FortiCNAPP: Securing the Cloud via Anomaly Detection

Modern Security for Modern Threats 

Modern cyberattacks are designed to evade detection. Traditional, rules-based cybersecurity tools—like signature-based antivirus software and static rules—can't be your only protection. The sheer volume of activities happening in a cloud environment, the complexity of cloud infrastructure and deployment diversity, and the sophistication of modern threats and vulnerable attack surfaces demand automated intelligence solutions. This is where machine learning (ML) and anomaly detection have become a new foundation of cloud security. 

So, how does FortiCNAPP use these powerful technologies to create a more secure digital world for our customers? Let's take a look. 

The Power of Anomaly Detection: Finding the Needle in the Haystack 

At its core, anomaly detection is about identifying behavior that deviates from a known "normal" baseline. In a cloud environment, this could mean anything from a user suddenly accessing many sensitive files to a server making unusual network requests. While a human security analyst would be overwhelmed by the sheer volume of data, machine learning models thrive on it. 

FortiCNAPP uses ML models—like language models and graph neural networks—to continuously analyze massive datasets, including logs, network traffic, and user activity. This allows it to build a dynamic and constantly updated profile of what "normal" looks like for a specific user, application, or system. When an event occurs that falls outside this established pattern, the system flags it as an anomaly, alerting security teams to a potential threat. 

Following a data-centric approach, FortiCNAPP leverages statistical models and AI to dynamically determine when something suspicious is taking place in a way that’s unique to each customer’s cloud environment. By placing a strong focus on timely threat detection and quality of the data that FortiCNAPP uniquely captures, we achieve the best detection outcomes for our customers.   

 
We achieve this with a two-part approach: 

• Broad Environment Monitoring: We observe the entire environment to spot any unusual changes, no matter how subtle. 

• Targeted Threat Detection: We also focus on highly popular tactics used by attackers—actions that are difficult to catch with static rules. 

This strategy delivers a range of benefits that traditional security tools can't match: 

• Early Threat Detection: We find threats like zero-day attacks and other emerging risks that traditional methods miss. Our systems proactively adapt to the evolving threat landscape, giving you a crucial head start. 

• Enriched Context: Every alert is enriched with detailed information about the anomaly, helping your team quickly understand the nature of the threat and its potential impact. 

• Comprehensive Visibility: We provide a better understanding of normal behavior patterns across your environment, helping you spot deviations that signify a security risk and improving your overall situational awareness. 

• Insider Threat Detection: By combining behavior-based signals with targeted threat detections, we can effectively detect insider threats and unauthorized access by privileged users. 

• Reduced Alert Fatigue: We cut through the noise. Our system aggregates related anomalies into a single, prioritized alert, so your security team can focus on what matters most. 

Here are some real-world examples of how this works: 

• Entity Outlier detections: We build clusters to represent the normal behavior of entities like processes and machines. Our approach combines both automation and expert knowledge. Our system learns from your data and dynamically adapts to your environment. At the same time, we embed extensive domain knowledge—such as knowing that the /bin directory on Linux contains system binaries—to reduce false positives and improve accuracy. 

• Geographic Anomalies: We use ML to monitor the geographic origin of API calls and logins. If a user's account, which is typically used in San Francisco, suddenly makes a request from a different continent, the system can trigger a multi-factor authentication prompt or temporarily block the request until the user's identity is verified. 

• IAM Role Behavior Changes: An IAM (Identity and Access Management) role is a set of permissions for a user or service. An ML model learns the normal behavior of each role. For example, it might learn that an S3_ReadOnly_Role is always used by a data analytics service to read files from a specific S3 bucket. If that same role suddenly attempts to assume a more powerful administrative role or starts deleting data, the system immediately flags this as an anomaly. This type of detection is critical for identifying privilege escalation and lateral movement attempts. 

• Active Scanning Detection: Active Scanning involves sending network traffic to various IP addresses to determine which ones are live. Identifying this type of behavior allows security teams to detect potential threats before they escalate into more advanced attacks. 

• Domain Generation Algorithm (DGA) Detection: Malware often uses DGAs to generate many random domain names, making it difficult for traditional security measures to block them. Lacework FortiCNAPP uses machine learning, including deep learning and natural language processing (NLP) techniques, to identify these DGA-generated domains. 

• Compromised Storage: Imagine an employee who normally logs in from New York City during business hours. If their account suddenly logs in from a different country at 3 a.m. and starts downloading terabytes of data, our detection system would immediately flag this as suspicious. This could indicate a compromised account and a potential data breach. 

• DNS Command line Injection: We attempt to detect malicious DNS hostnames, including DNS command line injection attacks. 

Integration with Composite Alerts 

The ML-powered detections are surfaced as anomaly alerts and are also integrated with Composite Alerts to reduce noise. With Anomaly Alerts and Composite Alert correlation of these signals with multiple IOCs, security teams that have become accustomed to the bombardment of thousands of individual alerts, can save time by investigating FortiCNAPP AL & ML powered priority alerts. This allows security professionals to cut through the noise and focus their attention on real threats, improving the accuracy, speed, and effectiveness of your threat detection and response.