Behavioral Clustering Maps Cloud Identity Roles at Scale

Security teams face a fundamental challenge in cloud environments: distinguishing legitimate identity behavior from potential threats. A new behavioral clustering approach developed by Palo Alto Networks' Unit 42 research team offers a systematic way to map the functional roles of cloud identities by analyzing their actual API activity rather than relying solely on assigned permissions.

The research examined more than 40,000 identities across 125 cloud environments over two months, according to findings first reported by Unit 42. The team applied unsupervised machine learning techniques—specifically UMAP (Uniform Manifold Approximation and Projection) and HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise)—to AWS CloudTrail audit logs, revealing distinct behavioral clusters that correspond to functional roles including administrators, backup services, security tools, and DevOps operations.

Why it matters

Traditional cloud security approaches focus on what identities can do based on IAM policies, but attackers routinely exploit over-privileged identities to blend malicious activity with legitimate operations. Behavioral clustering shifts focus to what identities actually do, providing context that makes anomalous activity easier to detect. The methodology also extracts lightweight heuristic logic that can run in standard SQL, enabling continuous classification without maintaining resource-intensive ML pipelines.

From permissions to patterns

The distinction between capability and behavior is critical. While cloud security posture management tools audit assigned permissions, they miss the operational reality. An identity enumerating all resources might be a security scanner performing routine scans or a compromised backup service that normally touches only a single storage bucket. Context determines whether the activity is benign or malicious.

The researchers visualized identities as data points in two-dimensional space, where proximity indicates behavioral similarity. The analysis identified 30 major clusters representing approximately 20,000 identities. One of the largest clusters contained roughly 5,000 administrative user identities across more than 100 cloud projects, distinguished by operations like ConsoleLogin—invoked by 94% of identities in that cluster but fewer than 1% elsewhere.

Four-method validation

To decode each cluster's functional role, the team combined operation frequency analysis, class-based TF-IDF scoring to identify distinguishing operations, attribute-based mapping that highlights specific operations or naming patterns, and identity naming pattern mining. For the administrator cluster, automated analysis discovered the default prefix "AWSReservedSSO_AdministratorAccess_" generated by AWS IAM Identity Center.

The methodology converts raw audit logs into identity vectors capturing invoked operations, then applies dimensionality reduction before clustering. The initial boolean vectors span more than 15,000 possible AWS operations. UMAP compresses these into 32-dimensional dense embeddings for clustering and separate two-dimensional projections for visualization.

Scaling detection

After identifying behavioral groups, the team trained simple logistic regression classifiers on the original sparse vectors to evaluate whether new identities belong to known clusters. Using L1 regularization, these models focus exclusively on a small subset of critical operations, making them interpretable and efficient. The approach enables organizations to classify functional identity roles continuously without running the full clustering pipeline.

While the research focused on AWS CloudTrail data, the methodology extends to other cloud providers, SaaS platforms, and Kubernetes environments. Unit 42 first reported these findings in a detailed technical analysis published on the Palo Alto Networks threat intelligence blog.