Construction of software development, security and operation environments

Abstract

Aspects of the present disclosure generally relate to software development environments, and more particularly to systems, computer program products, and methods for automated software development, security, and operation (DevSecOp). Receiving, by the processor, a plurality of infrastructure-code files specifying a configuration of a runtime environment for deployable images of source code in a continuous integration and continuous delivery pipeline for the cloud platform; generating, by the processor, compliance code for at least one file of a plurality of infrastructure, code files; constructing, by the processor, a deployable image of source code in a continuous integration and continuous delivery pipeline according to a configuration specified by a plurality of infrastructure, code files, and the compliance code; and deploying, by the processor, an instance of the image in a runtime environment.

Description

Background Art

[0001] Aspects of the present invention relate generally to software development environments and, more particularly, to systems, computer program products, and methods for automating software development, security, and operations (DevSecOp).

[0002] Infrastructure as Code (IaC) is the practice of automatically configuring a system's dependencies and providing local and remote instances of software deployments. Professionals view IaC as a fundamental pillar for implementing software development and operations (DevOps) practices for the rapid delivery of software and services to end users. For companies creating cloud-based projects that leverage IaC, strategies for identifying any flaws or security defects during development and deployment of environments are useful for corporate compliance and auditing. Summary of the invention

[0003] In a first aspect of the present invention, there is a computer-implemented method, comprising: receiving, by a processor, a plurality of infrastructure-as-code files, the plurality of infrastructure-as-code files specifying a configuration of a runtime environment for a deployable image of source code in a continuous integration and continuous delivery pipeline for a cloud platform; generating, by the processor, compliant code for at least one file of the plurality of infrastructure-as-code files; building, by the processor, the deployable image of the source code in the continuous integration and continuous delivery pipeline according to the configuration specified by the plurality of infrastructure-as-code files and the compliant code; and deploying, by the processor, an instance of the image in the runtime environment.

[0004] In another aspect of the present invention, a computer program product is provided, comprising one or more computer-readable storage media, on which program instructions are stored together, the program instructions being executable to: input features of each of a plurality of code files in a continuous integration and continuous delivery pipeline for a cloud platform into a machine learning model, the machine learning model being trained using test data, the test data comprising examples of non-compliant code having security vulnerabilities; detecting, by the machine learning model, non-compliant code in at least one of the plurality of code files in the continuous integration and continuous delivery pipeline for the cloud platform; building, according to a configuration of a runtime environment specified by the plurality of code files, a deployable image of source code in the continuous integration and continuous delivery pipeline, the image comprising the at least one code file of the plurality of code files, the at least one code file containing compliant code that fixes the security vulnerability; and deploying an instance of the image in the runtime environment.

[0005] In another aspect of the present invention, there is a system, a processor group, one or more computer-readable storage media, and program instructions stored together on the one or more computer-readable storage media. The program instructions are executable to: detect code that does not comply with compliance rules of security and compliance policies in at least one of a plurality of infrastructure-as-code files in a continuous integration and continuous delivery pipeline for a cloud platform; append compliant code that complies with the compliance rules of the security and compliance policies to the at least one of the plurality of infrastructure-as-code files; and deploy a deployable image of source code in the continuous integration and continuous delivery pipeline in a runtime environment specified by the plurality of infrastructure-as-code files, the image including the at least one file to which the compliant code that complies with the compliance rules is appended. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In the following detailed description, with reference to the various figures mentioned, aspects of the invention are described by way of non-limiting examples of exemplary embodiments of the invention.

[0007] Figure 1 A computing environment according to an embodiment of the invention is shown.

[0008] Figure 2 A block diagram of an exemplary environment according to aspects of the invention is shown.

[0009] Figure 3 A diagram of an exemplary workflow according to aspects of the invention is described.

[0010] Figure 4 A flow chart of an exemplary method according to aspects of the invention is shown.

[0011] Figure 5 An illustration of an exemplary process flow diagram according to aspects of the present invention is shown.

[0012] Figure 6 A flow chart of an exemplary method according to aspects of the invention is shown.

[0013] Figure 7 A flow chart of an exemplary method according to aspects of the invention is shown.

