Abstract: Methods and systems for identifying malicious tenants using machine learning (ML) models and spatialized activity data within a cloud platform. A method includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, training an ML model based on the spatial data, and deploying the trained ML model in the cloud platform to detect tenants engaged in malicious activities. A method also includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, inputting the spatial data into a trained ML model, and initiating a remedial action against the tenant based on an output indicating that activity data for the tenant has a threshold probability of being malicious.

Abstract: Methods and systems for identifying malicious tenants using machine learning (ML) models and spatialized activity data within a cloud platform. A method includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, training an ML model based on the spatial data, and deploying the trained ML model in the cloud platform to detect tenants engaged in malicious activities. A method also includes accessing sequential activity data for a tenant, converting the sequential data into spatial data by creating multi-dimensional representation(s) expressing the sequential data across different timescales, inputting the spatial data into a trained ML model, and initiating a remedial action against the tenant based on an output indicating that activity data for the tenant has a threshold probability of being malicious.

Abstract: Systems and methods herein provide a detection engine and its related functions. In an aspect, a detection engine determines tenants associated with a service within a cloud-based or hybrid environment and determines a plurality of resources associated with the tenants. Based on the resources, the detection engine determines a relational similarity between a first subset of tenants, such as by clustering the tenants into groups indicating related resources. From the grouping, the detection engine determines a first group of tenants contains bot-created tenants. Subsequently, the detection engine submits the first group of tenants as input into a neural network model to determine whether the tenants within the first group are legitimate or bot-created. Based on the output from the neural network model, the detection engine identifies the bot-created tenants within the first group, as well as any legitimate tenants present therein.

Abstract: According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to cause a graphical user interface to be displayed, the graphical user interface including graphical icons of a plurality of authentication types available for assignment to users and a graphical icon of a first user. The instructions may also cause the processor to detect a movement of a graphical icon of a first authentication type from a first location to a second location in the graphical user interface, the second location corresponding to the graphical icon of the first user and based on the detected movement, assign the first authentication type to the first user.

Abstract: According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to cause a graphical user interface to be displayed, the graphical user interface including graphical icons of a plurality of authentication types available for assignment to users and a graphical icon of a first user. The instructions may also cause the processor to detect a movement of a graphical icon of a first authentication type from a first location to a second location in the graphical user interface, the second location corresponding to the graphical icon of the first user and based on the detected movement, assign the first authentication type to the first user.

Abstract: An account provisioning manager is disclosed. A placeholder account is generated with a primary work set attribute and a plurality of enhanced work set attributes. Initially, the primary work set attribute is populated with data to convert the placeholder account into an onboarded operating account. Subsequently, the plurality of enhanced work set attributes are populated via data propagation into the onboarded operating account, wherein an enhanced work set attribute of the plurality of enhanced work set attributes is selectively populated in response to a trigger for the onboarded operating account.

Abstract: Techniques are described herein that are capable of providing sequence-based authentication using rhythm and/or poses. A user-defined secret of a user is received. The user-defined secret indicates a user-defined sequence, which includes a sequence of shapes, a rhythmic sequence of sounds, and/or a rhythmic sequence of visual gestures. A first request for the user to be granted access to a resource is received. A second request, requesting that the user repeat the user-defined sequence, is caused to be presented via a user interface of a computing system. A second sequence, which is included in a response to the second request, is compared to the user-defined sequence. Access to the resource is provided to the user based at least in part on the second sequence corresponding to the user-defined sequence.

Abstract: According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to cause a graphical user interface to be displayed, the graphical user interface including graphical icons of a plurality of authentication types available for assignment to users and a graphical icon of a first user. The instructions may also cause the processor to detect a movement of a graphical icon of a first authentication type from a first location to a second location in the graphical user interface, the second location corresponding to the graphical icon of the first user and based on the detected movement, assign the first authentication type to the first user.

Abstract: An account provisioning manager is disclosed. A placeholder account is generated with a primary work set attribute and a plurality of enhanced work set attributes. Initially, the primary work set attribute is populated with data to convert the placeholder account into an onboarded operating account. Subsequently, the plurality of enhanced work set attributes are populated via data propagation into the onboarded operating account, wherein an enhanced work set attribute of the plurality of enhanced work set attributes is selectively populated in response to a trigger for the onboarded operating account.

Abstract: According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to determine a call duration threshold assigned to an entity, in which a phone number may be associated with the entity. The processor may also track durations of one or more calls placed to the phone number, determine whether the tracked durations of the one or more calls placed to the phone number meet or exceed the call duration threshold, and based on a determination that the tracked durations meet or exceed the call duration threshold, throttle placement of an additional call to the phone number.

Abstract: According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to determine a call duration threshold assigned to an entity, in which a phone number may be associated with the entity. The processor may also track durations of one or more calls placed to the phone number, determine whether the tracked durations of the one or more calls placed to the phone number meet or exceed the call duration threshold, and based on a determination that the tracked durations meet or exceed the call duration threshold, throttle placement of an additional call to the phone number.