The research presents a behavioral clustering model that analyzes cloud audit logs to map functional roles of cloud identities, such as administrators, backup services, security tools, and DevOps. Using unsupervised machine learning algorithms UMAP and HDBSCAN, the model clusters over 40,000 identities from 125 cloud environments based on their API activity patterns. This approach overcomes limitations of relying solely on IAM policies or naming conventions, which can be misleading due to over-privileged identities and attacker masquerading. The model enables continuous operational visibility and automated threat detection via lightweight heuristics implemented in SQL, demonstrated with a focus on AWS CloudTrail data. The methodology is adaptable to other cloud providers and environments.

The model enhances cloud security by providing richer context for detecting malicious activity that might otherwise be hidden by legitimate permissions or benign labels. It helps differentiate normal operational behavior from potential security breaches by mapping identities to their functional roles based on actual behavior rather than assigned permissions alone. This improves detection accuracy and reduces false positives in cloud threat detection. There is no indication of a direct vulnerability or exploit; rather, this is a research and detection enhancement.

This is a research and detection methodology rather than a vulnerability requiring patching. Organizations can adopt the behavioral clustering approach to improve cloud identity visibility and threat detection. Palo Alto Networks customers benefit from integrated protections via Cortex Cloud, Cortex XDR, XSIAM, and Idira products. No direct remediation or patch is applicable. Organizations should consider implementing similar behavioral analysis techniques to complement existing cloud security posture management and identity governance.