Cluster security based on VM content

Abstract

A cluster is scanned. The cluster includes one or more virtual machines. A first content file change is detected based on the scan of the cluster. The first content file change is for a first content file. The first content file is located on a first virtual machine associated with the cluster. A content-based security level of the cluster is determined based on the detection of the first content file change. The determined content-based security level of the cluster is compared with a security level standard of the cluster. A security breach is identified based on the comparison of the determined content-based security level with the security level standard of the cluster. In response to the identification of the security breach, an update of a security setting of the cluster is performed.

Description

Technical Field

[0001] The present disclosure relates to virtualized computing and, more particularly, to tuning virtual machine security. Background Art

[0002] A virtual machine may be operable to provide different content and services to a user. A virtual machine may be created with certain security settings. In some instances, roles, workflows, or content stored on a virtual machine may change. These changes may result in a situation where the security settings of the virtual machine do not match the workload of the virtual machine. Summary of the invention

[0003] According to an embodiment of the present disclosure, a method, system and computer program for virtual machine security are provided. A cluster is scanned. The cluster includes one or more virtual machines. A first content file change is detected based on a scan of the cluster. The first content file change is for a first content file. The first content file is located on a first virtual machine associated with the cluster. A content-based security level of the cluster is determined based on the detection of the change to the first content file. The determined content-based security level of the cluster is compared with a security level standard of the cluster. A security breach is identified based on a comparison of the determined content-based security level with the security level standard of the cluster. In response to the identification of the security breach, an update of the security settings of the cluster is performed.

[0004] The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The accompanying drawings included in this application are incorporated into the specification and constitute a part of the specification. The accompanying drawings illustrate embodiments of the present disclosure and, together with the description, are used to explain the principles of the present disclosure. The accompanying drawings illustrate only certain embodiments and do not limit the present disclosure.

[0006] Figure 1 depicts representative major components of an example computer system that may be used in accordance with some embodiments of the present disclosure;

[0007] Figure 2 Depicting a cloud computing environment according to an embodiment of the present invention;

[0008] Figure 3 depicts an abstract model layer according to an embodiment of the present invention;

[0009] Figure 4 An example content-aware system for operating a cluster of virtual machines consistent with some embodiments of the present disclosure is depicted;

[0010] Figure 5 depicts an example cluster configured for enhanced security settings consistent with some embodiments of the present disclosure;

[0011] Figure 6 depicts an example cluster with configured lower security settings consistent with some embodiments of the present disclosure;

[0012] Figure 7 An example method of performing CDVS consistent with some embodiments of the present disclosure is depicted.

[0013] Although the present invention can be modified in various ways and has various alternative forms, its details have been shown by way of example in the accompanying drawings and will be described in detail. However, it should be understood that the present invention is not limited to the specific embodiments described. On the contrary, the present invention is intended to cover all modifications, equivalents and substitutes that fall within the spirit and scope of the present invention. DETAILED DESCRIPTION

[0014] Aspects of the present disclosure relate to virtualized computing; more particularly, aspects relate to adjusting virtual machine security. Although the present disclosure is not necessarily limited to such applications, various aspects of the present disclosure may be understood through a discussion of different examples using this context.

[0015] Virtual machines and virtualized systems can allow additional computing flexibility. Historically, it takes time to build hardware, install software, and assign permissions and privileges to access and operate computer systems. Virtual machines can allow for rapid assignment of tasks to computing devices by virtualizing the underlying computer hardware. Further, operating systems and other core computer resources can be imaged so that they can be instantiated, quickly installed, and provided to users for computer use.

[0016] In some instances, this flexibility and speed can lead to security issues. For example, a virtual machine or cluster of virtual machines can operate on data or provide computer resources with inadequate security. Lack of security can lead to the loss of data to third-party bad actors or the accidental exposure of data to the public.

[0017] In some cases, an attempt to fix these security issues is to implement a set of rules, policies, or standards. A fixed security level standard may be assigned to a virtual machine. A security level standard may be a policy, role, or other fixed set of security settings that may be applied to a virtual machine regardless of the content or workload of the virtual machine or other virtual machines. This may cause problems because the security level standard may become unsafe as the workload changes. For example, a data store and associated virtual machines may be added to a cluster that operates on secure data. Because the cluster has a fixed, predetermined security level standard, the virtual machine may have security holes that are susceptible to attacks from third-party bad actors.

