# US 10,454,935 B2 · Method and system to detect discrepancy in infrastructure security configurations from translated security best practice configurations in heterogeneous environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,935 B2 - Document ID: US10454935B2 - Status: Granted - Kind: B2 - Application number: 15/481,499 - Filed: 2017-04-07 - Published: 2017-10-12 - Granted: 2019-10-22 - Earliest claimed: 2016-04-08 - Assignees: CloudKnox Security Inc. - Applicants: CloudKnox Security Inc. - Inventors: Balaji Parimi; Koteswara Rao Cherukuri - Web page: https://patentgrep.com/patent/US10454935B2 ## CPC - G06N 20/00: Machine learning - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 5/025: Extracting rules from data - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, system and/or an apparatus to detect discrepancy in infrastructure security configurations from translated security best practice configurations in heterogeneous environments is disclosed. A method of an infrastructure security server communicatively coupled with a set of heterogeneous infrastructures translates a set of security best practice configurations of the heterogeneous infrastructures and/or a set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to programmatic execution. The method monitors the infrastructure security configurations associated with the heterogeneous infrastructures using a processor and a memory. The method analyzes the infrastructure security configurations based on the translated security best practice configurations and/or the translated common vulnerabilities and exposures (CVE). The method detects any discrepancy of the infrastructure security configurations from the translated security best practice configurations, and/or any translated CVE. The method alerts a set of devices and a user through one communication channel about any discrepancy. ## Claims ### Claim 1 A method of an infrastructure security server communicatively coupled with a set of heterogeneous infrastructures, comprising: translating at least one of a set of security best practice configurations of the heterogeneous infrastructures and a set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to programmatic execution; monitoring infrastructure security configurations associated with the heterogeneous infrastructures using a processor and a memory of the infrastructure security server; analyzing the infrastructure security configurations associated with the heterogeneous infrastructures based on at least one of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE); detecting at least one of: any discrepancy of the infrastructure security configurations from the translated security best practice configurations, and any translated CVE in the infrastructure security configurations; and alerting to a set of devices and a user through at least one communication channel about any discrepancy of the infrastructure security configurations from the translated security best practice configurations and any translated CVE in the infrastructure security configurations. ### Claim 2 (depends on 1) The method of the infrastructure security server in claim 1, further comprising: translating at least one of the security best practice configurations of the heterogeneous infrastructures and the set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to a set of security rule definitions; and constructing a set of security profiles each comprising a subset of the set of the security rule definitions. ### Claim 3 (depends on 2) The method of the infrastructure security server in claim 2, further comprising: sharing the security rule definitions and the security profiles to be used by heterogeneous authorization systems and heterogeneous cloud-based services using a platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels. ### Claim 4 (depends on 2) The method of the infrastructure security server in claim 2: wherein the platform providing at least one application program interface (API) for third parties to develop the security rule definitions and the security profiles. ### Claim 5 (depends on 2) The method of the infrastructure security server in claim 2, further comprising: obtaining other shared security rule definitions and other shared security profiles from third parties using the platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels, wherein the other shared security rule definitions and the other shared security profiles are to be used by heterogeneous authorization systems and heterogeneous cloud-based services. ### Claim 6 (depends on 2) The method of the infrastructure security server in claim 2, further comprising: analyzing the infrastructure security configurations associated with the heterogeneous infrastructures based on the security rule definitions and the security profiles; detecting if the infrastructure security configurations violate any of the security rule definitions and the security profiles; alerting to the set of devices and the user through the at least one communication channel if the infrastructure security configurations violate any of the security rule definitions and the security profiles; and suggesting modifications of the infrastructure security configurations associated with the heterogeneous infrastructures to avoid violating any of the security rule definitions and the security profiles, wherein the modifications of the infrastructure security configurations is at least one of a manual, a semi-automatic, and a fully automatic. ### Claim 7 A system comprising: an infrastructure security server communicatively coupled with a set of heterogeneous infrastructures: to translate at least one of a set of security best practice configurations of the heterogeneous infrastructures and a set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to programmatic execution; to monitor infrastructure security configurations associated with the heterogeneous infrastructures using a processor and a memory of the infrastructure security server; to analyze the infrastructure security configurations associated with the heterogeneous infrastructures based on at least one of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE); to detect at least one of: a discrepancy of the infrastructure security configurations from the translated security best practice configurations, and the translated CVE in the infrastructure security configurations; to alert a set of devices and a user through at least one communication channel about any discrepancy of the infrastructure security configurations from the translated security best practice configurations and any translated CVE in the infrastructure security configurations; and to suggest modifications of the infrastructure security configurations associated with the heterogeneous infrastructures as a remediation for the discrepancy and the CVE, wherein the modifications of the infrastructure security configurations is at least one of a manual, a semi automatic, and a fully automatic. ### Claim 8 (depends on 7) The system of claim 7, wherein the infrastructure security server: to translate at least one of the security best practice configurations of the heterogeneous infrastructures and the set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to a set of security rule definitions; and to construct a set of security profiles each comprising a subset of the set of the security rule definitions. ### Claim 9 (depends on 7) The system of claim 7, wherein the infrastructure security server: to share the security rule definitions and the security profiles to be used by heterogeneous authorization systems and heterogeneous cloud-based services using a platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels. ### Claim 10 (depends on 7) The system of claim 7, wherein the infrastructure security server: to provide at least one application program interface (API) for third parties to develop the security rule definitions and the security profiles. ### Claim 11 (depends on 7) The system of claim 7, wherein the infrastructure security server: to obtain other shared security rule