Back to results
US 12,625,686 B1Granted
Provider network deficiency management
AssigneeAmazon Technologies, Inc.
InventorsSean Patrick Maher, Raghuveer Ketireddy, Trevor Tonn, David M. Wheeler
Life of this patent
Estimating the term…
Abstract
A system for provider network deficiency management includes a deficiency management computing system in a provider network having a machine-readable definition file and a knowledge graph. A method for provider network deficiency management includes receiving a machine-readable definition file and generating a knowledge graph based on the machine-readable definition file. Additionally or alternatively, the method can include any or all of: scanning provider network infrastructure; analyzing software for vulnerabilities; determining a deficiency finding based on the knowledge graph; providing the deficiency finding in a user interface; or any other suitable processes.
Claims20
A method comprising:
- scanning a set of resources, including one or more of software resources or hardware resources, associated with a provider network customer cloud, including scanning a virtual machine instance of the set of resources by scanning one or more ports of the virtual machine instance for listeners;
- analyzing source code associated with the set of resources;
- receiving a machine-readable definition file declaring the set of resources;
- generating a knowledge graph for the set of resources based on the scanning of the set of resources, the analyzing of the source code, and the machine-readable definition file, wherein the knowledge graph comprises a set of nodes and edges representing a data communication channel between a first resource of the set of resources and a second resource of the set of resources, wherein the set of nodes and edges comprises a plug component node, a plug node, a socket node, a socket component node, a first edge from the plug component node to the plug node, a second edge from the plug node to the socket node, and a third edge from the socket component node to the socket node, and wherein at least one of the first resource and the second resource is a hardware resource of the hardware resources;
- determining a deficiency finding based on the knowledge graph;
- and
- providing the deficiency finding in a user interface.
4 more elements
A method comprising:
- receiving a machine-readable definition file declaring a set of resources including one or more of software resources or hardware resources, wherein the machine-readable definition file is based at least in part on a scan of the set of resources, including a scan for listeners at one or more ports of a virtual machine instance of the set of resources;
- generating a knowledge graph for the set of resources based on the machine-readable definition file, wherein the knowledge graph comprises a set of nodes and edges representing a data communication channel between a first resource of the set of resources and a second resource of the set of resources, wherein the set of nodes and edges comprises a plug component node, a plug node, a socket node, a socket component node, a first edge from the plug component node to the plug node, a second edge from the plug node to the socket node, and a third edge from the socket component node to the socket node, and wherein at least one of the first resource and the second resource is a hardware resource of the hardware resources;
- determining a deficiency finding based on the knowledge graph;
- and
- providing the deficiency finding.
2 more elements
A system comprising:
- one or more electronic devices to implement a deficiency management computing system, the deficiency management computing system comprising instructions which when executed by one or more processors cause the deficiency management computing system to:
- receive a machine-readable definition file declaring a set of resources for a provider network customer cloud, the set of resources including one or more of software resources or hardware resources, wherein the machine-readable definition file is based at least in part on a scan of the set of resources, including a scan for listeners at one or more ports of a virtual machine instance of the set of resources;
- generate a knowledge graph for the set of resources based on the machine-readable definition file, wherein the knowledge graph comprises a set of nodes and edges representing a data communication channel between a first resource of the set of resources and a second resource of the set of resources, wherein the set of nodes and edges comprises a plug component node, a plug node, a socket node, a socket component node, a first edge from the plug component node to the plug node, a second edge from the plug node to the socket node, and a third edge from the socket component node to the socket node, and wherein at least one of the first resource and the second resource is a hardware resource of the hardware resources;
- determine a deficiency finding based on the knowledge graph;
- and
- provide the deficiency finding in a user interface.
3 more elements
Dependencies are inferred from the claim text.