Characterization of activity of users in cloud applications and services

Abstract

Systems, methods, and other embodiments associated with self-reliant characterization of activities of users are described. In one embodiment, a method includes generating a dataset of data points from a batch of electronic log messages that describe electronic actions taken by various accounts. A data point collectively describes actions of a single account. The method includes modeling distinct activities based on clustering of the data points into M behavioral groups and inferring M or more distinct activities from the dataset by probabilistic activity modeling of the actions. The value of M is derived automatically during the clustering. The method includes predicting activity of a user account to be non-conformant based on other accounts in a behavioral group satisfying a threshold for similarity. And, the method includes generating an electronic alert that indicates the user account to have non-conformant activity.