[0014] Figure 8 A flow chart of an exemplary method according to aspects of the invention is shown. DETAILED DESCRIPTION

[0015] Aspects of the present invention generally relate to software development environments, and more specifically, to systems, computer program products, and methods for automated software development, security, and operations (DevSecOp). More specifically, aspects of the present invention relate to methods, computer program products, and systems for an optimized continuous integration and continuous delivery (CI / CD) pipeline environment that fixes non-compliant code and verifies compliant code according to an enterprise's compliance and security policies in the development and deployment of serverless functions, microservices, and application programming interface (API) gateways on a cloud platform. When cloud service providers rely on third-party security consulting to support compliant and secure development in cloud service deployments, inefficient and inconsistent processes occur. According to aspects of the present invention, the methods, systems, and computer program products described herein automatically detect and fix non-compliant code as part of a process in a CI / CD environment, and further verify that the code is compliant as part of a deployment process.

[0016] In various embodiments, the methods, systems, and program products described herein receive source code written for a serverless function and an API gateway and CI / CD pipeline configuration file, including an infrastructure as code (IaC) file that specifies the configuration of a cloud service, functions and resources (such as an infrastructure stack) that trigger a runtime environment to deploy cloud services. By applying machine learning analysis (such as long short-term memory (LSTM) analysis) in a machine learning model trained using enterprise data and / or crowdsourced data, the source code and CI / CD pipeline configuration file are processed as part of the CI / CD integration and delivery environment. The analysis detects code that does not follow the compliance rules of security and compliance policies. Compliant code that follows the compliance rules is generated and attached to the corresponding code file with the detected non-compliant code so that the code follows the compliance rules. According to the configuration of the runtime environment specified by the pipeline configuration file (including files updated with compliance code), a deployable image for the service of the source code is built in a continuous integration and continuous delivery pipeline. In addition, as part of the deployment process, the build of the deployable image is verified to verify that the code complies with the compliance rules, and the cloud service is deployed on the cloud platform.

[0017] In addition, the methods, systems, and program products used in the embodiments of the present disclosure incorporate security / policy compliance into the DevSecOps pipeline by crowdsourcing compliance recommendations for common compliance security / policy issues (e.g., threats, vulnerabilities) and using a reward system (e.g., reputation scores) to identify useful recommendations. The crowdsourced compliance recommendations are used as training data to train a cognitive engine to generate compliant code for input source code. The trained cognitive engine can then generate compliant code for a given set of serverless cloud computing code. The reward system can use blockchain to track individual compliance recommendations and reward contributors of compliance recommendations based on the success of the compliance recommendations for actual security / policy issues.

[0018] Various aspects of the present invention relate to improvements in computer-related techniques and prior art processes in a CI / CD environment for deploying cloud services. In an embodiment, a system including a processor, a computer-readable memory, one or more computer-readable storage media, and program instructions stored together on the one or more computer-readable storage media can detect code that does not follow compliance rules of security and compliance policies in a continuous integration and continuous delivery pipeline for cloud services, attach compliant code that follows compliance rules of security and compliance policies to fix non-compliant code, verify that code follows compliance rules of security and compliance policies, and deploy cloud services. These are specific improvements in the way that computers can operate and interoperate to automatically detect and fix non-compliant code and further verify that deployable cloud services follow the compliance and security policies of the enterprise.

[0019] Implementations of the present disclosure describe add-ons that are specific improvements to the way a computer can operate, and these add-ons provide non-abstract improvements to computer functionality and capabilities. As an example, a computer program product including one or more computer-readable storage media with program instructions stored together on one or more computer-readable storage media may input features of code files in a continuous integration and continuous delivery pipeline for a cloud service into a machine learning model trained using samples of non-compliant code with security vulnerabilities, detect non-compliant code in one or more code files in a continuous integration and continuous delivery pipeline for a cloud service by the machine learning model, build a deployable image for a cloud service in a continuous integration and continuous delivery pipeline according to a configuration of a runtime environment specified by the code files (including one or more code files that incorporate compliant code that fixes security vulnerabilities), and deploy the cloud service in the runtime environment.

[0020] It should be understood that to the extent that implementations of the present invention collect, store, or employ personal information provided by or obtained from individuals, such information should be used in accordance with all applicable laws relating to the protection of personal information. In addition, the collection, storage, and use of such information may be subject to the individual's consent to such activities, for example, through an "opt-in" or "opt-out" process that may be appropriate to the circumstances and type of information. The storage and use of personal information may be in an appropriately secure manner that reflects the type of information, for example, through various encryption and anonymization techniques for particularly sensitive information.

[0021] Various aspects of the present disclosure are described by narrative text, flow charts, block diagrams of computer systems, and / or block diagrams of machine logic included in computer program product (CPP) embodiments. With respect to any flow chart, depending on the technology involved, the operations may be performed in an order different from the order shown in a given flow chart. For example, again depending on the technology involved, two operations shown in consecutive flow chart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that at least partially overlaps in time.

