Cloud computing environment activity monitoring

Patent metadata

Field	Value
Publication number	US-10567406-B2
Application number	US-201615238645-A
Country	US
Kind code	B2
Filing date	Aug 16, 2016
Priority date	Aug 16, 2016
Publication date	Feb 18, 2020
Grant date	Feb 18, 2020

Abstract

A computer-implemented method according to one embodiment includes identifying a cloud computing environment, establishing a baseline associated with input and output requests within the cloud computing environment, monitoring activity associated with the cloud computing environment, comparing the activity to the baseline, and performing one or more actions, based on the comparing.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
identifying a cloud computing environment;
establishing a baseline including a ratio of logged read requests received by the cloud computing environment for a first predetermined time period to logged write requests received by the cloud computing environment for the first predetermined time period, including determining and logging an identifier associated with the ratio of logged read requests to logged write requests received by the cloud computing environment for the first predetermined time period;
monitoring activity associated with the cloud computing environment, including a ratio of current read requests to current write requests received by the cloud computing environment, the monitoring including determining an identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment;
comparing the activity to the baseline, including comparing the identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment to the logged identifier associated with the logged read requests and logged write requests received by the cloud computing environment for the first predetermined time period; and
performing one or more security actions within the cloud computing environment, based on the comparing, including blocking the identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment, in response to determining that the activity is a security threat.

2. The computer-implemented method of claim 1 , wherein the baseline further includes:
a volume of the logged read requests made to the cloud computing environment for the first predetermined time period, and
a volume of the logged write requests made to the cloud computing environment for the first predetermined time period.

3. The computer-implemented method of claim 1 , wherein the activity further includes:
a volume of the current read requests received by the cloud computing environment for a current predetermined time period, and
a volume of the current write requests received by the cloud computing environment for the current predetermined time period.

4. The computer-implemented method of claim 1 , wherein:
comparing the activity to the baseline includes flagging the activity in response to determining that the activity deviates from the baseline by more than a predetermined amount,
performing the one or more security actions includes, in response to flagging the activity:
comparing the activity to one or more predetermined threat criteria, and
determining and blocking one or more identifiers associated with the activity, in response to determining that the activity is a security threat in response to comparing the activity to the one or more predetermined threat criteria.

5. The computer-implemented method of claim 1 , wherein the comparing is performed on a recurring basis according to a predetermined amount of time.

6. The computer-implemented method of claim 1 , wherein performing the one or more security actions includes flagging the activity as an anomaly in response to determining that the activity deviates from the baseline by more than a predetermined amount.

7. The computer-implemented method of claim 6 , wherein performing the one or more security actions may include comparing the activity to one or more predetermined security threat criteria in response to determining that the activity is flagged as the anomaly.

8. The computer-implemented method of claim 7 , wherein one or more security actions are performed in response to determining that the activity flagged as the anomaly is a security threat as a result of the comparing of the activity to the one or more predetermined security threat criteria.

9. A computer program product for monitoring activity associated with a cloud computing environment, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processor to cause the processor to perform a method comprising:
identifying the cloud computing environment, utilizing the processor;
establishing, utilizing the processor, a baseline including a ratio of logged read requests received by the cloud computing environment for a first predetermined time period to logged write requests received by the cloud computing environment for the first predetermined time period, including determining and logging an identifier associated with the ratio of logged read requests to logged write requests received by the cloud computing environment for the first predetermined time period;
monitoring the activity associated with the cloud computing environment, including a ratio of current read requests to current write requests received by the cloud computing environment, utilizing the processor, the monitoring including determining an identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment;
comparing the activity to the baseline, utilizing the processor, including comparing the identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment to the logged identifier associated with the logged read requests and logged write requests received by the cloud computing environment for the first predetermined time period; and
performing, utilizing the processor, one or more security actions within the cloud computing environment, based on the comparing, including blocking the identifier associated with the ratio of current read requests to current write requests received by the cloud computing environment, in response to determining that the activity is a security threat.

10. The computer program product of claim 9 , wherein the baseline indicates an expected input/output (I/O) pattern to the cloud computing environment.

11. The computer program product of claim 9 , wherein the baseline has one or more associated temporal constraints.

12. The computer program product of claim 9 , wherein the baseline is obtained by performing active monitoring of the cloud computing environment.

13. The computer program product of claim 9 , wherein:
comparing the activity to the baseline includes flagging the activity in response to determining that the activity deviates from the baseline by more than a predetermined amount,
performing the one or more security actions includes, in response to flagging the activity:
comparing the activity to one or more predetermined threat criteria, and
determining and blocking one or more identifiers associated with the activity, in response to determining that the activity is a security threat in response to comparing the activity to the one or more predetermined threat criteria.

14. The computer program product of claim 9 , wherein comparing the activity to the baseline includes determining whether the activity falls above or below the baseline by at least a predetermined amount.

15. The computer program product of claim 9 , wherein performing the one or more security actions includes flagging the activity as an anomaly in response to determining that the activity deviates from the baseline by more than a predetermined amount.

16. The computer program product of claim 15 , wherein performing the one or more security actions may include co

Assignees

• IBM

Inventors

• Astigarraga Tara
• Derobertis Christopher V
• Dickens Louie A
• Winarski Daniel J

Classifications

• H04L41/5003

  Managing SLA; Interaction between SLA and QoS · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title