"As cloud environments expand to include human, machine and autonomous agent identities, mapping the functional roles of these identities has become a significant security challenge," the Unit 42 report from Palo Alto Networks states. The team lays out a practical, data-driven method for turning audit logs into a behavioral map that reveals what identities actually do — not merely what permissions they hold.
Behavioral clustering model and dataset
The researchers examined activity from more than 40,000 identities across 125 cloud environments over a two-month period, converting API activity into behavioral vectors and grouping similar identities into functional roles such as administrators, backup services, security tooling and DevOps. The report emphasizes why this matters: resource names and assigned IAM policies often fail to reveal true behavior, and attackers exploit that opacity by masquerading behind benign labels and pre-existing permission profiles.
To decode role by behavior, the team combines operation frequency, class-based TF‑IDF (c-TF‑IDF) scoring, attribute mapping (by service or operation), and mining of identity-name substrings. The result is a visual and quantitative map where proximity reflects behavioral similarity and dense regions correspond to consistent functional roles.
Administrator console cluster in AWS — a worked example
The largest, best-isolated cluster in the dataset represents administrative users operating through the AWS Management Console. Roughly 5,000 identities from over 100 cloud projects formed this cluster; about 94% of them invoked ConsoleLogin events, while fewer than 1% of identities in any other cluster did so. Around 60% also called console-related APIs like GetCostAndUsage and GetCostForecast.
c-TF‑IDF scoring highlighted operations that are characteristic markers for this group — for example, APIs automatically triggered on console sign-in scored highly even if their raw frequency was modest. Textual mining turned up repeated name patterns such as the prefix AWSReservedSSO_AdministratorAccess_, indicating the cluster’s real-world tie to AdministratorAccess via AWS IAM Identity Center. Together, these signals let the researchers confidently label this dense region as administrative console users.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDimensionality reduction and clustering: UMAP and HDBSCAN
The pipeline begins by treating the set of AWS operations as a “vocabulary” — more than 15,000 possible operations across some 240 services — and representing each identity as a high-dimensional boolean vector (positions marked true if an operation was observed). These sparse vectors can exceed 10,000 dimensions.
To make the data tractable, the team applies UMAP (using cosine similarity) in two parallel passes: one to produce compact dense embeddings (32 continuous values) for clustering and another to generate two-dimensional visualizations. HDBSCAN then detects dense regions and labels clusters or outliers. The resulting groups align closely with expected functional roles such as DevOps, infrastructure-as-code runners, CI/CD, security products, backup agents, networking components and FinOps platforms.
Lightweight classification, L1 regularization, and SQL-scaled detection
Rather than repeatedly running the full, resource-intensive pipeline for new identities, the researchers distilled cluster logic into interpretable classifiers. They train simple logistic regression models on the original sparse boolean vectors and apply L1 regularization (Lasso) to force most coefficients to zero. The result is a compact, explainable model in which a few dozen operations — each with an observable weight — determine likely cluster membership.
Because the classifier computes a weighted sum of present operations, its logic can be translated into standard SQL. That permits continuous, large-scale role inference without constant re-running of the ML pipeline: an organization can embed the distilled rules directly into queries to classify identities, maintain operational baselines, and highlight anomalous deviations.
What this means for technologists, procurement leaders, and adversaries
- Technologists and security teams: Behavioral baselines add context beyond CSPM permission audits; the report shows how enriched telemetry can expose high‑risk anomalies, e.g., a backup agent that suddenly performs administrative actions.
- Procurement and enterprise leaders: The approach can be operationalized at scale — the researchers point to lightweight SQL implementations and classifiers — and mapped into products such as Cortex Cloud, Cortex XDR/XSIAM, Idira PAM and Idira IGA to pair static and behavioral controls.
- Adversaries and threat actors: Masquerading with benign names and over-privileged identities becomes harder to sustain when detection incorporates the observed pattern of operations rather than labels or assigned permissions alone.
The Unit 42 analysis delivers a pragmatic bridge between deep, unsupervised learning and operational detection: behavioral maps clarify what identities actually do, compact interpretable classifiers make that insight consumable at scale, and simple SQL implementations lower the barrier for continuous monitoring. As the report notes, "context is key" — knowing an identity’s functional baseline enables faster detection of deviations and accelerates incident response.
Read the original Unit 42 report: https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/
