An Automated Framework for Detecting Identity and Access Anomalies in Cloud Environments

  • Authors

    • Uday Allala Lead SRE Engineer, USA. Author

    DOI:

    https://doi.org/10.67228/30713498/IJADSMSC-2019PII3M5J

    Published 10-03-2019

  • Cloud Security, Identity and Access Management, Anomaly Detection, User Behavior Analytics, Machine Learning, Access Anomalies, Behavioral Profiling, Risk Scoring, Automated Threat Detection, Cloud Environments

    Issue

    Vol. 2 No. 2 (2019)

    Section

    Articles

  • Abstract

    Distributed identity and access management is a mechanism that has become commonplace in cloud environments, generating intricate authentication, authorization and privilege scenarios that are challenging to track with traditional rule-based security methods. The distributed identity and access management is a mechanism that has become ubiquitous in cloud environments, where complex privilege, authentication and authorization patterns are difficult to monitor using traditional rule-based security methods. The legitimate change in user behaviour, dynamic workloads, use of privileged accounts, misuse of credentials and abnormal access patterns can create a significant challenge in identifying identity and access anomalies in a timely manner. The paper outlines an automated framework that utilizes an identity telemetry collection and behavioral profiling technique, feature engineering, machine learning-based anomaly detection, risk scoring, and automated security alert generation to detect identity and access anomalies in cloud environments. It continuously performs analysis of authentication events, access requests, privilege changes, use of resources, use characteristics of sessions, and contextual attributes of users and entities to create dynamic profiles of users and entities. Anomaly detection models are subsequently used to find any anomalies from the known behaviour and categorise the anomalous activities by their security risk. The proposed architecture also includes adaptive thresholding and automatic response mechanisms to enable real-time detection and minimize the need for manual security analysis. Detection accuracy, precision, recall, F1 score, false positive rate, detection latency, computational overhead, and scalability are used as key performance measures to evaluate the framework. The suggested solution offers a comprehensive solution to enhance visibility, responsiveness, and automation of identity and access security monitoring in dynamic cloud infrastructures.

  • References

    [1] Buyya, R., Srirama, S. N., Casale, G., Calheiros, R., Simmhan, Y., Varghese, B., ... & Shen, H. (2018). A manifesto for future generation cloud computing: Research directions for the next decade. ACM computing surveys (CSUR), 51(5), 1-38.

    [2] Moura, J., & Hutchison, D. (2016). Review and analysis of networking challenges in cloud computing. Journal of Network and Computer Applications, 60, 113-129.

    [3] Toosi, A. N., Calheiros, R. N., & Buyya, R. (2014). Interconnected cloud computing environments: Challenges, taxonomy, and survey. ACM Computing Surveys (CSUR), 47(1), 1-47.

    [4] Voorsluys, W., Broberg, J., & Buyya, R. (2011). Introduction to cloud computing. Cloud computing: Principles and paradigms, 1-41.

    [5] Indu, I., Anand, P. R., & Bhaskar, V. (2018). Identity and access management in cloud environment: Mechanisms and challenges. Engineering science and technology, an international journal, 21(4), 574-588.

    [6] Indu, I., Anand, R., & Bhaskar, V. (2018). Identity and access management in cloud environment: Mechanisms and challenges. Engineering Science and Technology, an International Journal, 21(4), 574–588. https://doi.org/10.1016/j.jestch.2018.05.010Sharma, D. H., Dhote, C. A., & Potey, M. M. (2016). Identity and access management as security-as-a-service from clouds. Procedia Computer Science, 79, 170-174.

    [7] Ahmed, K. E. U., & Alexandrov, V. (2011). Identity and access management in cloud computing. In Cloud Computing for Enterprise Architectures (pp. 115-133). London: Springer London.

    [8] Shashanka, M., Shen, M. Y., & Wang, J. (2016, December). User and entity behavior analytics for enterprise security. In 2016 IEEE International Conference on Big Data (Big Data) (pp. 1867-1874). IEEE.

    [9] Omar, S., Ngadi, A., & Jebur, H. H. (2013). Machine learning techniques for anomaly detection: An overview. International Journal of Computer Applications, 79(2), 33–41. https://doi.org/10.5120/13715-1478

    [10] Habiba, U., Masood, R., Shibli, M. A., & Niazi, M. A. (2014). Cloud identity management security issues & solutions: a taxonomy. Complex Adaptive Systems Modeling, 2(1), 5.

    [11] Laptev, N., Amizadeh, S., & Flint, I. (2015, August). Generic and scalable framework for automated time-series anomaly detection. In Proceedings of the 21th ACM SIGKDD international conference on knowledge discovery and data mining (pp. 1939-1947).

    [12] Lan, Z., Zheng, Z., & Li, Y. (2009). Toward automated anomaly identification in large-scale systems. IEEE Transactions on Parallel and Distributed Systems, 21(2), 174-187.

    [13] Cherkasova, L., Ozonat, K., Mi, N., Symons, J., & Smirni, E. (2009). Automated anomaly detection and performance modeling of enterprise applications. ACM Transactions on Computer Systems (TOCS), 27(3), 1-32.

    [14] Tolosana, R., Vera-Rodriguez, R., Ortega-Garcia, J., & Fierrez, J. (2015). Preprocessing and feature selection for improved sensor interoperability in online biometric signature verification. Ieee Access, 3, 478-489.

    [15] Arrington, B., Barnett, L., Rufus, R., & Esterline, A. (2016, August). Behavioral modeling intrusion detection system (BMIDS) using internet of things (IoT) behavior-based anomaly detection via immunity-inspired algorithms. In 2016 25th International Conference on Computer Communication and Networks (ICCCN) (pp. 1-6). IEEE.

    [16] Ali, M. Q., Al-Shaer, E., Khan, H., & Khayam, S. A. (2013). Automated anomaly detector adaptation using adaptive threshold tuning. ACM Transactions on Information and System Security (TISSEC), 15(4), 1-30.

    [17] Xu, R., Nikouei, S. Y., Chen, Y., & Faughnan, T. R. (2018). Real-time human objects tracking for smart surveillance at the edge. In Proceedings of the 2018 IEEE International Conference on Communications (ICC) (pp. 1–6). IEEE.

    [18] Hong, J., Liu, C. C., & Govindarasu, M. (2014). Integrated anomaly detection for cyber security of the substations. IEEE Transactions on Smart Grid, 5(4), 1643-1653.

    [19] Dukaric, R., & Juric, M. B. (2013). Towards a unified taxonomy and architecture of cloud frameworks. Future Generation Computer Systems, 29(5), 1196-1210.

    [20] Burramukku, N. R. (2016). Secure identity and access management integration for cloud-native network observability platforms. International Journal of Engineering Development and Research.

    [21] Waters, M. (2016). Evaluating identity and access management (IAM) as a Cloud service. Research Gate, September.

    [22] Crawford, H., Renaud, K., & Storer, T. (2013). A framework for continuous, transparent mobile device authentication. Computers & Security, 39, 127-136.

    [23] Jorquera Valero, J. M., Sanchez Sanchez, P. M., Fernandez Maimo, L., Huertas Celdran, A., Arjona Fernandez, M., De Los Santos Vilchez, S., & Martinez Perez, G. (2018). Improving the security and QoE in mobile devices through an intelligent and adaptive continuous authentication system. Sensors, 18(11), 3769.

    [24] Ashibani, Y., Kauling, D., & Mahmoud, Q. H. (2019). Design and implementation of a contextual-based continuous authentication framework for smart homes. Applied System Innovation, 2(1), 4.

  • Downloads