DETECTING MALICIOUS SHELL SCRIPTS IN COMPUTE INSTANCES OF CLOUD COMPUTING PLATFORMS

A cloud computing platform provides compute instances of customer accounts. A shell script in a compute instance is evaluated by normalizing the shell script to output a set of tokens that are separated by a predetermined separator. The set of tokens is searched for presence of reference tokens. The counts of the reference tokens in the set of tokens are formed into an occurrence vector, which is evaluated by a machine learning model to determine if the shell script is malicious.