[0018] In some cases, virtual machine clusters have attempted to preemptively upgrade the security of various virtual machines. For example, various virtual machines in a cluster can be upgraded in security level standards. For example, if the first virtual machine in a cluster has a lower security level standard than other virtual machines, the cluster can operate by upgrading the security level of the virtual machine to the same security level as other virtual machines. The upgrade of security level standards can be completed without considering the content of the virtual machines in the cluster. The upgrade of security level standards can be based only on security level standards, policies, or other fixed rule sets. These operations may work only to improve security, which may cause computer resource constraints in the cluster. For example, in order to perform more advanced security operations, higher levels of encryption can be used. Increased security may use too much computer processing, memory, input and output ("I / O"), and in some cases increase the use of each of these resources.

[0019] To overcome current issues associated with computer virtualization, content-based dynamic virtual machine security ("CDVS") may be implemented. CDVS may operate by continuously monitoring and collecting content-based insights into data operated by each virtual machine in a cluster. Content-based insights may be performed on a first virtual machine in a cluster in isolation. For example, in determining the security level of the first virtual machine, any data received by, accessible to, or created by the first virtual machine may be analyzed. Content-based insights may be performed by analyzing a cumulative data set of multiple virtual machines of a cluster. For example, in determining the security level of all virtual machines of a cluster, any data or content of all virtual machines of the cluster combined may be analyzed.

[0020] CDVS can operate by increasing the security level of a cluster including one or more virtual machines of the cluster based on content analysis. For example, if one or more virtual machines are operating on sensitive data, CDVS can operate by identifying the content as particularly sensitive or secure. CDVS can responsively upgrade the security settings of the virtual machines of the cluster based on content. Dynamic upgrades of multiple systems can create advanced security within a virtual machine cluster. For example, a change to the security level of a single VM may cause all VMs in the cluster to be updated to the new security level as well. Other systems in the cluster should not be at a lower security level because they become targets for attackers to access the cluster network. CDVS can operate by lowering the security level of a cluster including one or more virtual machines of the cluster based on content analysis. For example, if the virtual machine is operating on non-sensitive data, CDVS can operate by identifying the content as not particularly sensitive or private. CDVS can responsively downgrade the security settings of the virtual machines of the cluster based on content.

[0021] Upgrading and downgrading of security settings can be completed regardless of the security level standards of one or more virtual machines of the cluster. For example, if a first virtual machine has been established with a high security level at the first time, the first virtual machine can operate with enhanced security rules, thereby utilizing the large amount of processing and memory of the underlying computer hardware. CDVS can determine that the first virtual machine is no longer operating on data that requires high security based on content insights of the first virtual machine. CDVS can operate based on multi-level analysis. The first level may include collecting data within each virtual machine. The second level may include data / insights generated across the cluster to produce cumulative insights. The cumulative insights can dictate the security level compliance of the cluster.

[0022] The operation of CDVS can provide advanced compliance and security for administrators of virtual machines and clusters of virtual machines. By operating on the insight system, CDVS can make policy and security changes to virtual machines without exposing the underlying content of the virtual machines of a given cluster to any human operator. Further, CDVS can allow users to manage the security levels of virtual machines and clusters, even when the user does not have access to content or insight permissions generated from content. Further, CDVS can alert system administrators to changes in the security level of a cluster based on new data added to individual virtual machines or existing data deleted from individual virtual machines. In some embodiments, CDVS can utilize content-based analysis and insight generation to make security level recommendations to administrators of a cluster. For example, an administrator may receive a notification from CDVS that the security level of a cluster is to be lowered based on an analysis of the content and a determination that the security level is using too many resources.

[0023] The CDVS may operate based on the content that exists on the cluster at a given moment. The CDVS may operate based on a virtual machine that receives new content segments from a user or other computer system. The CDVS may operate based on the sharing of content on the virtual machines of the cluster or the privacy level of the content. For example, a first virtual machine may host a file sharing service for a user. A user may share a file with only a small group of other users. The CDVS may determine that the security settings of the cluster should be increased in response to scanning the sharing settings of a file. If a user changes the sharing settings of a file so that the file is publicly available on the Internet, the CDVS may detect the content-level change. In response to detecting public sharing of a file, the CDVS may determine that the content has a lower security level and reduce the security settings of the cluster.

