Serverless Anomaly Detection Using Native Cloud Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Serverless computing environments face challenges in detecting compromised functions and threats due to their dynamic nature, high volume of activities, and limited control over infrastructure, leading to difficulties in identifying malicious behavior and preventing attacks like permission misuse, data leakage, and denial-of-wallet attacks, especially in fully managed cloud environments where traditional security solutions are ineffective.
Innovation Solution
An unsupervised deep learning anomaly detection model utilizing LSTM autoencoders and native cloud provider monitoring tools to analyze serverless application logs, generating multivariate sequences, and using graph theory to detect anomalies, enabling the detection of both known and unknown threats without modifying the infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional rule-based security methods are used in serverless environments, then implementation is simple, but detection accuracy is low and false alarm rate is high
Solution Approach 1:
The patent replaces traditional rule-based security mechanisms with machine learning models that automatically learn security patterns from data. The system uses supervised learning to train classifiers on labeled security events and unsupervised learning to detect anomalies, substituting manual rule creation with automated intelligent detection that adapts to new threats without requiring explicit programming of security rules.
Solution Approach 2:
The system dynamically adjusts detection parameters and thresholds based on learned patterns from training data. Instead of using fixed rules, the machine learning models continuously optimize detection sensitivity and specificity by learning from historical security events, enabling adaptive parameter tuning that improves detection accuracy while reducing false alarms.
2Reliability
If static analysis is used to detect security threats, then code can be audited for bad practices, but external threats like injections cannot be detected and the approach does not scale well in dynamic environments
Solution Approach 1:
The patent transitions from static code analysis to dynamic runtime monitoring using machine learning. The system collects security events during function execution and uses supervised learning to train models on actual runtime behavior patterns. This dynamic approach enables detection of external threats like injections that only manifest during execution, while the automated learning process scales to handle the diversity and volume of serverless workloads.
Solution Approach 2:
The system performs preliminary training of machine learning models using labeled security events before deployment. This preliminary action creates pre-trained detectors that can immediately identify threats in production environments without requiring real-time rule creation, enabling both rapid deployment and scalability across diverse serverless functions.
3Measurement precision
If dynamic analysis with modified runtime environments is used, then malicious activity can be monitored, but this approach requires non-managed environments and cannot be implemented in fully managed serverless settings
Solution Approach 1:
The patent implements a self-service security monitoring system that operates within the constraints of managed serverless environments. Instead of requiring modifications to the runtime environment, the system uses cloud provider-native logging and monitoring tools to collect security events, then applies machine learning models to analyze these events and detect malicious activity, making the solution compatible with fully managed environments like AWS Lambda.
Solution Approach 2:
The system introduces machine learning models as an intermediary layer between native cloud monitoring tools and security analysis. The ML models process and interpret security events collected from managed environment logs, enabling sophisticated threat detection without requiring direct access or modification of the underlying managed runtime infrastructure.
4Reliability
If prevention-based security approaches are used, then suspicious requests can be blocked, but this leads to high false alarm rates that interfere with application availability
Solution Approach 1:
The patent implements feedback mechanisms where the security system continuously learns from detected threats and adjusts its detection behavior. The machine learning models are retrained on new security events, allowing the system to improve its discrimination between malicious and legitimate requests over time. This feedback loop reduces false alarms while maintaining security effectiveness, preserving application availability.
Data Source
Figure 1
Figure 2
AI summary
A method for detecting compromised functions and threats in a serverless cloud environment, according to which an unsupervised deep learning anomaly detection model utilizes only cloud provider's native monitoring tools to detect abnormal behavior of serverless applications, while customizing the data preprocessing for the analysis of serverless application logs, thereby considering all of the unique features of said application logs. The model is used to detect a predefined type of threat with unique patterns and post-exploitation abnormal behavior.