Abstract: Systems and methods for session similarity identification include receiving historical sessions for one of a plurality of machines operating in a cloud-based system. The methods can include receiving and manage sessions from any number of machines in the cloud-based system. The system then receives monitored sessions for the machine or plurality of machines, and calculates a similarity between the received historical sessions and the received monitored sessions. After calculating the similarity, the system defines a risk score based on the similarity.

Abstract: Systems and methods for dynamic applicative session separation and grouping. The system receives logs from one of a plurality of machines. The system can receive and manage logs from any number of machines in the cloud-based system. The system resamples the received logs by a given time frame. The system determines time intervals between activities based on the resampling of the logs. After determining the time intervals, the system determines a probability of a new log to be received after a time interval. The system then defines a session separation breaker and defines one or more logs as opening or closing a session.

Abstract: Systems and methods include obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time; determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users; scoring and ranking the unused and abnormal user accounts; and remediating a set of the ranked unused and abnormal user accounts.

Abstract: Systems and methods include obtaining unused user accounts associated with a cloud application where an unused user account is one where a corresponding user has not accessed the cloud application in a certain period of time; determining a subset of the unused user accounts that are abnormal user accounts, wherein an abnormal user account is one that is anomalous compared to similar users; scoring and ranking the unused and abnormal user accounts; and remediating a set of the ranked unused and abnormal user accounts.

Abstract: A system and method for classifying entities accessing computing resources are provided. The method includes identifying, within a received request to access a computing resource, at least one data feature, wherein a data feature is a piece of data included in the request and uniquely identifies an entity sending the request; analyzing each of the at least one identified feature; and classifying, based on the analysis of the at least one identified data feature, the entity sending the request as any one of: a human, and a non-human.