Abnormal Activity Detection System for Cloud Resource Fraud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public cloud computing systems face vulnerabilities in resource usage, leading to fraudulent activities such as 'fraud storms' due to unauthorized subscriptions and high resource utilization, which can deplete available resources for authorized users, necessitating costly excess capacity to mitigate these issues.
Innovation Solution
An abnormal activity detection system generates prediction models for resource usage data, extracts features from past usage, and applies a classifier to identify abnormal usage patterns, determining errors and satisfying an established criterion to flag fraudulent activity, allowing for timely intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a cloud provider offers free subscriptions and uses CAPTCHA to prevent fraud, then user acquisition is improved, but the system becomes vulnerable to automated fraud storms that deplete resources
Solution Approach 1:
The system performs preliminary analysis of subscription patterns and resource usage behaviors before fraud storms deplete resources. By establishing baseline models of normal user behavior and detecting deviations in real-time, the system can identify and block fraudulent subscriptions before they cause resource exhaustion, thus maintaining both high user acquisition and resource availability
Solution Approach 2:
The system implements continuous feedback loops that monitor resource usage patterns, subscription rates, and user behaviors. When abnormal patterns are detected (indicating potential fraud storms), the system automatically adjusts resource allocation, blocks suspicious subscriptions, or triggers additional verification, thereby maintaining system reliability while preserving legitimate user acquisition
2Reliability
If a cloud provider provisions excess capacity to mitigate fraud storms, then resource availability is improved, but operational cost increases
Solution Approach 1:
The system dynamically adjusts resource provisioning based on real-time detection of fraud storm patterns. Instead of maintaining static excess capacity, the system scales resources up or down according to actual threat levels, using machine learning models to predict fraud storm onset and adjust capacity accordingly. This maintains high availability during attacks while minimizing costs during normal operation
Solution Approach 2:
The system changes operational parameters such as resource allocation thresholds, verification stringency, and monitoring intensity based on detected patterns. When fraud storms are detected, the system adjusts parameters to prioritize security and availability; during normal operation, parameters are relaxed to reduce costs, eliminating the need for permanent excess capacity
3Measurement precision
If the system monitors resource usage to detect fraud, then detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The monitoring system is segmented into multiple specialized components that analyze different aspects of resource usage independently (e.g., subscription pattern analysis, resource consumption analysis, user behavior analysis). Each segment processes specific data types with optimized algorithms, improving detection accuracy while distributing computational load efficiently across the system
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for identifying abnormal resource usage in a data center is provided. In some embodiments, the system employs a prediction model for each of a plurality of resources and an abnormal resource usage criterion. For each of a plurality of resources of the data center, the system retrieves current resource usage data for a current time and past resource usage data for that resource. The system then extracts features from the past resource usage data for that resource, predicts using the prediction model for that resource usage data for the current time based on the extracted features, and determines an error between the predicted resource usage data and the current resource usage data. After determining the error data for the resources, the system determines whether errors satisfy the abnormal resource usage criterion. If so, the system indicates that an abnormal resource usage has occurred