Cross Authorization Anomaly Detection for Cloud Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and mitigate suspicious cross authorizations in cloud storage environments, allowing attackers to exploit access privileges for unauthorized actions such as data exfiltration or malware insertion, which are difficult to detect due to the separation of identity and resource access management systems.
Innovation Solution
A system employing two trained anomaly detection models and a rule-based security indicator to analyze cross authorization events and post-elevation activities, generating security scores to identify and respond to suspicious actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate identity and resource access management systems are used, then system security and access control are improved, but detection of suspicious cross authorizations becomes more difficult
Solution Approach 1:
The patent combines separate identity and resource access management systems into a unified access management system that can detect suspicious cross authorizations. The system integrates identity management components (users, groups, roles) with resource access management components (storage accounts, containers, blobs) to monitor and analyze authorization patterns across previously separate system boundaries, enabling detection of abnormal cross-system authorization events while maintaining security.
2Measurement precision
If anomaly detection models analyze multiple perspectives of cross authorization events, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis of cross authorization events into multiple independent perspectives or views (e.g., user perspective, resource perspective, temporal perspective, contextual perspective). Each perspective is analyzed separately by specialized detection models, and results are aggregated to form a comprehensive security assessment. This segmentation improves detection accuracy by capturing different aspects of suspicious behavior while managing complexity through modular, specialized analysis components.
Data Source
AI summary
A system to detect abnormal cross authorizations and take action is described. The system determines whether cross authorization event applied to a first trained anomaly detection model and activity post cross authorization event applied to a second trained anomaly detection model is suspicious. An indicator score is determined from rule-based security indications applied to the cross authorization. A security action is taken based on application of the indicator score applied to a threshold.