[0024] CDVS can be configured to scan different log files, content files or other files to determine context. In some embodiments, the natural language processing system may include the operation of various components (not shown) by hardware, software or in some combination: for example, a natural language processor, one or more data sources, a search application and a report analyzer. A natural language processor can be a computer module that analyzes received content and other information. A natural language processor can perform different methods and techniques for analyzing text information (e.g., syntactic analysis, semantic analysis, etc.). A natural language processor can be configured to recognize and analyze any number of natural languages. In some embodiments, a natural language processor can parse paragraphs of documents or content from one or more virtual machines in a cluster. Various components (not shown) of a natural language processor may include, but are not limited to, a tokenizer, a part-of-speech (POS) tagger, a semantic relationship identifier and a grammatical relationship identifier.

[0025] In some embodiments, a tagger can be a computer module that performs lexical analysis. A tagger can convert a sequence of characters into a sequence of tags. Tags can be strings of characters included in an electronic document and categorized as meaningful symbols. Further, in some embodiments, a tagger can identify word boundaries in an electronic document and divide any text paragraphs in the document into their constituent text elements, such as words, multi-word tags, numbers, and punctuation marks. In some embodiments, a tagger can receive a string of characters, identify word units in the string of characters, and categorize them into tags.

[0026] In accordance with various embodiments, a POS tagger can be a computer module that tags words in a paragraph to correspond to a specific part of speech. The POS tagger can read a paragraph or other text in a natural language and assign a part of speech to each word or other tag. The POS tagger can determine the part of speech corresponding to a word (or other text element) based on the definition of the word and the context of the word. The context of a word can be based on its relationship to adjacent and related words in a phrase, sentence or paragraph.

[0027] In some embodiments, the context of the word can depend on one or more previously analyzed electronic documents (e.g., the use and relative position of the word within the first virtual machine compared to other virtual machines of the cluster). Examples of parts of speech that can be assigned to words include, but are not limited to, nouns, verbs, adjectives, adverbs, etc. Examples of other parts of speech that the POS tagger may assign include, but are not limited to, comparative or superlative adverbs, wh-adverbs, conjunctions, determiners, negation words, possessive markers, prepositions, wh-pronouns, etc. In some embodiments, the POS tagger can mark or otherwise annotate the tags of a paragraph with a part of speech category. In some embodiments, the POS tagger can mark tags or words of a paragraph that will be parsed by a natural language processing system.

[0028] In some embodiments, the semantic relationship identifier can be a computer module that can be configured to identify semantic relationships of text elements (e.g., words, phrases) identified in a document. In some embodiments, the semantic relationship identifier can determine functional dependencies between entities and other semantic relationships.

[0029] According to various embodiments, a grammatical relationship identifier may be a computer module that may be configured to identify grammatical relationships in a paragraph consisting of tokens. The grammatical relationship identifier may determine the grammatical structure of a sentence, for example, which groups of words are associated as phrases, which words are subjects or objects of verbs. The grammatical relationship identifier may conform to a formal grammar.

[0030] In some embodiments, the natural language processor can be a computer module that can parse a document and generate a corresponding data structure for one or more parts of the document. For example, in response to receiving an updated document on a virtual machine at a natural language processing system, the natural language processor can output the parsed text elements from the post as a data structure. In some embodiments, the parsed text elements can be represented in the form of a parse tree or other graphical structures. In order to generate the parsed text elements, the natural language processor can trigger a computer module including a tagger, a part of speech (POS) tagger, a semantic relationship identifier, and a grammatical relationship identifier.

[0031] Each computing system of the CDVS can have a cognitive agent / client running on it. The cognitive agents of the CDVS can be trained on different models before implementation. For example, there can be a predefined set of security policies for protecting data belonging to different industries. The cognitive agent can be trained to understand the different sets of security policies available on the system. The cognitive agent can be trained to understand which policy is more stringent and select the more stringent of the policies as its output. Next, the cognitive agent can be trained to generate models for different industry sectors (e.g., finance, health, etc.). For example, for text data, the model can be trained to identify keywords or insights into specific industries present in the data. In some embodiments, the cognitive agent can create an association between security levels and different industries. For example, if one of the security levels / policies available on the system is for the PCI (Payment Card Industry) compliance standard, all financial keywords can be associated with that security policy.

