Systems and Methods for Contextual and Cross Application Threat Detection and Prediction in Cloud Applications

• US 20150319185A1
• Filed: 06/24/2015
• Published: 11/05/2015
• Est. Priority Date: 12/13/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Palerra, Inc. (Oracle Corporation)
• Inventors: Kirti, Ganesh, Biswas, Kamalendu, Gurumurthy, Prakash, Alomari, Raja S., Perera, Sumedha Sumedha Nalin
• Granted Patent: US 10,063,654 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

Systems and methods for contextual and cross application threat detection in cloud applications in accordance with embodiments of the invention are disclosed. In one embodiment, a method for detecting threat activity in a cloud application using past activity data from cloud applications includes receiving activity data concerning actions performed by a user account associated with a user within a monitored cloud application, receiving external contextual data about the user that does not concern actions performed using the user account within the monitored cloud application, where the external contextual data is retrieved from outside of the monitored cloud application, deriving a baseline user profile using the activity data and external contextual data and associating the baseline user profile with the user account, and determining the likelihood of anomalous activity using the baseline user profile.

Claims

1. A method for detecting threat activity in a cloud application using past activity data from cloud applications, the method comprising:

receiving activity data concerning actions performed by a user account associated with a user within a monitored cloud application;

receiving external contextual data about the user that does not concern actions performed using the user account within the monitored cloud application, where the external contextual data is retrieved from outside of the monitored cloud application;

deriving a baseline user profile using the activity data and external contextual data and associating the baseline user profile with the user account; and

determining the likelihood of anomalous activity using the baseline user profile.

2. The method of claim 1, wherein the activity data includes a count of the number of unique internet protocol (IP) addresses used by a user account per day.

3. The method of claim 1, wherein the activity data includes one or more time differences between the use of different IP addresses by a user account.

4. The method of claim 1, further comprising:

deriving a baseline profile associated with a user account using activity data from at least one cloud application where the activity data is associated with the user account.

5. The method of claim 4, wherein the baseline profile includes a list of IP addresses and associated valid geolocations.

6. The method of claim 5, wherein a threat is recognized when activity occurs from a geolocation that is not on the list of IP addresses and valid associated geolocations.

7. The method of claim 4, wherein the baseline profile is derived from activity data collected over a time period, where the time period is selected from the group consisting of:

from eight weeks prior to four weeks prior to a target date, from four weeks prior to one week prior to a target date, and from one week prior to a target date.

8. The method of claim 7, further comprising calculating a risk score for the user based on the baseline user profile and generating a ranking of a plurality of users in one or more the cloud applications based upon the risk scores.

9. The method of claim 8, wherein the risk scores of users are used to prioritize threat remediation actions within the one or more cloud applications, which helps organizations to remediate most severe issues first.

10. The method of claim 1, wherein the activity data includes a number of login failures for an existing valid user account.

11. The method of claim 1, wherein the activity data includes a count of login failures greater than a predetermined threshold.

12. The method of claim 1, wherein the activity data includes a count of number of downloads greater than a predetermined threshold.

13. The method of claim 1, wherein the external contextual data includes travel plans for the user.

14. The method of claim 1, wherein the external contextual data includes credit card transactions by the user.

15. A system for detecting threat activity in a cloud application using past activity data from cloud applications comprising:

memory containing an analytics application; and

a processor;

wherein the processor is configured by the analytics application to;

receive activity data concerning actions performed by a user account associated with a user within a monitored cloud application;

receive external contextual data about the user that does not concern actions performed using the user account within the monitored cloud application, where the external contextual data is retrieved from outside of the monitored cloud application;

derive a baseline user profile using the activity data and external contextual data and associating the baseline user profile with the user account; and

determine the likelihood of anomalous activity using the baseline user profile.

16. The system of claim 15, wherein the activity data includes a count of the number of unique internet protocol (IP) addresses used by a user account per day.

17. The system of claim 15, wherein the activity data includes one or more time differences between the use of different IP addresses by a user account.

18. The system of claim 15, wherein the processor is further configured by the analytics application to:

derive a baseline profile associated with a user account using activity data from at least one cloud application where the activity data is associated with the user account.

19. The system of claim 18, wherein the baseline profile includes a list of IP addresses and associated valid geolocations.

20. The system of claim 19, wherein a threat is recognized when activity occurs from a geolocation that is not on the list of IP addresses and valid associated geolocations.

21. The system of claim 18, wherein the baseline profile is derived from activity data collected over a time period, where the time period is selected from the group consisting of:

from eight weeks prior to four weeks prior to a target date, from four weeks prior to one week prior to a target date, and from one week prior to a target date.

22. The system of claim 21, wherein the processor is further configured by the analytics application to calculate a risk score for the user based on the baseline user profile and generating a ranking of a plurality of users in one or more the cloud applications based upon the risk scores.

23. The system of claim 22, wherein the risk scores of users are used to prioritize threat remediation actions within the one or more cloud applications, which helps organizations to remediate most severe issues first.

24. The system of claim 15, wherein the activity data includes a number of login failures for an existing valid user account.

25. The system of claim 15, wherein the activity data includes a count of login failures greater than a predetermined threshold.

26. The system of claim 15, wherein the activity data includes a count of number of downloads greater than a predetermined threshold.

27. The system of claim 15, wherein the external contextual data includes travel plans for the user.

28. The system of claim 15, wherein the external contextual data includes credit card transactions by the user.