Behavior-Based Detection of Abnormal Cloud Identity Activity

  • Authors

    • Uday Allala Lead SRE Engineer, USA. Author

    DOI:

    https://doi.org/10.67228/30715717/IJDEIC-2019PI7B2S

    Published 02-05-2019

  • Cloud Security, Identity and Access Management, Behavioral Analytics, User Behavior Analytics, Anomaly Detection, Identity Threat Detection, Machine Learning, Cloud Computing

    Issue

    Vol. 2 No. 1 (2019)

    Section

    Articles

  • Abstract

    With the emergence of cloud computing environments, identity and access controls are playing a more prominent role in order to manage users, applications, and resources, and abnormal identity activity is becoming a major security issue. Known attack detection methods, such as rule or signature-based, work for known attacks but may be ineffective to detect subtle variations in legitimate user behavior that are new and evolving or have not been observed. This paper presents a behavior-based detection method to detect abnormal cloud identity activity by continuously monitoring identity and access events, and building behavioral profiles of users and entities. The proposed solution includes features that represent temporal, geographical, device, session, resource-access, authentication, and privilege aspects to describe normal identity behavior and anomalies from a known behavior pattern. The proposed detection model applies anomaly scoring and adaptive risk assessment mechanisms to determine whether a user's behavior is normal or potentially malicious and malicious identity behavior. The framework is tested with representative cloud identity activities, including both normal and abnormal activities, and is compared with traditional detection methods with accuracy, precision, recall, F1 score, ROC-AUC, false-positive rate, detection latency, and computational overhead. Experimental results show that the behavior-based analysis can enhance the detection of abnormal identity activity while providing appropriate detection performance and minimizing false alarm under different workloads. The key contribution of this research is an integrated behaviour-based framework that connects dynamic behavioural profiling, anomaly detection and identity risk scoring to enable continuous and adaptive detection of identity threats to the cloud.

  • References

    [1] Zheng, R., Chen, J., Zhang, M., Wu, Q., Zhu, J., & Wang, H. (2018). A collaborative analysis method of user abnormal behavior based on reputation voting in cloud environment. Future Generation Computer Systems, 83, 60-74.

    [2] Kim, T., Choi, Y., Han, S., Chung, J. Y., Hyun, J., Li, J., & Hong, J. W. K. (2012, April). Monitoring and detecting abnormal behavior in mobile cloud infrastructure. In 2012 IEEE network operations and management symposium (pp. 1303-1310). IEEE.

    [3] Indu, I., Anand, P. R., & Bhaskar, V. (2018). Identity and access management in cloud environment: Mechanisms and challenges. Engineering science and technology, an international journal, 21(4), 574-588.

    [4] Almulla, S. A., & Yeun, C. Y. (2010, March). Cloud computing security management. In 2010 Second International Conference on Engineering System Management and Applications (pp. 1-7). IEEE.

    [5] Alcaraz Calero, J. M., Edwards, N., Kirschnick, J., Wilcock, L., & Wray, M. (2010). Toward a multi-tenancy authorization system for cloud services. IEEE Security & Privacy, 8(6), 48–55. https://doi.org/10.1109/MSP.2010.194

    [6] Ahmed, K. E. U., & Alexandrov, V. (2011). Identity and access management in cloud computing. In Cloud Computing for Enterprise Architectures (pp. 115-133). London: Springer London.

    [7] Mangiuc, D. M. (2012). Cloud identity and access management–A model proposal. Journal of Accounting and Management Information Systems (JAMIS), 11(3), 484-500.

    [8] Sharma, D. H., Dhote, C. A., & Potey, M. M. (2016). Identity and access management as security-as-a-service from clouds. Procedia Computer Science, 79, 170-174.

    [9] Kaur, H., Singh, G., & Minhas, J. (2013). A review of machine learning based anomaly detection techniques. arXiv preprint arXiv:1307.7286.

    [10] Mazzawi, H., Dalal, G., Rozenblatz, D., Ein-Dorx, L., Niniox, M., & Lavi, O. (2017, April). Anomaly detection in large databases using behavioral patterning. In 2017 IEEE 33rd International Conference on Data Engineering (ICDE) (pp. 1140-1149). IEEE.

    [11] Casakin, H., Hernández, B., & Ruiz, C. (2015). Place attachment and place identity in Israeli cities: The influence of city size. Cities, 42, 224–230. https://doi.org/10.1016/j.cities.2014.07.007.

    [12] Gong, S., & Xiang, T. (2011). Visual analysis of behaviour: from pixels to semantics. Springer Science & Business Media.

    [13] Habiba, U., Masood, R., Shibli, M. A., & Niazi, M. A. (2014). Cloud identity management security issues & solutions: a taxonomy. Complex Adaptive Systems Modeling, 2(1), 5.

    [14] Aldribi, A., Traore, I., & Moa, B. (2018). Data sources and datasets for cloud intrusion detection modeling and evaluation. In Cloud computing for optimization: foundations, applications, and challenges (pp. 333-366). Cham: Springer International Publishing.

    [15] Puketza, N. J., Zhang, K., Chung, M., Mukherjee, B., & Olsson, R. A. (1996). A methodology for testing intrusion detection systems. IEEE Transactions on Software Engineering, 22(10), 719-729.

    [16] Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012). Toward developing a systematic approach to generate benchmark datasets for intrusion detection. computers & security, 31(3), 357-374.

    [17] Joshi, K., Raj, A., & Janakiram, D. (2017, December). Sherlock: Lightweight detection of performance interference in containerized cloud services. In 2017 IEEE 19th International Conference on High Performance Computing and Communications; IEEE 15th International Conference on Smart City; IEEE 3rd International Conference on Data Science and Systems (HPCC/SmartCity/DSS) (pp. 522-530). IEEE.

    [18] Ho, C. Y., Lai, Y. C., Chen, I. W., Wang, F. Y., & Tai, W. H. (2012). Statistical analysis of false positives and false negatives from real traffic with intrusion detection/prevention systems. IEEE Communications Magazine, 50(3), 146-154.

    [19] Liao, H.-J., Richard Lin, C.-H., Lin, Y.-C., & Tung, K.-Y. (2013). Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications, 36(1), 16–24.

    [20] Omar, S., Ngadi, A., & Jebur, H. H. (2013). Machine learning techniques for anomaly detection: an overview. International journal of computer applications, 79(2), 33-41.

    [21] Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/COMST.2015.2494502

  • Downloads