# US 10,484,402 B2 · Security in virtualized computing environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,402 B2 - Document ID: US10484402B2 - Status: Granted - Kind: B2 - Application number: 15/677,322 - Filed: 2017-08-15 - Published: 2018-02-22 - Granted: 2019-11-19 - Earliest claimed: 2016-08-16 - Assignees: British Telecommunications public limited company - Applicants: British Telecommunications Public Limited Company - Inventors: Fadi El-Moussa; Ian Herwono - Web page: https://patentgrep.com/patent/US10484402B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/047: Probabilistic or stochastic networks - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2221/2149: Restricted operating environment - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A computer implemented method to identify one or more parameters of a configuration of a target virtual machine (VM) in a virtualized computing environment used in a security attack against the target VM, the security attack exhibiting a particular attack characteristic, is disclosed. ## Claims ### Claim 1 A computer implemented method to identify one or more parameters of a configuration of a target virtual machine (VM) in a virtualized computing environment used in a security attack against the target VM, the security attack exhibiting a particular attack characteristic, the method comprising: training a machine learning algorithm as a classifier based on a plurality of training data items, each training data item corresponding to a training VM and including a representation of parameters for a configuration of the training VM and a representation of characteristics of security attacks for the training VM; generating a first data structure for storing one or more relationships between VM configuration parameters and attack characteristics, wherein the first data structure is generated by sampling the trained machine learning algorithm to identify the one or more relationships; receiving a second data structure storing a directed graph representation of one or more sequences of VM configuration parameters for achieving the particular attack characteristic of the security attack, the VM configuration parameters in the directed graph being determined based on the first data structure; and determining a subset of sequences in the directed graph corresponding to VM configuration parameters of the target VM to identify VM configuration parameters of the target VM used in the security attack. ### Claim 2 (depends on 1) The method of claim 1, wherein each of the attack characteristics has associated a protective measure, the method further comprising, in response to the identification of an attack characteristic to which the target VM is susceptible, implementing the protective measure so as to protect the VM from attacks having the attack characteristic. ### Claim 3 (depends on 2) The method of claim 2 wherein each protective measure is a configuration parameter or a change to a configuration parameter for a VM to protect against an attack characteristic. ### Claim 4 (depends on 1) The method of claim 1, wherein the machine learning algorithm is a restricted Boltzmann machine. ### Claim 5 (depends on 4) The method of claim 4 wherein the restricted Boltzmann machine includes a plurality of hidden units and a plurality of visible units, and sampling the trained machine learning algorithm includes generating sample inputs for the hidden units to determine values of the visible units. ### Claim 6 (depends on 5) The method of claim 5 wherein each generated sample input is a vector of binary values wherein each binary value is determined using a randomization algorithm. ### Claim 7 (depends on 1) The method of claim 1, wherein the characteristics of security attacks include an indication of the consequence of a security attack executing in the training VM. ### Claim 8 (depends on 1) The method of claim 1, wherein each training data item comprises a vector of binary values indicating each indicating a presence or absence of a configuration feature and an attack characteristic of a corresponding training VM. ### Claim 9 (depends on 1) The method of claim 1, wherein the data structure is a matrix data structure for mapping VM configuration parameters against attack characteristics. ### Claim 10 (depends on 1) A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the method as claimed in claim 1. ### Claim 11 A computer system comprising: a processor and memory storing computer program code to identify one or more parameters of a configuration of a target virtual machine (VM) in a virtualized computing environment used in a security attack against the target VM, the security attack exhibiting a particular attack characteristic by: training a machine learning algorithm as a classifier based on a plurality of training data items, each training data item corresponding to a training VM and including a representation of parameters for a configuration of the training VM and a representation of characteristics of security attacks for the training VM; generating a first data structure for storing one or more relationships between VM configuration parameters and attack characteristics, wherein the first data structure is generated by sampling the trained machine learning algorithm to identify the one or more relationships; receiving a second data structure storing a directed graph representation of one or more sequences of VM configuration parameters for achieving the particular attack characteristic of the security attack, the VM configuration parameters in the directed graph being determined based on the first data structure; and determining a subset of sequences in the directed graph corresponding to VM configuration parameters of the target VM to identify VM configuration parameters of the target VM used in the security attack.