[0022] Computer program product embodiments ("CPP embodiments" or "CPP") are terms used in this disclosure to describe any collection of one or more storage media (also referred to as "media") collectively included in a collection of one or more storage devices that collectively include machine-readable code corresponding to instructions and / or data for performing the computer operations specified in a given CPP claim. A "storage device" is any tangible device that can hold and store instructions for use by a computer processor. Without limitation, a computer-readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include: magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanical encoding devices (such as punch cards or pits / land formed in a major surface of a disk), or any suitable combination of the foregoing. Computer-readable storage media, as the term is used in this disclosure, should not be construed as storing in the form of transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, light pulses transmitted through fiber optic cables, electrical signals transmitted through wires and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at certain occasional points in time during normal operation of the storage device, such as during access, defragmentation, or garbage collection, but this does not make the storage device transient because the data is not transient while it is stored.

[0023] The computing environment 100 includes an example of an environment for executing at least some of the computer codes involved in performing the methods of the present invention, such as an optimized serverless continuous integration and continuous delivery environment 200 on a cloud platform for software development, security, and operations. In addition to the block 200, the computing environment 100 includes, for example, a computer 101, a wide area network (WAN) 102, an end-user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this embodiment, the computer 101 includes a processor set 110 (including a processing circuit 120 and a cache 121), a communication structure 111, a volatile memory 112, a permanent storage device 113 (including an operating system 122 and a block 200, as described above), a peripheral device set 114 (including a user interface (UI) device set 123, a storage device 124, and an Internet of Things (IoT) sensor set 125), and a network module 115. The remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140 , a cloud coordination module 141 , a host physical machine set 142 , a virtual machine set 143 , and a container set 144 .

[0024] Computer 101 may take the form of a desktop computer, laptop computer, tablet computer, smart phone, smart watch or other wearable computer, mainframe computer, quantum computer, or any other form of computer or mobile device now known or developed in the future that is capable of running programs, accessing a network, or querying a database such as remote database 130. As is well known in the art of computer technology, and depending on the technology, the performance of computer-implemented methods may be distributed among multiple computers and / or among multiple locations. On the other hand, in this presentation of computing environment 100, the detailed discussion focuses on a single computer, particularly computer 101, to keep the presentation as simple as possible. Computer 101 may be located in the cloud, even though it is not yet fully understood. Figure 1 1 is not shown in the cloud, on the other hand, computer 101 need not be in the cloud except to any extent that can be positively indicated.

[0025] Processor set 110 includes one or more computer processors of any type known now or to be developed in the future. Processing circuit 120 may be distributed over multiple packages, such as multiple cooperating integrated circuit chips. Processing circuit 120 may implement multiple processor threads and / or multiple processor cores. Cache 121 is a memory located in the processor chip package and is typically used for data or code that should be quickly accessed by threads or cores running on processor set 110. Cache memory is typically organized into multiple levels based on relative proximity to the processing circuit. Alternatively, some or all of the caches of the processor set may be located "off chip". In some computing environments, processor set 110 may be designed to work with qubits and perform quantum computing.

[0026] Computer-readable program instructions are typically loaded onto the computer 101 to cause the processor set 110 of the computer 101 to perform a series of operating steps to implement a computer-implemented method, so that the instructions so executed will instantiate the method specified in the flowchart and / or narrative description of the computer-implemented method included in this document (collectively referred to as the "method of the present invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 121 and other storage media discussed below. The program instructions and related data are accessed by the processor set 110 to control and direct the execution of the computer-implemented method. In the computing environment 100, at least some of the instructions for performing the method of the present invention may be stored in a block 200 in a persistent storage device 113.

[0027] The communication fabric 111 is the signal conduction paths that allow the various components of the computer 101 to communicate with each other. Typically, the fabric is made up of switches and conductive paths, such as those that make up a bus, a bridge, physical input / output ports, etc. Other types of signal communication paths may be used, such as fiber optic communication paths and / or wireless communication paths.

[0028] The volatile memory 112 is any type of volatile memory now known or developed in the future. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory is characterized by random access, but this is not required unless affirmatively indicated. In the computer 101, the volatile memory is located in a single package and is internal to the computer 101, but, alternatively or additionally, the volatile memory can be distributed in multiple packages and / or located externally relative to the computer 101.

