# US 12,216,551 B2 · Vulnerability tagging for Kubernetes workloads in a data protection system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,216,551 B2
- Document ID: US12216551B2
- Status: Granted
- Kind: B2
- Application number: 18/329,313
- Filed: 2023-06-05
- Published: 2024-12-05
- Granted: 2025-02-04
- Earliest claimed: 2023-06-05
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Mahesh Reddy Av; Avinash Kumar; Terry O'Callaghan
- Web page: https://patentgrep.com/patent/US12216551B2

## CPC

- G06F 11/1464: {for networked environments}
- G06F 11/1451: {by selection of backup contents}
- G06F 11/1453: {using de-duplication of the data}
- G06F 11/1461: {Backup scheduling policy}
- H04L 63/1433: {Vulnerability analysis}
- G06F 2201/815: Virtual
- G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A vulnerability tagging process helps prioritize backups of datasets in a network by monitoring events that affect containers in the network. The monitored events are processed by an AI-based event analyzer to characterize each event in terms of a potential for destruction or damage to the data by each event. A vulnerability measure is calculated as the product of the number of occurrences of each event based on the severity associated with each event. Once the events are analyzed and the vulnerability scores are calculated, the scores are tagged on each workload. The vulnerability tags can then be utilized by the backup server to modify protection policies and/or prioritize backup schedules for the container workloads.

## Claims

### Claim 1

A computer-implemented method of dynamically prioritizing backups of datasets in a network, comprising:
defining one or more protection policies to back up the datasets according to a defined prioritization;
monitoring events that affect data of a dataset to be protected by the one or more protection policies;
processing the monitored events in an event analyzer to characterize each event in terms of a severity of potential damage to the data by each event;
calculating a vulnerability measure for a dataset as the product of the number of occurrences of each event based on the severity associated with each event;
assigning a numerical score to the calculated vulnerability measure;
tagging the score as metadata to a payload of the dataset; and
using the score to modify the defined prioritization for backing up the dataset in the one or more protection policies to accommodate a vulnerability of the dataset as indicated by the vulnerability measure.

### Claim 2 (depends on 1)

The method of claim 1 further comprising re-prioritizing an ad-hoc backup request within a series of backup requests managed by the one or more protection policies.

### Claim 3 (depends on 2)

The method of claim 2 wherein the network comprises a PowerProtect Data Domain deduplication backup system.

### Claim 4 (depends on 1)

The method of claim 1 wherein the data is containerized data managed by a container management process.

### Claim 5 (depends on 4)

The method of claim 4 wherein the network comprises a Kubernetes cluster having a controller, an application program interface (API) server, and a data migration process performing the data protection.

### Claim 6 (depends on 5)

The method of claim 5 wherein the payload comprises a JavaScript Object Notation (JSON) payload.

### Claim 7 (depends on 6)

The method of claim 6 wherein the tag is implemented as an alphanumeric string appended to an existing payload of the dataset having data source information.

### Claim 8 (depends on 7)

The method of claim 7 wherein the tag comprises a key value having a format of “VULNERABILITY_TAG” with an associated scalar value, wherein the associated value represents a severity level of a corresponding event ranked along a defined scale, and wherein the defined scale is on the order of 1 to 10, in one of ascending or descending order of severity.

### Claim 9 (depends on 8)

The method of claim 8 wherein the tag is associated with a Kubernetes payload of the dataset using a Kubernetes application programming interface (API).

### Claim 10 (depends on 1)

The method of claim 1 wherein the event analyzer is an artificial intelligence (AI) based event analyzer.

### Claim 11 (depends on 10)

The method of claim 10 wherein the event analyzer comprises a data collection component, a training component, and an inference component, and contains historical information regarding events of the network to continuously train a machine learning (ML) algorithm to identify events and potential damaging consequences of the events to correlate events to vulnerabilities of the data.

### Claim 12

A system for dynamically prioritizing backups of datasets in a network, comprising:
a backup server executing one or more protection policies to back up the datasets according to a defined prioritization;
a hardware-based monitor monitoring events that affect data of a dataset to be protected by the one or more protection policies;
an event analyzer processing the monitored events to characterize each event in terms of a severity of potential damage to the data by each event;
a hardware-based calculator calculating a vulnerability measure for a dataset as the product of the number of occurrences of each event based on the severity associated with each event and assigning a numerical score to the calculated vulnerability measure; and
a tagger tagging the score as metadata to a payload of the dataset, wherein the backup server uses the score to modify the defined prioritization for backing up the dataset in the one or more protection policies to accommodate a vulnerability of the dataset as indicated by the vulnerability measure.

### Claim 13 (depends on 12)

The system of claim 12 wherein the backup server comprises a PowerProtect Data Domain deduplication backup server, and wherein the data is containerized data managed by a container management process, and further wherein the network comprises a Kubernetes cluster having a controller, an application program interface (API) server, and a data migration process implementing the protection policies.

### Claim 14 (depends on 13)

The system of claim 13 wherein the tag is implemented as an alphanumeric string appended to an existing payload of the dataset having data source information, and further wherein the payload comprises a JavaScript Object Notation (JSON) payload.

### Claim 15 (depends on 14)

The system of claim 14 wherein the tag comprises a key value having a format of “VULNERABILITY_TAG” with an associated scalar value, wherein the associated value represents a severity level of a corresponding event ranked along a defined scale, and wherein the defined scale is on the order of 1 to 10, in one of ascending or descending order of severity.

### Claim 16 (depends on 15)

The system of claim 15 wherein the tag is associated with a Kubernetes payload of the dataset using a Kubernetes application programming interface (API).

### Claim 17 (depends on 16)

The system of claim 16 wherein the event analyzer is an artificial intelligence (AI) based event analyzer.

### Claim 18 (depends on 17)

The system of claim 17 wherein the event analyzer comprises a data collection component, a training component, and an inference component, and contains historical information regarding events of the network to continuously train a machine learning (ML) algorithm to identify events and potential damaging consequences of the events to correlate events to vulnerabilities of the data.

### Claim 19

A tangible computer program product having stored thereon program instructions that, when executed by a process, cause the processor to perform a method of prioritizing data assets for data protection operations in a data protection system, comprising:
defining one or more protection policies to back up the datasets according to a defined prioritization;
monitoring events that affect data of a dataset to be protected by the one or more protection policies;
processing the monitored events in an event analyzer to characterize each event in terms of a severity of potential damage to the data by each event;
calculating a vulnerability measure for a dataset as the product of the number of occurrences of each event based on the severity associated with each event;
assigning a numerical score to the calculated vulnerability measure;
tagging the score as metadata to a payload of the dataset; and
using the score to modify the defined prioritization for backing up the dataset in the one or more protection policies to accommodate a vulnerability of the dataset as indicated by the vulnerability measure.

### Claim 20 (depends on 1)

The product of claim 1 wherein the method further comprises re-prioritizing an ad-hoc backup request within a series of backup requests managed by the one or more protection policies.