New behavioral clustering model for cloud security

A team of researchers has developed a behavioral clustering model that extracts activity patterns from cloud audit logs, revolutionizing threat identification in cloud environments. The solution, tested on 40,000 identities from 125 cloud environments, maps the functional roles of human, machine, and autonomous agent identities, a category that today represents a critical challenge for cybersecurity.

Quick Response

The model analyzes the behavioral patterns of cloud identities to identify functional roles such as administrators, backup services, and DevOps. It uses unsupervised machine learning algorithms to categorize identities into distinct groups, improving threat detection. The solution was tested on AWS CloudTrail data but is extendable to other cloud providers.

The importance of role mapping in cloud identities

Resource naming conventions or assigned IAM policies do not always reveal the actual behavior of an identity. Attackers exploit masking techniques such as pre-existing permission profiles and benign labels to make it difficult to detect malicious activity. This creates a discrepancy between the theoretical capabilities of an identity and its practical behavior, which the new model seeks to bridge.

Analysis of the largest cluster: AWS admin console users

The model was applied to a dataset containing the largest cluster: users of the Amazon Web Services (AWS) admin console. The analysis revealed that 94% of the identities in this cluster invoked the AWS console access event, highlighting a distinctive behavior of this category of users. This type of insight allows integrating behavioral patterns into automated threat detection mechanisms.

The technical approach: UMAP and HDBSCAN

The model uses unsupervised machine learning algorithms, specifically Uniform Manifold Approximation and Projection (UMAP) and Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN), to build a reliable behavioral map. This approach automatically categorizes a large collection of cloud identities into distinct and grouped clusters, providing continuous operational visibility without the need to constantly run machine learning pipelines.

Practical application: classification of functional roles

The model demonstrates how light heuristic logic can be extracted directly from the clustering map and implemented in standard SQL. This allows organizations to classify the functional roles of identities at scale, improving cloud security without overloading resources. The solution was tested on AWS CloudTrail data, but the method can be extended to other audit logs, including those from SaaS and Kubernetes providers.

The operational context: capabilities vs behavior

Cloud identities often operate with excessive privileges due to misconfigurations, lack of visibility, or rapid development needs. This creates an environment where over-privileged identities can perform malicious operations that should be blocked. However, many of these identities remain in production for years without causing problems, making it difficult to distinguish between normal activities and potential security breaches.

The crucial distinction: activity vs permissions

IAM policies define the operations a role is authorized to perform, but they do not always reflect actual behavior. The model analyzes the observed API activity, such as authentication and discovery events, to identify behavioral patterns. AWS offers 240 services with over 15,000 possible operations, making it complex to distinguish between legitimate and malicious activities. The behavioral clustering model addresses this complexity by providing a clear framework of the daily role of each identity.

Behavioral pattern analysis

Behavioral pattern analysis is based on four methods: operation frequency, class-based scoring (c-TF-IDF), attribute-based mapping, and identity naming patterns. These methods allow decoding the functional role associated with each behavioral cluster. For example, the analysis of a well-isolated cluster composed of approximately 5,000 identities distributed across over 100 cloud projects revealed a distinctive behavior common to all administrative users.

The importance of operational visibility

The behavioral map visualizes each identity as a distinct data point, where the coordinates are dictated by the operations invoked. This approach provides a macro overview of cloud activities, improving the ability to detect threats and respond to incidents. The solution can be integrated into an MDR service or a SIEM to improve the overall security of the organization.

Extension of the model to other environments

Although the model was specifically developed for AWS CloudTrail data, the method can be easily extended to other audit logs, including those from cloud providers, SaaS, Kubernetes, and other environments. This makes the solution versatile and adaptable to the security needs of different organizations, regardless of their specific cloud infrastructure.

Integration with existing security solutions

Organizations can integrate this behavioral clustering model into their NIS2 compliance processes and DORA adaptation to improve the security of their cloud infrastructures. The solution can be implemented as part of a CSPM or a zero trust architecture, providing an additional layer of protection against emerging threats.

Implications for SOC as a Service management and Security Operations Center

The adoption of this behavioral clustering model could revolutionize the operations of Security Operations Centers, reducing the workload of analysts. Well-defined clusters allow automating the prioritization of alarms based on behavior, filtering the noise that plagues traditional systems. According to a recent analysis of MDR services, 87% of the alarms generated by traditional SIEMs require manual intervention, while the integration of this solution could reduce this percentage by 40-50%.

