers represent the same elements), which form a part of this article, and in which specific example embodiments that can practice various embodiments are shown by way of illustration. These embodiments are described in sufficient detail to enable those skilled in the art to practice the embodiments, but other embodiments can be used, and logical, mechanical, electrical and other changes can be made without departing from the scope of the various embodiments. In the foregoing description, many specific details are set forth to provide a thorough understanding of the various embodiments. However, various embodiments can be practiced without these specific details. In other examples, known circuits, structures and techniques are not shown in detail to avoid blurring the embodiments.

[0088] Different instances of the word "embodiment" as used in this specification do not necessarily refer to the same embodiment, but they may refer to the same embodiment. Any data and data structures shown or described herein are examples only, and in other embodiments, different amounts of data, data types, fields, number and type of fields, field names, number and type of rows, records, entries, or organizations of data may be used. In addition, any data may be combined with logic so that a separate data structure may not be necessary. Therefore, the previous detailed description should not be considered to be limiting.

[0089] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, practical applications, or technical improvements to technologies found in the marketplace, or to enable those of ordinary skill in the art to understand the embodiments disclosed herein.

[0090] Although the present disclosure has been described in terms of specific embodiments, it is contemplated that changes and modifications will become apparent to those skilled in the art. Therefore, the following claims are intended to be interpreted as covering all such changes and modifications that fall within the true spirit and scope of the present disclosure.

[0091] Any advantages discussed in the present disclosure are exemplary advantages, and there may be embodiments of the present disclosure that achieve all, some, or none of any of the advantages discussed while remaining within the spirit and scope of the present disclosure.

[0092] A non-limiting list of embodiments is provided below to illustrate some aspects of the present disclosure. Example 1 is a computer-implemented method. The method includes detecting malicious activity on a compromised application in a multi-tenant host; automatically performing a live migration of each tenant in the multi-tenant host to a corresponding single-tenant host; mitigating the malicious activity on the compromised application migrated to the single-tenant host; and automatically performing another live migration of each benign tenant to a new multi-tenant host.

[0093] Example 2 includes features of Example 1. In this example, the multi-tenant host includes a plurality of virtual machines hosted on one or more shared servers, and wherein each respective single-tenant host includes a dedicated server for a tenant associated with the respective single-tenant host.

[0094] Example 3 includes the features of any of Examples 1 to 2. In this example, activity signatures are used to detect malicious activity.

[0095] Example 4 includes the features of any one of Examples 1 to 2. In this example, a machine learning model is used to detect malicious activity. Optionally, the method further includes: transmitting a notification based on the malicious activity to a network security administrator; and updating parameters associated with the machine learning model based on feedback provided by the network security administrator.

[0096] Example 5 includes the features of any one of Examples 1 to 4, including or excluding the optional features. In this example, the method further includes archiving activity logs of the compromised application and the benign application running on the multi-tenant host.

[0097] Example 6 is a computer-implemented method. The method includes detecting an unauthorized clone of a first tenant in a multi-tenant host; automatically isolating tenants of the multi-tenant host in a sandbox container; determining a security image corresponding to the first tenant; re-imaging the first tenant on a new multi-tenant host using the security image; verifying the security of each tenant in the sandbox container; and in response to verifying the security of each tenant in the sandbox container, migrating each tenant from the sandbox container to the new multi-tenant host.

[0098] Example 7 includes features of Example 6. In this example, the sandbox container includes restricted permissions and continued availability for workloads associated with each tenant of the multi-tenant host.

[0099] Example 8 includes the features of any one of Examples 6 to 7. In this example, unauthorized clones are detected using a spot image based on a previous snapshot of the first tenant and a current snapshot of the first tenant.

[0100] Example 9 includes the features of any one of Examples 6 to 7. In this example, a machine learning clone detection model is used to detect unauthorized clones.

[0101] Example 10 is a system. The system includes one or more computer-readable storage media storing program instructions; and one or more processors, which are configured to perform the method according to any one of Examples 1 to 9, including or excluding optional features, in response to executing the program instructions.

[0102] Example 11 is a computer program product. The computer program product includes one or more computer-readable storage media, and program instructions stored together on the one or more computer-readable storage media, the program instructions including instructions configured to cause one or more processors to perform a method according to any one of Examples 1 to 9, including or excluding optional features.

Claims

1. A computer-implemented method comprising: Detect malicious activity on compromised applications in multi-tenant hosts; Automatically perform live migration of each tenant in the multi-tenant host to a corresponding single-tenant host; Mitigating malicious activity on compromised applications migrated to single-tenant hosts; as well as Automatically perform another live migration of each benign tenant to the new multi-tenant host.

