Cloud service usage monitoring system

摘要

A cloud service usage assessment system analyzes network traffic from an enterprise data network and generates cloud service usage analytics for the enterprise. In some embodiments, the cloud service usage analytics may include cloud service usage risk assessment. The cloud service usage assessment system is advantageous applied to assess network security in view of an enterprise's adoption of multiple cloud based services.

主权项

1. A method of assessing a cloud service usage level of an enterprise operating an enterprise data network, the method comprising:
receiving, at an on-premises processor configured within the enterprise data network, network event logs associated with network traffic traveling to and from the enterprise data network, the network event logs comprising network event data describing network events traveling to and from the enterprise data network, the network event data comprising a source indicator, a destination indicator, a time of the network event, and a request parameter; processing, at the on-premises processor, the network event logs to generate processed network event data containing network event data related to cloud service usage; transmitting the processed network event data to an off-premises usage analysis system configured outside of the enterprise data network; assessing, using the off-premises usage analysis system, cloud service usage behavior and pattern of the enterprise based on the processed network event data; and generating, using the off-premises usage analysis system, a cloud service usage analytic based on the cloud service usage behavior and pattern of the enterprise, the cloud service usage analytic describing the use of cloud-based services from one or more cloud service providers by the enterprise, wherein processing, at the on-premises processor, the network event logs to generate processed network event data containing network event data related to cloud service usage comprises:
analyzing the network event logs to identify network events related to the use of cloud-based services;filtering the network event logs to include only network event data relating to the use of cloud-based services;tokenizing the filtered network event data to remove identifying information relating to the enterprise or to users of the enterprise and to replace the identifying information with random identifiers;applying a compression algorithm to the tokenized and filtered network event data; andproviding the compressed, tokenized and filtered network event data as the processed network even data.