Cloud API Event Sequence Modeling for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud security products struggle to detect anomalous activities in cloud computing environments due to the high volume and complexity of cloud activity traces, making it difficult to identify attackers' lateral movements and leading to inevitable security breaches and data loss, as they are limited by their inability to detect previously unseen threats.
Innovation Solution
A deep learning anomaly detection model, specifically an encoder-decoder machine-learning model, is trained on historical cloud application programming interface (API) events to predict expected next events, flagging candidate anomalies for further evaluation based on impact score and contextual events, and notifying administrators of critical anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heuristic-based approaches are used to monitor cloud activity traces, then the system can provide basic security monitoring, but it fails to detect previously unseen threats and anomalous activities due to the high volume and complexity of cloud activity traces
Solution Approach 1:
The patent replaces traditional heuristic-based mechanical rule systems with a deep learning neural network model that automatically learns patterns from historical cloud activity traces. The neural network model processes sequences of API events using encoder-decoder architecture, substituting manual rule creation with automated machine learning-based anomaly detection that can identify previously unseen threats.
Solution Approach 2:
The patent introduces an intermediary processing layer consisting of event embedding, sequence construction, and neural network processing between the raw cloud activity traces and the anomaly detection output. This intermediary layer transforms high-volume, complex raw events into structured sequences that the deep learning model can effectively analyze, bridging the gap between raw data and meaningful security insights.
2Adaptability or versatility
If traditional security products monitor cloud activity traces, then they can identify known threats, but they cannot detect attackers' lateral movements and previously unseen threats due to limited detection capabilities
Solution Approach 1:
The patent performs preliminary actions by training the deep learning model on extensive historical cloud activity traces before deployment. The model learns normal behavior patterns and contextual relationships in advance, enabling it to detect anomalies including lateral movements and previously unseen threats when they occur, rather than relying on pre-defined rules that cannot adapt to new attack patterns.
Solution Approach 2:
The patent adds a temporal dimension to threat detection by analyzing sequences of events rather than isolated incidents. The encoder-decoder neural network processes event sequences, capturing contextual relationships and patterns across time, enabling detection of lateral movements and multi-stage attacks that traditional single-event analysis cannot identify.
3Loss of information
If cloud providers offer detailed logs and services to monitor customer activities, then customers gain visibility into their infrastructures, but the high volume and complexity of these logs make it difficult to identify security issues and anomalous activities
Solution Approach 1:
The patent extracts only the most relevant features and patterns from the high-volume cloud activity traces by using the deep learning model to identify significant deviations from normal behavior. Instead of requiring analysts to examine all logs, the system extracts and flags only the anomalous events that warrant attention, reducing information overload while maintaining comprehensive monitoring capability.
Solution Approach 2:
The patent creates a learned representation or copy of normal cloud activity patterns through the trained neural network model. This learned model serves as a reference that automatically compares against actual activity, enabling efficient anomaly detection without requiring manual analysis of every log entry. The model copies essential behavioral patterns that can be quickly evaluated for deviations.
Data Source
AI summary
Systems and methods for identifying anomalous activities in a cloud computing environment are provided. According to one embodiment, a customer's infrastructure may be fortified by leveraging deep learning technology (e.g., an encoder-decoder machine-learning (ML) model) to predict events in the cloud environment. During a training phase, the ML model may be trained to make a prediction regarding a next event based on a predetermined or configurable length of a sequence of contextual events. For example, historical events (e.g., cloud application programming interface (API) events logged to a cloud activity trace) observed within the customer's cloud infrastructure over the course of a particular date range may be split into appropriate event/context pairs and fed to the ML model. Subsequently, during a run-time anomaly detection phase, the ML model may be used to predict a next event based on a sequence of immediately preceding events to facilitate identification of anomalous activity.