[0032] Figure 1Representative major components of an example computer system 100 (alternatively, a computer) that can be used according to some embodiments of the present disclosure are shown. It should be appreciated that the various components can vary in complexity, quantity, type, and / or configuration. The specific examples disclosed are for illustrative purposes only and are not necessarily the only such variations. The computer system 100 may include a processor 110, a memory 120, an input / output interface (herein referred to as I / O or I / O interface) 130, and a main bus 140. The main bus 140 may provide a communication path for other components of the computer system 100. In some embodiments, the main bus 140 may be connected to other components, such as a dedicated digital signal processor (not shown).

[0033] The processor 110 of the computer system 100 may include one or more cores 112A, 112B, 112C, 112D (collectively referred to as 112). The processor 110 may additionally include one or more storage buffers or caches (not shown) that provide temporary storage of instructions and data for the core 112. The core 112 may execute instructions on inputs provided from the cache or memory 120 and output the results to the cache or memory. The core 112 may include one or more circuits configured to perform one or more methods according to embodiments of the present disclosure. In some embodiments, the computer system 100 may include multiple processors 110. In some embodiments, the computer system 100 may be a single processor 110 with a single core 112.

[0034] The memory 120 of the computer system 100 may include a memory controller 122. In some embodiments, the memory 120 may include a random access semiconductor memory, a storage device, or a storage medium (volatile or non-volatile) for storing data and programs. In some embodiments, the memory may be in the form of a module (e.g., a dual in-line memory module). The memory controller 122 may communicate with the processor 110 to facilitate the storage and retrieval of information in the memory 120. The memory controller 122 may communicate with the I / O interface 130 to facilitate the storage and retrieval of input or output in the memory 120.

[0035] The I / O interface 130 may include an I / O bus 150, a terminal interface 152, a storage interface 154, an I / O device interface 156, and a network interface 158. The I / O interface 130 may connect the main bus 140 to the I / O bus 150. The I / O interface 130 may direct instructions and data from the processor 110 and the memory 120 to different interfaces of the I / O bus 150. The I / O interface 130 may also direct instructions and data from different interfaces of the I / O bus 150 to the processor 110 and the memory 120. The various interfaces may include a terminal interface 152, a storage interface 154, an I / O device interface 156, and a network interface 158. In some embodiments, the various interfaces may include a subset of the aforementioned interfaces (for example, an embedded computer system in a certain industry application may not include a terminal interface 152 and a storage interface 154).

[0036] The logic modules in the computer system 100, including but not limited to the memory 120, the processor 110, and the I / O interface 130, can communicate failures and changes to one or more components to a hypervisor or operating system (not shown). The hypervisor or operating system can allocate different resources available in the computer system 100 and keep track of the location of data in the memory 120 and processes assigned to different cores 112. In embodiments that combine or rearrange elements, various aspects and capabilities of the logic modules can be combined or reallocated. These variations will be apparent to those skilled in the art.

[0037] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0038] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0039] Features are as follows:

[0040] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring human interaction with the provider of the service.

[0041] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin-client platforms or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0042] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically do not have control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0043] Rapid elasticity: The ability to quickly and elastically provision capacity, in some cases automatically scaling down quickly and releasing quickly to scale up quickly. To the consumer, the capacity available for provisioning generally appears unlimited and can be purchased in any quantity at any time.

[0044] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0045] The service model is as follows:

[0046] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications can be accessed from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0047] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers using programming languages ​​and tools supported by the provider onto the cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the deployed applications and possible configuration of the application hosting environment.

[0048] Infrastructure as a Service (IaaS): The capabilities provided to consumers are the provision of processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0049] The deployment model is as follows:

[0050] Private Cloud: Cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0051] Community Cloud: Cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0052] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0053] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0054] Cloud computing environments are service-oriented and focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0055] See now Figure 2 , an illustrative cloud computing environment 50 is described. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud consumer can communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped in one or more networks such as the private cloud, community cloud, public cloud, or hybrid cloud described above, or a combination thereof (not shown). This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Figure 1 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0056] See now Figure 3 , showing the cloud computing environment 50 ( Figure 1 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 2The components, layers and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown in the figure, the following layers and corresponding functions are provided:

[0057] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; servers based on RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0058] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0059] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level management 84 may operate in conjunction with the workload layer 90 to perform CDVS. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources in anticipation of future demand according to the SLA.

[0060] The workload layer 90 provides examples of functions that can take advantage of the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and content updates on virtual machine monitoring 96.

