Basslines and Baselines: The role of Anomaly Detection in Cloud Security

The talk opens with the operational problem of cloud-native security. Microservices, Kubernetes, autoscaling and short-lived addresses make systems harder to understand, while large signature rule sets produce many false positives, break workloads and wear down analysts. Anomaly detection is presented as an additional layer alongside signature tools and hardening, not a replacement for them.

The speaker traces the approach to Dorothy Denning's late-1980s intrusion detection model, which assumed that exploitation shows up as abnormal use of a system. He walks through its components: subjects such as human accounts, service accounts and API keys; objects such as instances, load balancers, clusters and containers; audit records drawn from cloud and Kubernetes logs; and profiles that describe who talks to whom over time. A household analogy illustrates why baselines should be built per environment. The talk also covers the model's limits: attacks that resemble normal traffic, benign changes from fast development, data silos, scaling demands, and attackers who might learn the baseline or flood it with noise. Grouping identical resources is discussed as a way to reduce alert storms.

The closing section points to progress in unsupervised machine learning and scalable architectures that make baselines more practical. Practitioners are advised to test vendors for scale in their own environment, to look for ways to combine signature and anomaly signals, and to correlate weak events rather than judging each one alone.