Microsoft Technology Licensing, LLC

Ariel Brukman

Ram Haim Pliskin

Andrey Karpovsky

Coral Cohen

Techniques are described herein that are capable of performing a security action regarding an access request using a cluster-based determination of malicious intent. Subsets of access requests are clustered into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types. A determination is made that a received access request, which is associated with a designated requestor type, is malicious based at least on a relationship between an access action, which is requested by the received access request using an access token, and an access behavior associated with a group of access requests in a designated cluster that use the access token. As a result of determining that the received access request is malicious, a security action is performed with regard to the received access request.

Performing a security action regarding an access request using a cluster-based determination of malicious intent

According to examples, an apparatus includes a processor that determines that an encryption operation has been requested or executed through a cloud control plane capability with respect to a cloud storage device. The processor also determines that the requested or executed encryption operation with respect to the cloud storage device is anomalous and, based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, outputs an alert and/or performs a remedial action. By identifying anomalous encryption operation requests or executions on cloud storage devices, the processor is able to determine that ransomware attacks are or have occurred on the cloud storage devices. In some examples, the processor takes remedial actions to mitigate harm posed by or prevent the ransomware attacks.

Protection of cloud storage devices from anomalous encryption operations

Techniques are described herein that are capable of performing a security action with regard to an access token based on clustering of access requests. Subsets of access requests are clustered into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types. The access requests request access to cloud resources. Access behavior(s) associated with the access requests that are included in respective cluster(s) are identified. A security action is performed with regard to an access token based at least on at least one of the access behavior(s).

Growing community of inventors

Kiriat Ata, Israel

Ariel Brukman