Device and computer-implemented method for allocating computing resources in a method for protecting a computer-based development environment in a distributed development process from damage and threats

Abstract

Device and computer-implemented method for allocating computing resources in a method for protecting a computer-based development environment (100) in a distributed development process from damage and threats, wherein the protection method employs several methods for detecting damage and / or threats in the computer-based development environment (100), wherein a metric is determined for each method that quantifies the quality and / or predictive power of the method, wherein, depending on the metric, a respective offer for allocating computing resources for carrying out the respective method is determined, and the computing resources are allocated to the methods depending on the respective offer.

Description

State of the art

[0001] The invention relates to a device and a computer-implemented method for allocating computing resources in a method for protecting a computer-aided development environment in a distributed development process from damage and threats. Disclosure of the invention

[0002] A computer-implemented method for allocating computing resources in a method for protecting a computer-aided development environment in a distributed development process from damage and threats provides that, in the protection method, several methods for detecting damage and / or a threat in the computer-aided development environment are executed. For each method, a metric is determined that quantifies the quality and / or informative value of the method. Depending on the metric, a respective offer for allocating computing resources for executing the respective method is determined for the methods. The computing resources are allocated to the methods depending on the respective offer. This automates the load distribution of the resources for the methods.

[0003] It can be provided that the offer is taken from an available budget, or a budget is determined depending on the metric and the offer is taken from the budget determined depending on the metric.

[0004] The metric can be determined based on the number of errors found with the method or the number of lines of code analyzed with the method. This allows resources to be allocated based on the number.

[0005] It can be specified that the number is normalized with a normalization parameter, and the metric represents the number normalized with the parameter. This allows comparable offers for metrics of different types to be determined using the same function.

[0006] It can be provided that the supply for the respective method is determined using a function parameterized with at least one parameter, which maps the metric to the supply depending on the at least one parameter, or which maps the metric and the budget to the supply depending on the at least one parameter, whereby the at least one parameter is statically specified or learned. This means that static circumstances and changing, learnable circumstances are taken into account.

[0007] It can be provided that at least one parameter is learned depending on the metric. This makes the allocation self-learning depending on the metric.

[0008] It may be provided that the metric and the offer for the respective method are determined in iterations and the computing resources are allocated repeatedly in iterations depending on the metrics or offers determined for the respective iteration.

[0009] It can be provided that the computing resources include time slots of a computing time, memory areas of a memory, or bandwidth of a data line.

[0010] It may be provided that the computing resources are provided on a server.

[0011] It may be intended that the computer-aided development environment be deployed on distributed devices in the distributed development process. This means that the methods monitor the development environment on the distributed devices.

[0012] It may be provided that at least one of the plurality of methods for detecting the damage and / or the threat is executed on one of the distributed devices to which the at least one of the plurality of methods is assigned.

[0013] A device for allocating computing resources in a method for protecting a computer-aided development environment in a distributed development process from damage and threats provides that the device comprises at least one processor and at least one memory, wherein the at least one processor is designed to execute instructions, upon execution of which by the at least one processor the device executes the method, wherein the at least one memory stores the instructions.

[0014] A computer program comprising computer-executable instructions, the execution of which by a computer results in the method being carried out, may be provided.

[0015] Further advantageous embodiments can be found in the following description and the drawing. The drawing shows: Fig. 1 a computer-aided development environment, Fig. 2 a flowchart with steps of a method for allocating computing resources in a method for protecting the computer-aided development environment.

[0016] In Fig. 1 shows a computer-aided development environment 100.

[0017] The development environment 100 includes a server 102 and distributed devices 104.

[0018] The development environment 100 includes a device 106 for allocating computing resources in a method for protecting the computer-aided development environment 100 in a distributed development process from damage and threats.

[0019] The device 106 comprises at least one processor 108 and at least one memory 110.

[0020] The at least one processor 108 is configured to execute instructions, upon execution of which by the at least one processor 108, the device 106 executes a method described below for allocating computing resources in a method for protecting the computer-aided development environment 100 in the distributed development process from damage and threats

[0021] The at least one memory 110 stores the instructions.

[0022] In the example, the distributed devices 106 and the server 104 are configured to cooperate to execute multiple methods for detecting damage and / or threat in the protection process.

[0023] In the example, a method for detecting damage and / or a threat is associated with at least one of the distributed devices 106.

[0024] In the example, server 104 provides the computing resources to be allocated.

[0025] The computing resources include, for example, time slots of computing time on the server 104, memory areas of a memory of the server 104, or a bandwidth of a data line between the server and a distributed device 106.

