# US 2019/0377883 A1 · End-to-end change tracking for triggering website security review > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0377883 A1 - Document ID: US20190377883A1 - Status: Published application - Kind: A1 - Application number: 16/548,733 - Filed: 2019-08-22 - Published: 2019-12-12 - Earliest claimed: 2017-05-08 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Muhammad Wasiq; Nima Sharifi Mehr - Web page: https://patentgrep.com/patent/US20190377883A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06N 20/00: Machine learning - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 63/1433: {Vulnerability analysis} - G06F 2221/033: Test or assess software - G06F 2221/2101: Auditing as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An end-to-end request path associated with an application frontend is determined. A change to a service in the end-to-end request path is identified. A weight value to associate with the change is determined based at least in part on the characteristics of the change. The weight value is aggregated with weight values associated with other code changes is obtained from aggregating the weight value with the weight values of other code changes to produce a collective weight of the code changes. A security review is determined to be triggered based at least in part on the collective weight reaching a value relative to a threshold. ## Claims ### Claim 1 A computer-implemented method, comprising: determining an end-to-end request path associated with an application frontend; identifying a change to a service in the end-to-end request path; determining, based at least in part on characteristics of the change, a weight value to associate with the change; aggregating the weight value with weight values associated with other code changes of services in the end-to-end request path to produce a collective weight of code changes; and determining to trigger a security review at least in part as a result of the collective weight reaching a value relative to a threshold value. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising, as a result of determining to trigger the security review, sending a notification to a security review entity to trigger the security review. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein sending the notification causes the security review entity to perform an automated review of at least the application frontend associated with the end-to-end request path. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein determining the end-to-end request path further includes, as a result of a request call made by the application frontend to a backend service, tracing a set of request calls made to one or more backend services. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the set of request calls include at least one request identifier that associates the set of request calls with the request call made by the application frontend. ### Claim 6 A system, comprising: at least one computing device that implement one or more services, wherein the one or more services: determine an end-to-end request path associated with an application frontend; identify a change to a service in the end-to-end request path; determine a weight value to associate with the change, the weight value based at least in part on characteristics of the change; aggregate the weight value with weight values associated with other code changes of services in the end-to-end request path to produce a collective weight of code changes; and determine, based at least in part on the collective weight reaching a value relative to a threshold value, to trigger a security review. ### Claim 7 (depends on 6) The system of claim 6, wherein the weight value based at least in part on the characteristics of the change is a value associated with a difference between a current size of source code and a previous size of the source code. ### Claim 8 (depends on 6) The system of claim 6, wherein the one or more services further reset the collective weight of the code changes of the services in the end-to-end request path to a baseline value. ### Claim 9 (depends on 6) The system of claim 6, wherein the weight value based at least in part on the characteristics of the change is a value that indicates a sensitivity of data processed by the service. ### Claim 10 (depends on 9) The system of claim 9, wherein the one or more services further determine the sensitivity of the data being based at least in part on passing the characteristics of the change as input to a machine learning algorithm. ### Claim 11 (depends on 6) The system of claim 6, wherein the one or more services further, as a result of determining to trigger the security review, send a notification to a security review entity to trigger the security review. ### Claim 12 (depends on 11) The system of claim 11, wherein the notification causes the security review entity to perform an automated review of at least the application frontend associated with the end-to-end request path. ### Claim 13 (depends on 6) The system of claim 6, wherein the one or more services that determine the end-to-end request path, as a result of a request call made by the application frontend to a backend service, trace a set of request calls made to one or more backend services to determine the end-to-end request path. ### Claim 14 (depends on 13) The system of claim 13, wherein the set of request calls include at least one request identifier that associates the set of request calls with the request call made by the application frontend. ### Claim 15 A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least: determine an end-to-end request processing graph for an application frontend of a web site; determine that a change to a service in the end-to-end request processing path; determine a weight value to associate with the change, the weight value based at least in part on characteristics of the change; aggregate the weight value with weight-values associated with other code changes of services in the end-to-end request processing path to produce a collective weight of code changes; and determine, based at least in part on the collective weight reaching a value relative to a threshold value, to trigger a security review. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to determine the weight value further cause the computer system to determine the weight value based at least in part on a difference between a current size of source code and a previous size of the source code. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein executable instructions further cause the computer system to reset the collective weight of the code changes of the services in the end-to-end request processing path to a baseline value. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to determine the weight value further cause the computer system to determine the weight value based at least in part on a sensitivity of data processed by the service. ### Claim 19 (depends on 18) The non-transitory computer-readable storage medium of claim 18, wherein the executable instructions further cause the computer system to determine the sensitivity of the data based at least in part on passing the characteristics of the change as input to a machine learning algorithm. ### Claim 20 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions that cause the computer system to determine the weight value further cause the computer system to determine the weight value based at least in part on a privilege associated with the service.