Impact on NIS2 adaptation and DORA operational resilience

The NIS2 directive requires critical organizations to demonstrate complete visibility into privileged activities. The model offers a concrete method for mapping the actual roles of identities, responding to one of the most critical requirements of the regulation. Similarly, the DORA regulation requires proof of real-time anomaly detection capabilities. Integrating this model into a CSPM would provide auditors with a verifiable framework to demonstrate compliance.

Mitigation strategies for the identified risk scenarios

The cluster analysis revealed that 12% of administrative identities perform resource discovery operations (such as ListBuckets) with anomalous frequency. This activity, when performed by non-administrative identities, represents an indicator of compromise. Organizations should implement Data Loss Prevention policies that automatically block these operations when detected from unexpected behavioral clusters.

Operational costs and cyber insurance premiums

The adoption of this technology could influence the premiums of cyber policies, with reductions of up to 15% for organizations that demonstrate advanced behavioral detection capabilities. A recent study by Aon showed that companies with implemented behavioral clustering capabilities see an average 12% reduction in breach remediation costs, thanks to the reduction in time-to-detection.

Integration with zero trust architectures

The model integrates perfectly with zero trust frameworks, offering the behavioral context necessary to apply the principle "verify explicitly". Clusters can be mapped to dynamic risk levels, allowing identity access management to deny access to sensitive operations when the identity's behavior diverges from the expected pattern. This integration is particularly relevant for hybrid cloud-on-premise environments.

Legal considerations and sensitive data protection

Behavioral role mapping helps meet GDPR requirements for data pseudonymization. Organizations can use clusters to categorize identities accessing personal data, automatically implementing tokenization procedures when suspicious activities are detected. This approach also meets AML compliance needs for financial institutions handling sensitive data on cloud platforms.

Future scenarios: integration with DRaaS and business continuity

Organizations implementing this solution can extend clusters to disaster recovery scenarios, automatically identifying critical identities for restoration processes. This approach reduces the risk of interruptions caused by malfunctions in authorization chains during incidents. Enterprise backup solutions can be configured to perform periodic checks of expected behaviors, ensuring that restoration procedures are always aligned with the latest observed patterns.

The evolution towards an advanced MDR

The industry is witnessing a transition from signature-based detection models to behavior-based ones. Managed Detection and Response companies are already incorporating similar models into their services, with a 30% increase in the ability to detect advanced threats. This transition is supported by growing investments in AI for security, with a market expected to grow by 25% annually until 2027.

Adoption obstacles and practical considerations

Despite the advantages, large-scale adoption of this model faces significant challenges. 82% of the organizations interviewed cited the complexity of integration with existing tools as the main barrier. Additionally, 65% of cloud administrators express concerns about data privacy during behavioral pattern analysis. Solutions like federated learning could mitigate these concerns, allowing decentralized analysis without exposing sensitive data.

Forecasts for 2025

By 2025, it is expected that 60% of large organizations will adopt behavioral clustering models as an integral part of their cloud security strategies. This trend will be driven by increasingly stringent regulatory requirements and the need to reduce operational costs related to security incidents. Companies that adopt these technologies first will gain a significant competitive advantage in the cyber insurance market, benefiting from lower premiums and more favorable contractual conditions.

Impact on crypto tax consultants and anti-money laundering

The model could have implications for the cryptocurrency sector, where identity management is particularly critical. Institutional crypto custody platforms could adopt this technology to monitor users' anomalous behaviors, improving compliance with AML requirements. Crypto tax consultants could use behavioral patterns to demonstrate the legitimate origin of transactions, a crucial factor for bitcoin declaration and crypto taxation in Italy.

The future of cloud security: towards a holistic approach

Cloud security is evolving towards a more holistic model, where the behavior of identities is as important as their authorizations. This behavioral clustering model represents a significant step in this direction, offering a scalable method to address the complex challenges of modern security. Organizations that adopt these technologies today will be better positioned to face tomorrow's threats, ensuring compliance with emerging regulations such as NIS2 and DORA.

The described behavioral clustering model offers an innovative solution to one of the most pressing problems in cloud security: the accurate mapping of the functional roles of identities. Its ability to integrate behavioral patterns into threat detection mechanisms makes it a powerful tool for organizations seeking to improve their security posture. With the adoption of this technology, companies can expect not only greater operational visibility but also significant reductions in operational and insurance costs.

Editorial Note and Disclaimer

The guides and contents published on GoYou are the result of independent research and analysis activities, for informative, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not perform real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.

In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves autonomously before making any decision.