[0026] The procedure for allocating computing resources is carried out in iterations in the example.

[0027] The method for allocating computing resources includes a step 202.

[0028] In step 202, the protection method executes several methods for detecting damage and / or a threat.

[0029] For example, a respective method is executed at least partially as a process or as multiple processes on the server 104.

[0030] For example, a respective method is executed at least partially as a process or as multiple processes on at least one of the distributed devices 106.

[0031] A respective method is allocated the computing resource for at least the portion of the process executing on server 104. In a first iteration, the computing resources can be allocated randomly, according to a predetermined allocation, or evenly across all methods.

[0032] The method for allocating computing resources includes a step 204.

[0033] In step 204, a metric is determined for each method that quantifies the quality and / or meaningfulness of the method.

[0034] The computer-aided development environment is provided in the distributed development process, particularly on the distributed devices 104. The metric is determined in the distributed development process.

[0035] For example, at least one of the plurality of methods for detecting the damage and / or threat is executed on one of the distributed devices 104 to which the at least one of the plurality of methods is assigned.

[0036] The metric is determined, for example, depending on the number of errors found with the method or the number of lines of code analyzed with the method.

[0037] The number quantifies the quality in the sense that a high number represents better quality than a lower number.

[0038] It can be specified that the number is normalized with a normalization parameter, and the metric represents the number normalized with the parameter. This makes it impossible to use directly comparable numbers. An example of normalization with a normalization parameter is dividing or multiplying the metric by a value of the normalization parameter.

[0039] The method for allocating computing resources includes a step 206.

[0040] In step 206, depending on the metric, a respective offer for the allocation of computing resources for the execution of the respective method is determined for the methods.

[0041] In one example, the offer is taken from a budget available for the iterations.

[0042] The budget can characterize available computing time, available money, or permissible power consumption. In this example, the budget defines an upper limit for the total number of bids that can be made in the iterations.

[0043] In one example, a budget is determined depending on the metric and the offer per iteration is taken from the budget determined depending on the metric.

[0044] For example, the budget is reduced by the withdrawn supply in a first iteration, with the reduced budget being available in an iteration following the first iteration.

[0045] The offer for the respective method is determined, for example, with a function parameterized with at least one parameter.

[0046] In an example, the function maps the metric to the offer depending on at least one parameter.

[0047] In an example, the function maps the metric and the budget to the offer depending on at least one parameter.

[0048] At least one parameter can be statically specified or learned.

[0049] An example of a function with a parameter is the addition or multiplication of a metric by a parameter value. An example of a statically specified parameter is a parameter that, for example, has several different values ​​depending on time, which lead to different offers. For example, a first value of the parameter is specified for a period of time during the night and a second value of the parameter is specified for a period of time during the day. For example, the first value is greater than the second value in order to allocate more computing resources to a method at night than during the day. For example, the first value is smaller than the second value in order to allocate more computing resources to a method during the day than at night.

[0050] The at least one parameter for a function associated with a specific metric is learned, for example, depending on the specific metric. For example, in the iterations, the at least one parameter is learned for which the supply for the specific method leads to a greater allocation of computational resources to the specific method as the metric increases.

[0051] The method for allocating computing resources includes a step 208.

[0052] In step 208, the computing resources are allocated to the methods depending on the respective offer.

[0053] In the example, more or fewer computing resources are allocated to the methods depending on the bid size. For example, a method with a higher bid is allocated more computing resources than a method with a lower bid.

[0054] For example, metrics are collected about development and / or operation of one or more of the devices 104.

[0055] For example, the development and / or operation of the one or more devices 104 is monitored depending on the metrics.

[0056] Monitoring is carried out using the methods with the resources allocated to the respective methods.

[0057] The metric and bid are determined for each method in each iteration. Computing resources are allocated repeatedly in each iteration depending on the metrics or bids determined for each iteration.

[0058] The computing resources are provided according to the allocation, in particular on the server 102.

[0059] Step 202 is then executed.

[0060] It can be provided that the offers for each method are determined by an agent who is assigned to the respective method.

[0061] In a reinforcement learning process, the agent, in particular the at least one parameter, can learn to make offers depending on a reward. The reward is, for example, the metric or is determined for the respective method depending on the metric for the respective method.

[0062] Example detection methods for a development on operations, DEVOps environment include: Requirement analysis Secure coding static automated security testing, SAST White box dynamic automated security testing, DAST Black box DAST Digital sign Security analysis Security monitoring Security audit Security patch Security scan Security config Secure transfer

[0063] Example metrics to detect for a development on operations, DEVOps environment include: Error density

[0064] This metric is defined for a method, for example, as: Number of confirmed errors in a software or a component thereof during a development period of specified length determined using the method, divided by a code size of the software or component.