[0061] Figure 4 An example content-aware system 400 for operating a cluster of virtual machines consistent with some embodiments of the present disclosure is depicted. The content-aware system 400 may include a first cluster 410, a second cluster 440, and a central server 470 for performing management of the content-aware system. The first cluster 410 may include a plurality of first virtual machines 420-1, 420-2, ..., 420-n (collectively referred to as 420). The second cluster 440 may include a plurality of second virtual machines 450-1, 450-2, ..., 450-n (collectively referred to as 450).

[0062] The first cluster 410 may include one or more physical computer systems that host the cluster. The first cluster 410 may be a logical collection of physical computer systems. Figure 1 An example of a computer system 100 capable of hosting a first cluster 410 is depicted. The first cluster 410 can collectively operate first virtual machines 420. For example, a single accounting software middleware can operate across first virtual machines 420-1 and 420-2. The first cluster 410 can operate first virtual machines 420 under different workloads simultaneously. For example, the first virtual machine 420-1 can host a file sharing suite and the first virtual machine 420-2 can host image analysis software.

[0063] Each first virtual machine 420 may include a first CDVS client 430-1, 430-2, ..., 430-n (collectively referred to as 430). The first CDVS client 430 is configured to perform cognitive agent operations, including monitoring and collecting content from the corresponding first virtual machine 420. For example, the first CDVS 430-2 can detect changes or updates by continuously or periodically scanning the first virtual machine 420-2. The collected data can be transmitted to the central server 470 at 432.

[0064] Similarly, the second cluster 440 may include one or more physical computer systems hosting the second virtual machines 450. Each second virtual machine 460 may include a second CDVS client 460-1, 460-2, ..., 460-n (collectively referred to as 460). The second CDVS client 460 is configured to perform cognitive agent operations, including monitoring and collecting content from the corresponding second virtual machine 450. For example, the second CDVS 450-2 may detect changes or updates by continuously or periodically scanning the second virtual machine 460-2. The collected data may be transmitted to the central server 470 at 462.

[0065] The central server 470 may be a computer system configured to perform hosting, management, and coordination of a virtualized environment. For example, a management interface may operate on the central server 470 to allocate computer resources to the clusters 410 and 440. The CDVS cognitive agent 480 may operate on the central server 470. In some embodiments, the CDVS cognitive agent may operate on each virtual machine (e.g., the first virtual machine 420, the second virtual machine 450). The CDVS cognitive agent 480 may receive updated content scans from the clusters 410 and 440. The CDVS cognitive agent 480 may be configured to generate insights into the scan data to detect individual and cumulative changes in the content of a given cluster. If the security level on an individual virtual machine changes, the CDVS cognitive agent 480 may instruct the virtual machine to update the security level. For example, at 482, the CDVS cognitive agent 480 may communicate with the first virtual machine 420 to increase or decrease the security level based on insights identified from the received content. If the security level changes based on a combination of virtual machines within the cluster, the CDVS cognitive agent 480 may instruct the virtual machine to update the security level. For example, CDVS cognitive agent 480 may receive content updates from second CDVS client 460-1 and content information from second CDVS client 460-2 at 484. Based on the change in content on second virtual machine 450-1 relative to existing content on second virtual machine 450-2, CDVS cognitive agent 480 may determine a change in security settings and communicate the change to second virtual machine 450 at 484.

[0066] In some embodiments, CDVS clients 430 and 460 may be programmed to perform various analyses outside of CDVS cognitive agent 480. CDVS clients 430 and 460 may first analyze the contents of virtual machines 410 and 440 to generate a new security level. For example, if certain insights generated from credit card history lead to disclosure of a person's medical illness, the insights (and the content underlying the insights) are protected to comply with medical data protection laws, such as the Health Insurance Portability and Accountability Act (HIPAA). CDVS clients 430 and 460 may also isolate the content and the generated insights by providing limited access to the content and insights (e.g., administrative access only, access to the user who created the data). CDVS clients 430 and 460 may also send a new security level for a given virtual machine (420 and 450, respectively) to CDVS cognitive agent 480. CDVS clients 430 and 460 may also receive instructions from CDVS cognitive agent 480 regarding security settings to be applied to clusters 410 and 440, respectively. In some embodiments, if the current security settings on a given system are greater than the security requirements of the insights, no action may be taken. If the current settings on the system lack the identified level of security necessary to protect the content (e.g., a security breach), appropriate actions may be performed (e.g., adjusting security settings, notifying an administrator of new security settings to be applied). In some embodiments, CDVS clients 430 and 460 may, after the updated security settings are applied (or if the administrator rejects a suggestion to change the security settings), any previously quarantined data may be un-quarantined and made accessible to anyone with appropriate credentials.

