# CloudLens: Modeling and Detecting Cloud Security Vulnerabilities

arXiv: https://arxiv.org/abs/2402.10985 · HTML: https://mlsanity.com/paper/2402.10985/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 33 references that are in the map.
- First posted on arXiv 16 Feb 2024.

## Builds on (most cited first, 3 of 3)

- [POMDPs Make Better Hackers: Accounting for Uncertainty in Penetration Testing](https://mlsanity.com/paper/1307.8182/) (2013)
- [Attack Planning in the Real World](https://mlsanity.com/paper/1306.4044/) (2013)
- [Using Constraint Programming and Graph Representation Learning for Generating Interpretable Cloud Security Policies](https://mlsanity.com/paper/2205.01240/) (2022)

## Abstract (arXiv)

Cloud computing services provide scalable and cost-effective solutions for data storage, processing, and collaboration. With their growing popularity, concerns about security vulnerabilities are increasing. To address this, first, we provide a formal model, called CloudLens, that expresses relations between different cloud objects such as users, datastores, security roles, representing access control policies in cloud systems. Second, as access control misconfigurations are often the primary driver for cloud attacks, we develop a planning model for detecting security vulnerabilities. Such vulnerabilities can lead to widespread attacks such as ransomware, sensitive data exfiltration among others. A planner generates attacks to identify such vulnerabilities in the cloud. Finally, we test our approach on 14 real Amazon AWS cloud configurations of different commercial organizations. Our system can identify a broad range of security vulnerabilities, which state-of-the-art industry tools cannot detect.