[0029] Permanent storage 113 is any form of non-volatile storage for computers known now or developed in the future. The non-volatility of the memory means that the stored data is maintained regardless of whether the computer 101 and / or the permanent storage 113 are powered directly. Permanent storage 113 can be a read-only memory (ROM), but usually at least a portion of permanent storage 113 allows the writing of data, the deletion of data, and the rewriting of data. Some common forms of permanent storage include disks and solid-state storage devices. Operating system 122 can take several forms, such as various known proprietary operating systems or operating systems of the open source portable operating system interface type using a kernel. The code included in block 200 generally includes at least some computer codes involved in the execution of the method of the present invention.

[0030] The peripheral device set 114 includes a set of peripheral devices of the computer 101. The data communication connection between the peripheral devices and other components of the computer 101 can be implemented in various ways, such as a Bluetooth connection, a near field communication (NFC) connection, a connection made by a cable (such as a universal serial bus (USB) type cable), a plug-in type connection (e.g., a secure digital (SD) card), a connection made through a local area communication network, and even a connection made through a wide area network such as the Internet. In various embodiments, the UI device set 123 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smart watches), keyboards, mice, printers, touchpads, game controllers, and tactile devices. The storage device 124 is an external storage device, such as an external hard drive, or a pluggable storage device, such as an SD card. The storage device 124 can be permanent and / or volatile. In some embodiments, the storage device 124 can take the form of a quantum computing storage device for storing data in the form of quantum bits. In embodiments where the computer 101 needs to have a large amount of storage (e.g., where the computer 101 locally stores and manages a large database), the storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. The IoT sensor set 125 consists of sensors that can be used in IoT applications. For example, one sensor may be a thermometer, while another sensor may be a motion detector.

[0031] The network module 115 is a collection of computer software, hardware, and firmware that allows the computer 101 to communicate with other computers via the WAN 102. The network module 115 may include hardware such as a modem or a Wi-Fi signal transceiver, software for packetizing and / or depacketizing data transmitted over a communication network, and / or web browser software for transmitting data over the Internet. In some embodiments, the network control function and the network forwarding function of the network module 115 are performed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing software defined networks (SDN)), the control function and the forwarding function of the network module 115 are performed on physically separated devices, so that the control function manages several different network hardware devices. Computer-readable program instructions for executing a computer-implemented method can typically be downloaded to the computer 101 from an external computer or an external storage device via a network adapter card or a network interface included in the network module 115.

[0032] WAN 102 is any wide area network (e.g., the Internet) capable of transmitting computer data over non-local distances by any technology now known or developed in the future for transmitting computer data. In some embodiments, the WAN may be replaced and / or supplemented by a local area network (LAN) designed to transmit data between devices located in a local area (e.g., a Wi-Fi network). A WAN and / or LAN typically includes computer hardware, such as copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0033] End-user device (EUD) 103 is any computer system used and controlled by an end-user (e.g., a customer of an enterprise operating computer 101), and may take any of the forms discussed above in connection with computer 101. EUD 103 typically receives useful and usable data from the operation of computer 101. For example, in the hypothetical case where computer 101 is designed to provide recommendations to an end-user, the recommendations would typically be transmitted from network module 115 of computer 101 to EUD 103 via WAN 102. In this manner, EUD 103 may display or otherwise present the recommendations to the end-user. In some embodiments, EUD 103 may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, etc.

[0034] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents a machine that collects and stores useful and usable data for use by other computers, such as computer 101. For example, in the hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, the historical data may be provided to computer 101 from remote database 130 of remote server 104.

[0035] The public cloud 105 is any computer system available for use by multiple entities that provides on-demand availability of computer system resources and / or other computer capabilities, particularly data storage (cloud storage) and computing capabilities, without direct active management by users. Cloud computing typically utilizes the sharing of resources to achieve consistency and economy of scale. The direct and active management of the computing resources of the public cloud 105 is performed by computer hardware and / or software of the cloud coordination module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments running on various computers that constitute the host physical machine set 142, which is the universe of physical computers in and / or available for the public cloud 105. Virtual computing environments (VCEs) typically take the form of virtual machines from a virtual machine set 143 and / or containers from a container set 144. It should be understood that these VCEs can be stored as images and can be transferred between various physical machine hosts as images or after instantiation of the VCEs. Cloud orchestration module 141 manages the transfer and storage of images, deploys new instantiations of VCEs, and manages active instantiations of VCE deployments. Gateway 140 is a collection of computer software, hardware, and firmware that allows public cloud 105 to communicate over WAN 102 .