[0067] In some embodiments, CDVS cognitive agent 480 can work in conjunction with CDVS clients 430 and 460 and can react to information provided at 432 and 462. For example, CDVS cognitive agent 480 can process data / insights obtained from CDVS clients 430 and 460. CDVS cognitive agent 480 can also process new security settings proposed by CDVS clients 430 and 460 by looking at data / insights of virtual machines 420 and 450. CDVS cognitive agent 480 can analyze data / insights generated on given clusters 410 and 440 and propose a security level (e.g., one or more recommendations for different security settings). The security level may be the same as the previously existing security level, or it may be different. In some embodiments, CDVS cognitive agent 480 can compare the old and new security levels to see which is more stringent. CDVS cognitive agent 480 can send a more stringent security policy to be applied to the endpoint cognitive agent, or can recommend a new security policy to the administrator.

[0068] In some embodiments, 400 can operate based on decentralized logic. For example, CDVS clients 430 and 460 across virtual machines 420 and 450, respectively, can communicate using cluster protocols, or directly communicate about various insights and security settings (e.g., using peer-to-peer communication). CDVS clients 430 and 460 can directly apply security settings based on insights and content analysis. A decentralized environment may require that insights and content be propagated across a given cluster (e.g., the first virtual machine 420 of cluster 410) until all virtual machines in a given cluster have the same generated insights. As virtual machines are added to a given cluster and treated as new data sources, the security settings of existing virtual machines may increase in a short period of time. After cognitive analysis of the cumulative insights across a given cluster and the newly added virtual machines, a decision can be made about the impact of the newly added virtual machines on the given cluster. For example, before the first virtual machine 420-5 is migrated into cluster 410, its insights and security levels are passed to the existing first CDVS client 430. The first CDVS client 430 can scan the content of the newly migrated first virtual machine 420-5 and re-evaluate the security settings. A new first CDVS client 430-5 may be instantiated on the newly migrated first virtual machine 420-5, and updated security settings may be implemented. Until the security of the cluster 410 is reassessed, the first virtual machine 420-5 may be placed in a quarantine zone.

[0069] Figure 5An example cluster 500 configured for increasing security settings consistent with some embodiments of the present disclosure is depicted. Cluster 500 may include one or more virtual machines 510, 520, and 530. Virtual machines 510, 520, 530, and 540 may be associated with cluster 500. For example, these virtual machines may be associated with cluster 500 by being one of the existing virtual machines (e.g., 510, 520, and 530) of the cluster or by being added to the cluster (e.g., 540). Cluster 500 may implement CDVS to increase the security level of one or more of virtual machines 510, 520, and 530 based on changes to the cluster. In a first scenario, virtual machine 540 may be added to the cluster. Cluster 500 may increase security settings based on scanning the contents of virtual machines 510, 520, and 530 and the contents of the newly added virtual machine 540. In a second scenario, virtual machine 520 may generate new data 560. The newly generated data may be an analysis of information that is otherwise benign but may ultimately be considered private data based on the content analysis of CDVS. Cluster 500 may increase security settings based on newly generated data 560. In some embodiments, as new data 560 enters cluster 500, such new data 560 may be isolated and invisible to everyone (except, for example, an administrator or owner) until the security settings of cluster 500 are changed (if necessary) or determined to remain unchanged. In a third scenario, cluster 500 may increase security settings for virtual machines 510, 520, and 530 in response to being placed on network 550 with external access to a public network (i.e., the Internet).

[0070] Figure 6An example cluster 600 configured with lower security settings consistent with some embodiments of the present disclosure is depicted. Cluster 600 may include one or more virtual machines 610, 620, and 630. Virtual machines 610, 620, 630, and 640 may be associated with cluster 600. For example, a given virtual machine may be associated with cluster 600 by being one of the existing virtual machines of the cluster (e.g., 610, 620, and 630), or by being removed from the cluster (e.g., 640). Cluster 600 may implement CDVS to increase the security level of one or more of virtual machines 610, 620, 630, and 640 based on changes to the cluster. In a first scenario, virtual machine 640 may be removed from the cluster. Cluster 600 may reduce security settings based on scanning the content of virtual machines 610, 620, 630 and the newly removed content of newly removed virtual machine 640. In a second scenario, virtual machine 630 may delete data 660. The newly deleted data may change the content composition on cluster 600. The CDVS may determine that the new content of cluster 600 is no longer private. In a third example, cluster 600 may reduce security settings of virtual machines 610, 620, and 630 in response to being removed from network 650 (e.g., a network (not shown) connected to other virtual machines processing private data).

