Multitenant Activity Correlation for Cyberattack Campaign Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to detect rapid malware campaigns across multiple cloud tenants effectively, as localized detection tools often miss indicators of such attacks due to limited data access and computational inefficiencies.
Innovation Solution
Implement a multitenant shared activity analysis approach that automatically analyzes customer activity data across multiple tenants based on factors like similarity, time frame, and likelihood of shared activities to identify anomalies indicative of cyberattacks, using statistical methods and machine learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If localized detection tools are used to analyze single-tenant activity data, then detection simplicity and tenant data isolation are maintained, but detection precision and attack identification capability deteriorate due to limited data scope
Solution Approach 1:
The system segments detection into two layers: tenant-local detection tools that analyze individual tenant activity data, and a cloud-provided multitenant detection service that analyzes aggregated activity data across multiple tenants. This segmentation allows each layer to operate independently with appropriate complexity, while the cloud service provides enhanced detection precision by correlating patterns across tenant boundaries without requiring tenants to manage complex multitenant analysis infrastructure.
Solution Approach 2:
The cloud service acts as an intermediary that receives activity data from multiple tenants, performs multitenant correlation analysis, and returns detection results to individual tenants. This intermediary approach enables detection precision improvement through aggregated data analysis while maintaining tenant data isolation and avoiding the need for tenants to directly implement complex multitenant analysis systems.
2Measurement precision
If multitenant shared activity analysis is implemented across multiple tenants, then detection precision and attack campaign identification improve, but computational resource requirements and processing time increase
Solution Approach 1:
The system implements partial action by having the cloud service perform multitenant correlation analysis only on specific activity data types that are most indicative of attack campaigns (e.g., login events, process creations, network connections). Rather than analyzing all activity data from all tenants, the system focuses computational resources on high-value indicators, achieving improved detection precision while limiting computational resource consumption to essential analysis tasks.
Solution Approach 2:
The cloud service adjusts analysis parameters dynamically based on detected patterns and threat levels. When potential attack campaigns are detected, the system increases analysis depth and resource allocation for those specific cases. During normal operation, analysis parameters are reduced to minimize computational overhead. This adaptive parameter adjustment allows the system to achieve high detection precision when needed while maintaining low computational resource consumption during routine operation.
3Reliability
If activity data from multiple tenants is aggregated for analysis, then ability to detect coordinated attack campaigns improves, but data privacy concerns and security risks increase
Solution Approach 1:
The system extracts only the minimal necessary activity data elements required for multitenant correlation analysis, such as temporal patterns, event types, and anonymized metadata. Sensitive tenant-specific data (e.g., file contents, detailed user information, proprietary process data) is excluded from aggregation. This extraction approach enables reliable attack campaign detection through pattern recognition while minimizing data privacy risks by not collecting or analyzing sensitive tenant information.
Solution Approach 2:
The cloud service applies different data handling qualities to different types of activity data. High-level operational data (login times, event frequencies, network connection patterns) is aggregated for multitenant analysis to improve detection reliability. Sensitive local data (tenant-specific configurations, user credentials, proprietary information) remains localized and is never aggregated. This local quality differentiation allows the system to achieve reliable attack detection through aggregation of safe data while maintaining data privacy protection for sensitive information.
Data Source
Figure 1~4
Figure 5~8
Figure 9
AI summary
Embodiments detect cyberattack campaigns against multiple cloud tenants by analyzing activity data to find sharing anomalies. Data that appears benign in a single tenant's activities may indicate an attack when the same or similar data is also found for additional tenants. Attack detection may depend on activity time frames, on how similar certain activities of different tenants are to one another, on how unusual it is for different tenants to share an activity, and on other factors. Sharing anomaly analysis may utilize hypergeometric probabilities or other statistical measures. Detection avoidance attempts using entity randomization are revealed and thwarted. Authorized vendors may be recognized, mooting anomalousness. Although data from multiple tenants is analyzed together for sharing anomalies while monitoring for attacks, tenant confidentiality and privacy are respected through technical and legal mechanisms. Mitigation is performed in response to an attack indication.