Control Plane Log Anomaly Detection for Malicious Cloud Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing platforms face challenges in distinguishing between malicious and benign creation/deployment of compute resources, as malicious entities attempt to compromise accounts for crypto mining and other malicious activities, leading to significant financial loss for customers.
Innovation Solution
A malicious activity detector analyzes control plane logs to determine anomaly scores based on property sets and trend data, generating security alerts for potentially malicious operations, and mitigating such activities to conserve resources and reduce network load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security monitoring is used to detect malicious activity, then false positives increase and legitimate operations are blocked, but malicious activity still compromises resources
Solution Approach 1:
The system performs preliminary analysis by comparing each control plane operation against historical trend data before blocking it. This preliminary action allows the system to identify anomalies that deviate from established patterns while permitting operations that conform to normal behavior, thereby reducing false positives while maintaining security.
Solution Approach 2:
The system continuously updates trend data based on analyzed operations, creating a feedback loop that improves detection accuracy over time. By feeding back legitimate operation patterns into the trend data, the system learns to distinguish normal variations from actual malicious activity, reducing false positives while maintaining reliable detection.
2Measurement precision
If comprehensive log analysis is performed on all control plane operations, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system extracts only the essential properties from control plane operation logs that are relevant for anomaly detection, rather than analyzing complete log entries. By taking out only the critical comparison properties needed for trend analysis, the system maintains high detection accuracy while significantly reducing processing time and computational overhead.
3Reliability
If alert thresholds are set low to detect subtle malicious activity, then detection sensitivity increases, but false alarms increase and alert fatigue occurs
Solution Approach 1:
The system dynamically adjusts detection sensitivity based on the entity's historical behavior patterns stored in trend data. Rather than using fixed low thresholds that cause false alarms, the system adapts its detection criteria to each entity's normal operational variations, maintaining high sensitivity to actual malicious activity while filtering out false alarms caused by legitimate behavior changes.
Data Source
AI summary
Malicious activity detection is enabled for cloud computing platforms. A first log comprising a record of a first control plane operation executed by a cloud application associated with an entity is obtained. A plurality of second logs, each comprising a record of a respective second control plane operation executed in association with the entity, is obtained. A first property set is generated based on the first log and a second property set is generated based on the plurality of second logs. A malicious activity score indicative of a degree to which the first control plane operation is anomalous with respect to the entity is determined based on the first property set and the second property set. A determination that the first control plane operation potentially corresponds to malicious activity is made based on the malicious activity score and a security alert is generated.