LoFP LoFP / authorized model training

Techniques

Sample rules

Potential Azure OpenAI Model Theft

Description

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

Detection logic

from logs-azure_openai.logs-*
| where azure.open_ai.operation_name == "ListKey" and azure.open_ai.category == "Audit"
| KEEP @timestamp, azure.open_ai.operation_name , azure.open_ai.category, azure.resource.group, azure.resource.name, azure.open_ai.properties.response_length
| stats count = count(), max_data_transferred = max(azure.open_ai.properties.response_length) by azure.resource.group , azure.resource.name
| where count >= 100 or max_data_transferred >= 1000000
| sort count desc