[0065] This makes it possible to observe and reduce error density over time. Error resolution rate

[0066] This metric measures, for example, the speed at which a discovered error is fixed.

[0067] This makes it possible to monitor and increase the productivity of development teams. Assessment of critical risks:

[0068] This metric measures, for example, a relationship between the importance of a bug and the value of a vulnerability caused by the bug for a potential attacker.

[0069] This allows priorities to be defined for errors to be corrected. Main vulnerability types:

[0070] This metric measures, for example, the most important vulnerability types for errors and the most frequently occurring vulnerability types.

[0071] This allows a training plan to be provided for development teams to impart knowledge about the error and how to avoid it. Number of enemies per application

[0072] This metric measures, for example, how many enemies an application has. This metric can be determined using a threat model or risk analysis.

[0073] This allows you to identify the applications in the development environment that are more vulnerable than others, allowing you to adapt how these applications are handled. Rate of repeated hostility

[0074] This metric measures, for example, how often an enemy uses the same strategy or procedure.

[0075] This allows appropriate training to be provided to defend against threats. Risk point per device

[0076] This metric measures, for example, the number of vulnerabilities per device 104.

[0077] This allows for vulnerabilities to be prioritized according to their importance. This allows, for example, more attention to be paid to critical vulnerabilities that are vulnerable to attack from the internet. Number of continuous delivery cycles per month

[0078] This metric measures, for example, the number of successful deliveries to a production facility per month.

[0079] This makes it possible to measure how quickly changed code is available in production. Number of problems during training

[0080] This metric measures, for example, the number of problems found and fixed during training.

[0081] This makes it possible to measure the effectiveness of the trainees.

Claims

[1] Computer-implemented method for allocating computing resources in a method for protecting a computer-aided development environment (100) in a distributed development process from damage and threats, characterized by that in the protection method, several methods for detecting damage and / or a threat are executed in the computer-aided development environment (100) (202), wherein a metric is determined for each method (204) which quantifies a quality and / or meaningfulness of the method, wherein for the methods, depending on the metric, a respective offer for the allocation of computing resources for the implementation of the respective method is determined (206), wherein the computing resources are allocated to the methods depending on the respective offer (208). [2] Method according to claim 1, characterized bythat the offer is taken from a available budget (206), or that a budget is determined depending on the metric and the offer is taken from the budget determined depending on the metric (206). [3] Method according to one of the preceding claims, characterized by that the metric is determined depending on a number of errors found with the method or a number of lines of code analyzed with the method (204). [4] Method according to claim 3, characterized by that the number is normalized with a normalization parameter (204) and the metric represents the number normalized with the parameter. [5] Method according to one of the preceding claims, characterized bythat the offer for the respective method is determined with a function parameterized with at least one parameter (206), which maps the metric to the offer depending on the at least one parameter or which maps the metric and the budget to the offer depending on the at least one parameter, wherein the at least one parameter is statically specified or learned. [6] Method according to claim 5, characterized by that at least one parameter is learned depending on the metric. [7] Method according to one of the preceding claims, characterized by that the metric and the offer for the respective method are determined in iterations and the computing resources are allocated repeatedly in iterations depending on the metrics or offers determined for the respective iteration. [8] Method according to one of the preceding claims, characterized bythat the computing resources include time slots of a computing time, memory areas of a memory, or bandwidth of a data line. [9] Method according to one of the preceding claims, characterized by that the computing resources are provided on a server (102). [10] Method according to one of the preceding claims, characterized by that the computer-aided development environment is provided on distributed devices (104) in the distributed development process. [11] Method according to claim 10, characterized by that at least one of the plurality of methods for detecting the damage and / or the threat is executed on one of the distributed devices (104) to which the at least one of the plurality of methods is assigned. [12] Device (106) for allocating computing resources in a method for protecting a computer-aided development environment (100) in a distributed development process from damage and threats, characterized by that the device (106) comprises at least one processor (108) and at least one memory (110), wherein the at least one processor (108) is designed to execute instructions, upon execution of which by the at least one processor (108) the device (106) carries out the method according to one of claims 1 to 11, wherein the at least one memory (110) stores the instructions. [13] Computer program, characterized by that the computer program comprises computer-executable instructions, the execution of which by a computer results in the method according to one of claims 1 to 11.

Images