# Cloud Cybersecurity Research

Published articles for Cloud Cybersecurity Research.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

DevFeed: [Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection](<https://devfeed.tech/articles/unmasking-cloud-identities-from-behavioral-clustering-to-automated-detection-17391.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/>)

Author: Osher Jacob

Published: 2026-09-14T10:00:01Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [SIEM, Security, Observability](<https://devfeed.tech/topics/siem-security-observability.md>), [Machine learning](<https://devfeed.tech/topics/machine-learning.md>), [Algorithms](<https://devfeed.tech/topics/algorithms.md>), [SQL](<https://devfeed.tech/topics/sql.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [identity and access management](<https://devfeed.tech/topics/identity-and-access-management.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [algorithms](<https://devfeed.tech/tags/algorithms.md>), [amazon-web-services-aws](<https://devfeed.tech/tags/amazon-web-services-aws.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-cybersecurity-research](<https://devfeed.tech/tags/cloud-cybersecurity-research.md>), [cloud-detection](<https://devfeed.tech/tags/cloud-detection.md>), [devops](<https://devfeed.tech/tags/devops.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity-and-access-management](<https://devfeed.tech/tags/identity-and-access-management.md>), [logs](<https://devfeed.tech/tags/logs.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [post](<https://devfeed.tech/tags/post.md>), [sql](<https://devfeed.tech/tags/sql.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>)

### AI overview

This article presents a behavioral clustering model for mapping cloud identities to functional roles using activity patterns from audit logs. It applies unsupervised machine learning with UMAP and HDBSCAN to data from more than 40,000 identities across 125 cloud environments, and shows how the resulting map can support automated threat detection. The article also explains how lightweight heuristics extracted from the map can classify identities at scale using standard SQL, reducing the need for continuous resource-intensive machine learning pipelines.

### Source excerpt

We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42.