[0071] Figure 7 An example method 700 for performing CDVS consistent with some embodiments of the present invention is depicted. The method 700 may be performed by a computer system. For example, Figure 1 The illustrated computer system 100 may be used to perform one or more CDVS operations. Certain operations of method 700 may be performed by a first computing device and other operations may be performed by a second computing device: for example, a first CDVS client operating on the first device and a second CDVS client operating on the second device.

[0072] Beginning at 705, method 700 begins by scanning all virtual machines of a cluster at 710. Scanning a cluster may include monitoring updates to data present on a given virtual machine of the cluster. For example, if new content is added to a file through an update, the scan may detect the change. In another example, if a new virtual machine is added to the cluster, the scan may detect the content file located on the newly added virtual machine. The newly added file may be considered a change in content or updated content.

[0073] If a change is detected in the first content file (720: Y), the content-based security level of the cluster can be determined at 730. The content-based security level can be determined based on the analysis of the updated content. For example, the content can be analyzed by performing natural language processing on the content of the virtual machine. The content-based security level can be determined based on the analysis of the content existing on the rest of the cluster. For example, the content can be analyzed by performing analysis on the data existing on the virtual machine except for the updated data. In another example, the content can be analyzed by performing analysis on the existing data and the newly updated content on a single virtual machine or across virtual machines in the cluster. Data analysis can be based on data belonging to any user or can be in any form (e.g., XML, SQL database, log file, etc.). Insights can be generated based on data types using appropriate predefined models. Models for generating insights can be pre-trained in a specific industry field to generate insights related to the industry. The operation of model training and the insight generation process for determining the security level of the cluster can be based on the organizational policy that will use the proposed solution.

[0074] At 740, the determined content-based security level can be compared to a security level standard. The security level standard can be a pre-existing set of policies, rule sets, or permission settings across various computers and virtual machines in the cluster. Based on the comparison, security gaps can be identified. For example, based on truncated data within a log file, the determined content-based security level can be three out of ten, while the existing security level standard for the cluster can be seven out of ten. In a second example, based on data generated within the content store of the virtual machine, the determined content-based security level can be five out of ten, while the existing security level standard for the cluster can be four out of ten.

[0075] If there are identified gaps (750: Y), then an update to the security settings of the cluster may be performed at 740. The update to the security settings may be performed by changing the file sharing permission settings to remove access rights for certain entities. The update to the security settings may be performed by increasing the strength or complexity of the encryption algorithm of the cluster. The update to the security settings may be performed by generating a notification of the security settings adjustment and sending or communicating the notification to an administrative user.

[0076] The present invention may be a system, method and / or computer program product of any possible degree of technical detail integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to execute various aspects of the present invention.

[0077] Computer readable storage medium can be a tangible device that can retain and store instructions for use by instruction execution devices. Computer readable storage medium can be, for example but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device such as punch card or a protruding structure in a groove with instructions recorded thereon, and any suitable combination of the above. Computer readable storage medium as used herein should not be interpreted as a temporary signal itself, such as radio waves or other free propagating electromagnetic waves, electromagnetic waves propagated by waveguides or other transmission media (e.g., light pulses passing through fiber optic cables) or electrical signals emitted by wires.

[0078] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0079] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming languages ​​or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In certain embodiments, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can perform computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit so as to perform various aspects of the present invention.

[0080] The present invention is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present invention. It should be understood that each box of the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer readable program instructions.

[0081] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in the boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which causes the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium in which the instructions are stored includes an article of manufacture containing instructions for implementing aspects of the functions / actions specified in the boxes of the flowchart and / or block diagram.

[0082] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in the boxes of the flowchart and / or block diagram.

