Microsoft Technology Licensing, LLC

General Electric Company

Evgeny Bogokovsky

Andrey Karpovsky

Ram Haim Pliskin

Shai Dekel

Lior Ateret

The techniques disclosed herein prevent a rogue resource from being created within a cloud computing environment. For example, a rogue serverless function may be prevented from integrating with a cloud-based database, thereby preventing the serverless function from performing malicious operations such as low-rate data exfiltration. The rogue serverless function is detected before it is installed, heading off the attack completely. In some configurations, a key retrieval request is received. Parameters of the key retrieval request are analyzed for anomalies, and anomalous key retrieval requests are stored in a pool. Then, when a request to create a resource is received, the pool of anomalous key retrieval requests is searched for a match. When a match is found, the resource creation request may be suspended pending a further security review.

Detecting suspicious data access by a rogue cloud resource

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect mass control plane operations, which may be indicative of anomalous (or malicious) behavior. For example, one or more logs that specify a plurality of access enablement operations performed with respect to an entity is received. The log(s) are analyzed to identify a number of access enablement operations that occurred in a particular time period. A determination is made as to whether the identified number of access enablement operations meets a threshold condition (e.g., to determine whether an unusually high number of such operations occurred in a given time period). Based on the threshold condition being met, a determination is made that anomalous behavior has occurred with respect to the entity. Responsive to determining that the potentially behavior has occurred, a mitigation action may be performed that mitigates the behavior.

Detecting mass control plane operations

A system comprising a computer-readable storage medium storing at least one program, and a method for reducing cyber-security related false positive alerts is presented. In example embodiments the method may include identifying an indication of a cyber-security threat based on an operational anomaly in a network system. The method may further include determining that the operational anomaly is a false positive indicator with respect to the cyber-security threat based on the operational anomaly being correlated with a malfunction or reconfiguration event.

Collaborative infrastructure supporting cyber-security analytics in industrial networks

A system comprising a computer-readable storage medium storing at least one program, and a method for reducing cyber-security related false positive alerts is presented. In example embodiments the method may include identifying an abnormal operation pattern in the network system that may signal a cyber-security threat. In response to identifying the abnormal operation pattern, data related to a state change of an asset included in the network system is accessed. The method may further include determining that the abnormal operation pattern and the state change of the asset are correlated, and based on this determination, determining that the abnormal operation pattern is a false positive indicator with respect to the cyber-security threat.

Growing community of inventors

Herzliya, Israel

Evgeny Bogokovsky