Microsoft Technology Licensing, LLC

Josef Weizman

Ram Haim Pliskin

Dotan Patrich

Tomer Koren

Hani Hana Neuvirth

Moshe Israel

Omer Karin

Aharon Naftali Michaels

Idan Yehoshua Hen

Efim Hudis

Andrey Karpovsky

Yotam Livny

Eran Goldstein

Lior Becker

Amit Magen Medina

Nadav Wolfin

Liran Englender

Benyamin Farshteindiker

Elizabeta Mash Levin

Karl William Reinsch

Lior Sonntag

Amit Magen

Nir Gafni

Generally discussed herein are devices, systems, and methods for cloud resource security. A method can include receiving, at a monitor device and from a first cloud resource of cloud resources hosted by a cloud provider, a request for a token that uniquely identifies the first cloud resource, the request indicating a destination that is a metadata server. The method can include comparing, based on entries in an application programming interface (API) access log, the cloud provider associated with the first cloud resource and a cloud provider associated with the metadata server. The method can include responsive to the cloud provider of the first cloud resource being different from the cloud provider of the metadata server performing a security mitigation action.

Cloud attack detection via API access analysis

A computing system is configured to access a cloud storage and make a copy of at least a portion of the cloud storage. The copy of the at least portion of the cloud storage to search for a data pattern associated with a credential. In response to finding the data pattern associated with the credential, the computing system extracts an identifier associated with the credential and a scope of permission that the identifier is granted to. The scope of permission is associated with a permission to access a cloud resource. Finally, a risk of potential exposure of the credential is mitigated, such as (but not limited to) notifying an owner of the cloud resource, deleting the credential from the cloud, or modifying or revoking the scope of permission associated with the credential.

Agentless extraction of cloud credentials

A computing system is configured to detect a request for a deployment of a container at a container orchestration service. One or more datasets associated with the deployment of the container are collected, and a plurality of features associated with the deployment are extracted based on the one or more datasets. A probability score is then generated based on the plurality of features, using a machine-learning model trained on datasets associated with historical deployments of containers that have been performed via the container orchestration service. The probability score indicates a probability that the deployment of the container is anomalous compared to the historical deployments of containers. When the probability score is greater than a threshold, the deployment of the container is determined as anomalous.

Detect anomalous container deployment at a container orchestration service

According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that may cause the processor to identify a container image group of a plurality of container image groups to which a subject container image corresponds, in which each of the plurality of container image groups is assigned a respective behavioral profile. The processor may also determine whether activities in the subject container image comply with corresponding activities identified in the behavioral profile of the identified container image group. Based on a determination that at least one activity in the subject container image fails to comply with a corresponding at least one activity identified in the behavioral profile of the identified container image group, the processor may determine that the subject container image includes an anomalous activity and output an alert indicating that the subject container image includes an anomalous activity.

Anomalous activity detection in container images

According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a predefined type of file to the directory. In addition, based on a determination that the request is a request to upload the predefined type of file to the directory, the processor may determine, through application of a predictive model, whether the directory is a user content directory and based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and/or output a notification regarding the receipt of the request.

Predictive model application for file upload blocking determinations

Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.

Dangling domain detection and access mitigation

Technologies are shown for detection of identity misconfiguration that involve collecting identity/role binding and role/access rules data from multiple clusters supported by a computing resource system. Access rules for identities are extracted from the collected data and an access rule prediction model created to predict access rules for identities. An identity definition request for a tenant is received having a requested identity and a role assigned to the identity. A set of access rules is obtained for the role assigned to the identity and a predicted set of access rules is obtained for the requested identity from the prediction model. The access rules for the requested role are compared to the predicted set of access rules and a misconfiguration alert generated when there is a difference between the set of access rules for the requested role and the predicted set of access rules for the requested identity.