definitions and other shared security profiles from third parties using the platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels, wherein the other shared security rule definitions and the other shared security profiles are to be used by heterogeneous authorization systems and heterogeneous cloud-based services. ### Claim 12 (depends on 7) The system of claim 7, further comprising: a security best practices automation engine: to identify security best practices for the set of heterogeneous infrastructures, and to create security rule definitions m the infrastructure for each of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE), wherein the security rule definitions to include a rule, a violation triggering condition, and a remediation action. ### Claim 13 (depends on 12) The system of claim 12, wherein the security best practices automation engine to automatically execute the security rule definitions specified in each of the active security profiles. ### Claim 14 (depends on 12) The system of claim 12, wherein the remediation action to include at least one of the following: automatically fix the violation, notify the infrastructure security server, set a timer for automatic fix to start from the point of violation trigger, send a notification to the infrastructure security server about the violation, provide a way to schedule automatic fix for the violation, send a notification to the infrastructure security server about the violation, provide a link to the user to fix it, and provide ways to fix the violation at least one of a manually and a semi-automatically. ### Claim 15 An apparatus comprising: an infrastructure security server; and a set of heterogeneous infrastructures communicatively coupled with the infrastructure security server to: translate at least one of a set of security best practice configurations of the heterogeneous infrastructures and a set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to programmatic execution; monitor infrastructure security configurations associated with the heterogeneous infrastructures using a processor and a memory of the infrastructure security server; analyze the infrastructure security configurations associated with the heterogeneous infrastructures based on at least one of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE); detect at least one of: a discrepancy of the infrastructure security configurations from the translated security best practice configurations, and the translated CVE in the infrastructure security configurations; alert a set of devices and a user through at least one communication channel about any discrepancy of the infrastructure security configurations from the translated security best practice configurations and any translated CVE in the infrastructure security configurations; and suggest modifications of the infrastructure security configurations associated with the heterogeneous infrastructures as a remediation for the discrepancy and the CVE, wherein the modifications of the infrastructure security configurations is at least one of a manual, a semi-automatic, and a fully automatic. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the set of heterogeneous infrastructures communicatively coupled with the infrastructure security server to further: translate at least one of the security best practice configurations of the heterogeneous infrastructures and the set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to a set of security rule definitions; and construct a set of security profiles each comprising a subset of the set of the security rule definitions. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the set of heterogeneous infrastructures communicatively coupled with the infrastructure security server to further: share the security rule definitions and the security profiles to be used by heterogeneous authorization systems and heterogeneous cloud-based services using a platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the set of heterogeneous infrastructures communicatively coupled with the infrastructure security server to further: obtain other shared security rule definitions and other shared security profiles from third parties using the platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels, wherein the other shared security rule definitions and the other shared security profiles are to be used by heterogeneous authorization systems and heterogeneous cloud-based services. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the set of heterogeneous infrastructures communicatively coupled with the infrastructure security server to further: analyze the infrastructure security configurations associated with the heterogeneous infrastructures based on the security rule definitions and the security profiles; detect if the infrastructure security configurations violate any of the security rule definitions and the security profiles; alert the set of devices and the user through the at least one communication channel if the infrastructure security configurations violate any of the security rule definitions and the security profiles; and suggest modifications of the infrastructure security configurations associated with the heterogeneous infrastructures to avoid violating any of the security rule definitions and the security profiles, wherein the modifications of the infrastructure security configurations is at least one of a manual, a semi-automatic, and a fully automatic. ### Claim 20 (depends on 15) The apparatus of claim 15, further comprising: a security best practices automation engine: to identify security best practices for the set of heterogeneous infrastructures, and to create security rule definitions m the infrastructure for each of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE), wherein the security rule definitions to include a rule, a violation triggering condition, and a remediation action. ### Claim 21 A method of an infrastructure security server communicatively coupled with a set of heterogeneous infrastructures, comprising: translating at least one of a set of security best practice configurations of the heterogeneous infrastructures and a set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to programmatic execution; monitoring infrastructure security configurations associated with the heterogeneous infrastructures using a processor and a memory of the infrastructure security server; analyzing the infrastructure security configurations associated with the heterogeneous infrastructures based on at least one of the translated security best practice configurations and the translated common vulnerabilities and exposures (CVE); detecting at least one of: any discrepancy of the infrastructure security configurations from the translated security best practice configurations, and any translated CVE in the infrastructure security configurations; and suggesting modifications of the infrastructure security configurations associated with the heterogeneous infrastructures as a remediation for the discrepancy and the CVE, wherein the modifications of the infrastructure security configurations is at least one of a manual, a semi-automatic, and a fully automatic. ### Claim 22 (depends on 21) The method of the infrastructure security server in claim 21, further comprising: translating at least one of the security best practice configurations of the heterogeneous infrastructures and the set of common vulnerabilities and exposures (CVE) of the heterogeneous infrastructures to a set of security rule definitions; and constructing a set of security profiles each comprising a subset of the set of the security rule definitions. ### Claim 23 (depends on 22) The method of the infrastructure security server in claim 22, further comprising: sharing the security rule definitions and the security profiles to be used by heterogeneous authorization systems and heterogeneous cloud-based services using a platform comprising at least one of a social network, a networked forum, a networked bulletin board, a networked chat room, a networked news group, and other communications channels.