2. The method according to claim 1, wherein: The multi-tenant host includes a plurality of virtual machines hosted on one or more shared servers, and wherein each respective single-tenant host includes a dedicated server for a tenant associated with the respective single-tenant host.

3. The method according to claim 1, wherein: Activity signatures are used to detect the malicious activity.

4. The method according to claim 1, wherein: A machine learning model is used to detect the malicious activity.

5. The method according to claim 4, wherein: The method further comprises: transmitting notifications based on the malicious activity to network security administrators; and Parameters associated with the machine learning model are updated based on feedback provided by the network security administrator.

6. The method according to claim 1, further comprising: Activity logs of compromised applications and benign applications running on the multi-tenant host are archived.

7. A system comprising: one or more computer-readable storage media storing program instructions; as well as One or more processors, the one or more processors configured to perform a method in response to executing the program instructions, the method comprising: Detect malicious activity on compromised applications in multi-tenant hosts; Automatically perform live migration of each tenant in the multi-tenant host to a corresponding single-tenant host; Mitigating malicious activity on compromised applications that have been migrated to single-tenant hosts; and Automatically perform another live migration of each benign tenant to the new multi-tenant host.

8. The system according to claim 7, wherein: The multi-tenant host includes a plurality of virtual machines hosted on one or more shared servers, and wherein each respective single-tenant host includes a dedicated server for a tenant associated with the respective single-tenant host.

9. The system according to claim 7, wherein: Activity signatures are used to detect the malicious activity.

10. The system according to claim 7, wherein: A machine learning model is used to detect the malicious activity.

11. The system according to claim 10, wherein: The method further comprises: transmitting notifications based on the malicious activity to network security administrators; and Parameters associated with the machine learning model are updated based on feedback provided by the network security administrator.

12. The system according to claim 7, further comprising: Activity logs of compromised applications and benign applications running on the multi-tenant host are archived.

13. A computer program product comprising one or more computer-readable storage media and program instructions stored together on the one or more computer-readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method, the method comprising: Detect malicious activity on compromised applications in multi-tenant hosts; Automatically perform live migration of each tenant in the multi-tenant host to a corresponding single-tenant host; Mitigating malicious activity on compromised applications migrated to single-tenant hosts; as well as Automatically perform another live migration of each benign tenant to the new multi-tenant host.

14. The computer program product of claim 13, wherein: The multi-tenant host includes a plurality of virtual machines hosted on one or more shared servers, and wherein each respective single-tenant host includes a dedicated server for a tenant associated with the respective single-tenant host.

15. The computer program product of claim 13, wherein: Activity signatures are used to detect the malicious activity.

16. The computer program product of claim 13, wherein: A machine learning model is used to detect the malicious activity.

17. The computer program product of claim 16, wherein: The method further comprises: transmitting notifications based on the malicious activity to network security administrators; and Parameters associated with the machine learning model are updated based on feedback provided by the network security administrator.

18. The computer program product of claim 13, further comprising: Activity logs of compromised applications and benign applications running on the multi-tenant host are archived.

19. A computer-implemented method comprising: Detecting unauthorized clones of a first tenant in a multi-tenant host; Automatically isolating tenants of the multi-tenant host in a sandbox container; Determining a security image corresponding to the first tenant; re-imaging the first tenant on a new multi-tenant system using the secure image; Verify the security of each tenant in the sandbox container; as well as In response to verifying the security of each tenant in the sandbox container, each tenant is migrated from the sandbox container to a new multi-tenant host.

20. The method according to claim 19, wherein: The sandbox container includes restricted permissions and continued availability for workloads associated with each tenant of the multi-tenant host.

21. The method according to claim 19, wherein: The unauthorized clone is detected using a spot image based on a previous snapshot of the first tenant and a current snapshot of the first tenant.

22. The method according to claim 19, wherein: A machine learning clone detection model is used to detect the unauthorized clones.

23. A computer program product comprising one or more computer-readable storage media and program instructions stored together on the one or more computer-readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising: Detecting unauthorized clones of a first tenant in a multi-tenant host; Automatically isolating tenants of the multi-tenant host in a sandbox container; Determining a security image corresponding to the first tenant; re-imaging the first tenant on a new multi-tenant system using the secure image; Verify the security of each tenant in the sandbox container; as well as In response to verifying the security of each tenant in the sandbox container, each tenant is migrated from the sandbox container to a new multi-tenant host.

24. The computer program product of claim 23, wherein: The sandbox container includes restricted permissions and continued availability for workloads associated with each tenant of the multi-tenant host.

25. The computer program product of claim 23, wherein: The unauthorized clone is detected using a spot image based on a previous snapshot of the first tenant and a current snapshot of the first tenant.

Images