Identity misconfiguration detection for role-based access control

According to examples, an apparatus may include machine-readable instructions that may cause the processor to determine that a first malware was detected on a first computing device and to determine whether a second malware was detected on a second computing device within a predefined period of time of when the first malware was detected on the first computing device, in which the first computing device and the second computing device are associated with a shared data storage that is remote from the first and second computing devices. The instructions may also cause the processor to, based on a determination that the second malware was detected within the predefined period of time, output a notification that the first malware was likely spread to the first computing device and/or that the second malware was likely spread to the second computing device through the shared data storage.

Detecting spread of malware through shared data storages

Generally discussed herein are devices, systems, and methods for secure container operation. A behavior profile of normal container operation can be generated, such as by using crowd sourced data. A container monitor can provide container actions of an application in a deployed container. The container action can be compared to a behavior profile that indicates normal behavior of the container. A communication can in response to the container actions being inconsistent with the normal behavior of the behavior profile. The container can be halted to stop the abnormal behavior.

Container anomaly detection based on crowd sourcing

Cybersecurity enhancements expose likely cyberattacks and command abuse while reducing false positives. Some embodiments ascertain an operating system mismatch, which occurs when a command tailored for operating system X is asserted in an environment tailored to operating system Y. False positives may be reduced by alerting on such a mismatch only when a command's process belongs to a web server or other targeted process, or uses the same supporting technology (e.g., framework, scripting language, or runtime environment) as the web server or other targeted process. Some embodiments watch for command abuse by spotting assertions of commands that appear frequently in cyberattacks even though those commands also have legitimate uses such as system administration, network administration, or software development.

Attack detection through exposure of command abuse

The automated estimation that an interface service has been misconfigured. Sensitive interface services are first identified based on common characteristics, and those characteristics are associated with sensitivity based on behavior across multiple clusters. Thereafter, the threat assessment estimates that a particular interface service is misconfigured if the particular interface service has these same common characteristics, is accessible from outside the cluster, and does not require authentication. Cluster administrators can therefore be more fully and timely advised when a misconfiguration of an interface service subjects their cluster to undue security risks.

Interface threat assessment in multi-cluster system

A previously-unknown type of attack on a web application can be detected dynamically using server logs. An alert can be raised for an application that returns a valid response to the potential attacker (e.g., when an http (hypertext transfer protocol) status code of 200 is returned to the requestor). Server logs can be analyzed to identify an external computer that uses the same attack methodology on multiple targets. The external computer may attempt to access the same Uniform Resource Identifier (URI) on various web sites. In many cases, the http status code that is returned is an error code. Characteristics such as but not limited to fast crawling and numerous error status codes being returned to a particular requestor can be used by a machine learning (ML) system to identify potentially malicious external computing devices and/or vulnerable URIs.

Detecting attacks on web applications using server logs

'Sensitive' URIs for a website can be determined. Access attempts to a sensitive URI can be extracted from server logs. As used herein, sensitive URIs are URIs which if breached are likely to result in harm to the website owner. Access to sensitive URIs can be restricted to trusted accessors. Trusted accessors can be determined by filtering out untrusted accessors using thresholds and/or machine learning techniques. After filtering out untrusted accessors, any remaining accessors can be identified as trusted accessors. Trusted accessors can be added to a whitelist. Access requests to access-restricted URIs by an accessor not in the whitelist can be denied and an alert can be generated. Access requests to access-restricted URIs by an accessor in the whitelist can be granted.

Whitelisting of trusted accessors to restricted web pages

Systems, methods, and apparatuses are provided for restricting access to a web resource. Website access information is obtained by monitoring accesses to a plurality of websites for each access, which may include a network identifier of an access requestor, a website identifier, and an access time for each request. Based on at least the website access information, it may be determined that a particular access requestor has accessed a number of different websites in a given time period. As a result, the particular access requestor may be classified as a web robot. A request to permit access to a web resource is received by the particular access requestor. In response to receiving the request to permit access to the web resource, the particular access requestor is prevented from accessing the web resource and/or a notification is generated that the particular access requestor is attempting to access the web resource.

Growing community of inventors

Haifa, Israel

Josef Weizman