Multi-variate Anomaly Detection in Virtualized Cloud Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection in cloud environments faces challenges due to the virtual nature of source and target IP addresses, making it difficult to differentiate between malicious and legitimate access patterns, as traditional models like 'impossible travel' do not apply and replication activities are dynamic and not visible in logs, leading to low accuracy in anomaly detection.
Innovation Solution
The use of multiple variates of access patterns and multiple scopes of resources for anomaly detection, employing machine learning models dedicated to specific combinations of access pattern features and resource scopes, allows for better estimation of anomalies even in virtualized environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection models (e.g., impossible travel) are used in cloud environments, then detection speed is maintained, but detection accuracy deteriorates due to virtualized IP addresses and dynamic replication
Solution Approach 1:
The patent segments the anomaly detection task into multiple independent machine learning models, each dedicated to specific combinations of access pattern features (e.g., source IP, destination IP, timestamp) and resource scopes (e.g., virtual machine, storage account). This segmentation allows each model to specialize in detecting anomalies within its specific feature-scoped domain, improving overall detection accuracy without requiring a single complex model to handle all scenarios
Solution Approach 2:
The patent introduces a new dimension to anomaly detection by incorporating resource scope as an additional classification axis. Instead of detecting anomalies based solely on access patterns, the system now detects anomalies in the (access pattern, resource scope) space. This dimensional expansion allows the system to differentiate between legitimate cross-region access and malicious access by considering both the access pattern and the specific resource scope being accessed
2Measurement precision
If multiple machine learning models are deployed for different access pattern and resource scope combinations, then anomaly detection accuracy improves, but computational resources and system complexity increase
Solution Approach 1:
The patent applies local quality by training and deploying machine learning models with parameters specifically optimized for each combination of access pattern features and resource scopes. Each model learns the normal behavior patterns specific to its designated feature-scoped domain, allowing for more accurate local anomaly detection. This localized approach improves detection accuracy while avoiding the need for a single overly complex global model that would consume more computational resources
3Measurement precision
If replication activities are made visible in logs for detection purposes, then anomaly detection accuracy improves, but system performance and availability deteriorate due to additional logging overhead
Solution Approach 1:
The patent introduces an intermediary component that sits between the cloud service replication mechanisms and the intrusion detection system. This intermediary passively observes and captures replication-related access patterns and resource scope information from existing system logs and metadata, making replication activities visible to the anomaly detection system without requiring changes to replication operations or additional logging overhead that would impact system performance
Data Source
AI summary
Multiple variate anomaly detection against multiple scopes of the requested resource. Even if one of the variates patterns is sensitive to physical location of the requestor and/or the resource, not all of the variates of the access pattern will be. Furthermore, even if one of the scopes of the resource is sensitive to physical location of the resource, not all scopes will be. Thus, the use of multiple variates of the access pattern and multiple scopes of the anomaly detection allows for better estimates of anomaly detection to be made, even when the source of the access request is virtualized and/or the location of the resource is virtualized.