[0083] The flow chart and block diagram in the accompanying drawings show the architecture, function and operation of the possible implementation of the system, method and computer program product according to different embodiments of the present invention. To this end, each box in the flow chart or block diagram may represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing a specified logical function. In some alternative implementations, the function marked in the box may not occur in the order marked in the figure. For example, the two boxes shown in succession can actually be completed as a step, and are executed simultaneously, substantially simultaneously, in a partially or completely overlapping manner in time, or the boxes can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0084] The description of different embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to explain the principles of the embodiments, practical applications, or technical improvements to technologies in the marketplace, or to enable those of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method comprising: Scanning, by a first computer system, a cluster of one or more virtual machines; Based on the scanning of the cluster, detecting a first content file change, wherein the first content file change is for a first content file located on a first virtual machine associated with the cluster; wherein the detecting comprises performing natural language processing on the first content file, the natural language processing comprising identifying an industry sector associated with a change to the first content file; determining a content-based security level for the cluster based on detecting a change to the first content file, based on the natural language processing, and based on the industry sector; comparing the determined content-based security level of the cluster to a security level criterion for the cluster; identifying a security breach based on said comparison of said determined content-based security level with said security level criteria; and In response to the identified security breach, an update to a security setting of the cluster is performed.

2. The method according to claim 1: in, The cluster includes a second virtual machine, And wherein the method further comprises: scanning a second content file located on the second virtual machine; And wherein determining the content-based security level of the cluster is also responsive to scanning of the second content file.

3. The method according to claim 1, wherein: Performing the update of the security settings of the cluster includes updating security settings of the first virtual machine.

4. The method according to claim 1, wherein: Performing the update of the security settings of the cluster includes updating security settings of virtual machines of the cluster other than the first virtual machine.

5. The method according to claim 1, wherein: The scanning of the cluster includes monitoring for a given virtual machine to be added to the cluster, and wherein the first virtual machine is added to the cluster.

6. The method according to claim 1, wherein: The first content file change is a creation of the first content file.

7. The method according to claim 1, wherein: The first content file change is an update to the first content file.

8. The method according to claim 1, wherein: The first content file change is deletion of the first content file.

9. The method according to claim 1, wherein: The first content file change is a change in sharing permission of the first content file.

10. The method according to claim 1, wherein: The scanning of the cluster includes monitoring for a given virtual machine to be removed from the cluster, and wherein the first virtual machine is removed from the cluster.

11. A system, comprising: a memory containing one or more instructions; as well as a processor communicatively coupled to the memory, the processor being configured in response to reading the one or more instructions to: Scan a cluster of one or more virtual machines; detecting a first content file change based on the scanning of the cluster, wherein the first content file change is for a first content file located on a first virtual machine associated with the cluster; wherein the detecting comprises performing natural language processing on the first content file, the natural language processing comprising identifying an industry sector associated with a change to the first content file; determining a content-based security level for the cluster based on detecting the first content file change, based on the natural language processing, and based on the industry sector; comparing the determined content-based security level of the cluster to a security level standard for the cluster; identifying a security breach based on said comparing the determined content-based security level to said security level criteria; and In response to the identified security breach, an update to a security setting of the cluster is performed.

12. The system according to claim 11: in, The cluster includes a second virtual machine, And wherein the processor is further configured to: scanning a second content file located on the second virtual machine; And wherein determining the content-based security level of the cluster is further responsive to the scanning the second content file.

13. The system according to claim 11, wherein: Performing the update of the security settings of the cluster includes updating security settings of the first virtual machine.

14. The system according to claim 11, wherein: Performing the updating of the security settings of the cluster includes updating security settings of virtual machines of the cluster other than the first virtual machine.

15. The system according to claim 11, wherein: The scanning the cluster includes monitoring for a given virtual machine to be added to the cluster, and wherein the first virtual machine is added to the cluster.

16. A computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions being configured to: Scanning, by a first computer system, a cluster of one or more virtual machines; Based on the scanning of the cluster, detecting a first content file change, in, The first content file change is to a first content file located on a first virtual machine associated with the cluster; wherein the detecting comprises performing natural language processing on the first content file, the natural language processing comprising identifying an industry sector associated with a change to the first content file; determining a content-based security level for the cluster based on detecting the first content file change, based on the natural language processing, and based on the industry sector; comparing the determined content-based security level of the cluster to a security level standard for the cluster; identifying a security breach based on the content-based security level determined by the comparing with the security level standard; as well as In response to the identified security breach, an update to a security setting of the cluster is performed.

17. The computer program product of claim 16, wherein: The first content file change is a creation of the first content file.

18. The computer program product of claim 16, wherein: The first content file change is an update to the first content file.

19. The computer program product of claim 16, wherein: The first content file change is deletion of the first content file.

20. The computer program product of claim 16, wherein: The first content file change is a change in sharing permission of the first content file.

Images