# US 11,308,221 B2 · Testing cloud application integrations, data, and protocols > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,221 B2 - Document ID: US11308221B2 - Status: Granted - Kind: B2 - Application number: 16/927,298 - Filed: 2020-07-13 - Published: 2020-10-29 - Granted: 2022-04-19 - Earliest claimed: 2017-09-28 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Kamalendu Biswas; Gaurav Bhatia; Shachi Prasad; Kiran Shriniwas Doddi - Web page: https://patentgrep.com/patent/US11308221B2 ## CPC - G06F 11/3457: {Performance evaluation by simulation} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2201/86: Event-based monitoring - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Provided are systems, methods, and computer-readable medium for a simulation platform that can generate simulated activity data for testing a security monitoring and control system. In various examples, the simulation platform can parse the activity data from a cloud service to generate a template, where each entry in the template describes an action and the fields associated with the action. The simulation platform can further generate a configuration that describes a test scenario. The simulation platform can use the configuration and the template to generate the particular action, including randomizing some or all of the fields of the action. When input into the security monitoring and control system, the system can operate on the simulated activity data in the same way as when the system ingests live activity data. ## Claims ### Claim 1 A computer-implemented method comprising, at a computer system of a security management system: obtaining activity data from a service provider system, wherein the activity data includes a list of actions performed during use of a cloud service, wherein actions in the list of actions are performed by one or more users associated with a tenant, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to use the cloud service; generating a template for an action in the list of actions, wherein the template comprises a data structure describing a format of the action; generating a configuration associated with a test scenario, the configuration including a reference to the template; generating a simulated action for the configuration by using the template to determine fields for the action and an output structure for the action; generating simulated activity data that includes the simulated action, wherein the simulated activity data has a same format as the activity data; and inputting the simulated activity data into the security management system, wherein the security management system operates on the simulated activity data to determine whether actions included in the simulated activity data include use of the cloud service that constitutes a security risk. ### Claim 2 (depends on 1) The method of claim 1, further comprising: parsing the action from the list of actions to determine a list of fields included in the action. ### Claim 3 (depends on 2) The method of claim 2, further comprising: identifying a field in the list of fields, wherein an identity of the field describes data included in the field. ### Claim 4 (depends on 3) The method of claim 3, wherein identifying the field includes matching contents of the field against a pattern from a plurality of patterns. ### Claim 5 (depends on 3) The method of claim 3, wherein the template further comprises a data structure storing an identity of the field. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the simulated action further comprises using a test description to select values for fields in the action. ### Claim 7 (depends on 1) The method of claim 1, wherein the simulated action causes the security management system to perform a particular operation, wherein the particular operation is associated with the test scenario. ### Claim 8 A computing system of a security management system, comprising: one or more processors; and one or more memories comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: obtaining activity data from a service provider system, wherein the activity data includes a list of actions performed during use of a cloud service, wherein actions in the list of actions are performed by one or more users associated with a tenant, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to use the cloud service; generating a template for an action in the list of actions, wherein the template comprises a data structure describing a format of the action; generating a configuration associated with a test scenario, the configuration including a reference to the template; generating a simulated action for the configuration by using the template to determine fields for the action and an output structure for the action; generating simulated activity data that includes the simulated action, wherein the simulated activity data has a same format as the activity data; and inputting the simulated activity data into the security management system, wherein the security management system operates on the simulated activity data to determine whether actions included in the simulated activity data include use of the cloud service that constitutes a security risk. ### Claim 9 (depends on 8) The computing system of claim 8, wherein the operations further comprise: parsing the action to determine a list of fields included in the action; and identifying a field in the list of fields by inputting contents of the field into a machine learning model, wherein the machine learning model associates fields having different formats with a same identity. ### Claim 10 (depends on 8) The computing system of claim 8, wherein the operations further comprise: generating additional simulated actions, each additional simulated action having fields determined using the template and different randomized values for the fields, wherein the simulated activity data includes the additional simulated actions. ### Claim 11 (depends on 8) The computing system of claim 8, wherein the template is associated with the cloud service, wherein the operations further comprise: generating a different template for a different cloud service; and generating different activity data using the different template and the configuration. ### Claim 12 (depends on 8) The computing system of claim 8, wherein the operations further comprise: generating a second configuration associated with a second test scenario; and generating different activity data using the second configuration and the template. ### Claim 13 (depends on 8) The computing system of claim 8, wherein the operations further comprise: inputting the activity data into the security management system concurrent with the simulated activity data. ### Claim 14 (depends on 8) The computing system of claim 8, wherein the test scenario is a violation of a security policy, and wherein the security management system determines that the simulated action violates the security policy. ### Claim 15 A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a computing system of a security management system, cause the one or more processors to perform operations comprising: obtaining activity data from a service provider system, wherein the activity data includes a list of actions performed during use of a cloud service, wherein actions in the list of actions are performed by one or more users associated with a tenant, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to use the cloud service; generating a template for an action in the list of actions, wherein the template comprises a data structure describing a format of the action; generating a configuration associated with a test scenario, the configuration including a reference to the template; generating a simulated action for the configuration by using the template to determine fields for the action and an output structure for the action; generating simulated activity data that includes the simulated action, wherein the simulated activity data has a same format as the activity data; and inputting the simulated activity data into the security management system, wherein the security management system operates on the simulated activity data to determine whether actions included in the simulated activity data include use of the cloud service that constitutes a security risk. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the test scenario is designed to detect anomalies, and the security management system determines that the simulated action is anomalous. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: parsing the action to determine a list of fields included in the action; and identifying a field in the list of fields by inputting contents of the field into a machine learning model, wherein the machine learning model associates fields having different formats with a same identity. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: generating additional simulated actions, each additional simulated action having fields determined using the template and different randomized values for the fields, wherein the simulated activity data includes the additional simulated actions. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the template is associated with the cloud service, wherein the operations further comprise: generating a different template for a different cloud service; and generating different activity data using the different template and the configuration. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: generating a second configuration associated with a second test scenario; and generating different activity data using the second configuration and the template.