[0036] Some further explanation of a virtualized computing environment (VCE) will now be provided. A VCE can be stored as an "image". A new active instance of the VCE can be instantiated from the image. Two common types of VCEs are virtual machines and containers. Containers are VCEs that use operating system-level virtualization. This refers to an operating system feature in which the kernel allows the existence of multiple isolated user space instances, called containers. From the perspective of the programs running in them, these isolated user space instances typically behave like actual computers. Computer programs running on a normal operating system can utilize all of the resources of that computer, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, programs running within a container can only use the contents of the container and the devices assigned to the container, a feature known as containerization.

[0037] The private cloud 106 is similar to the public cloud 105, except that the computing resources are only available to a single enterprise. Although the private cloud 106 is depicted as communicating with the WAN 102, in other embodiments, the private cloud can be completely disconnected from the Internet and can only be accessed through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private, community, or public cloud types), typically implemented by different vendors. Each of the multiple clouds remains an independent and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable coordination, management, and / or data / application portability between the multiple constituent clouds. In this embodiment, the public cloud 105 and the private cloud 106 are both part of a larger hybrid cloud.

[0038] Figure 2 A block diagram of an exemplary environment 205 according to aspects of the present invention is shown. In an embodiment, the environment includes a server 206, which may be a server such as a reference Figure 1 The computer system described herein is computer 101, using server 206, end user device 103 and remote server 104 (each of which is also referred to as Figure 1 Description) can be accessed through a network (such as reference Figure 1 Typically, server 206 supports services for serverless continuous integration and continuous delivery (CI / CD) on a cloud platform optimized for software development, security, and operations (DevSecOps) practices.

[0039] The server 206 has a server memory 208, such as reference Figure 1The volatile memory 112 described. The server 206 includes a cognitive module 210 in the memory 208, which has the function of receiving data, including source code, infrastructure as code (IaC) code, practical manuals (playbooks), CI / CD pipeline configuration files, and other data provided and used during CI / CD delivery on the cloud platform, and processes the data to detect that the code does not comply with the compliance rules and policies of the enterprise and generates updated source code, IaC code and other files to comply with the compliance rules and policies of the enterprise. The server 206 also includes a continuous integration module 212 in the memory 208, which has the functions of downloading source code and any dependent code required for source code execution from the repository, compiling source code and dependent code, building executable instances of compiled source code and dependent code, and testing executable instances of source code, as well as other functions such as execution code analysis. In addition, the server 206 includes a continuous delivery module 214, which has the functions of packaging the build into a deployable image (such as a container or virtual machine (VM) image), configuring the deployable image for the runtime environment, and deploying the configured image in the production environment, as well as other functions such as load testing.

[0040] The server 206 may also include in the memory 208 a serverless function module 216 having a serverless function, a microservice module 218 having a microservice process, and a gateway API module 220, which has the function of supporting HTTP API requests for serverless functions of the serverless function module 216 in various embodiments, and has the function of supporting HTTP API requests for microservice processes of the microservice module 218 in alternative embodiments. Each of these modules may be generated by the continuous integration module 212 during CI / CD delivery from one or more source code files 230, a compliance code file 236 generated by the cognitive module 210, and other files used on the cloud platform during CI / CD delivery (such as a pipeline configuration file 238).

[0041] The server 206 may also include a test cognitive module 222 in the memory 208, which has the functionality of the cognitive module 210 to receive data, including source code, IaC code, practical manuals, CI / CD pipeline configuration files, and other data provided and used during CI / CD delivery on the cloud platform, and process the data to detect that the code does not follow the compliance rules and policies of the enterprise. The test cognitive module 222 is also trained using the same training data as the training data used to train the cognitive module 210, so that the test cognitive module 222 detects that the code does not follow the compliance rules and policies, similar to the cognitive module 210. The test cognitive module 222 can be trained using new training data (such as crowdsourced training data 228) to verify that the new training data improves the detectability of the test cognitive module 22 before the cognitive module 210 can be trained using the new training data.

[0042] In an embodiment, Figure 2 The server 206 includes a cognitive module 210, a continuous integration module 212, a continuous delivery module 214, and a test cognitive module 222, each of which may include Figure 1 The modules of the code of block 200 may be composed of Figure 1 The processing circuit 120 of the server 206 may be executed to perform the method of the present invention as described herein. Figure 2 The modules shown may be more or less than the modules shown. In embodiments, separate modules may be integrated into a single module. Additionally or alternatively, a single module may be implemented as multiple modules. Furthermore, the number of devices and / or networks in an environment is not limited to Figure 2 The number shown, in reality, the environment may include additional devices and / or networks; fewer devices and / or networks; different devices and / or networks; or Figure 2 Different arrangements of devices and / or networks are shown.

[0043] According to various aspects of the present invention, Figure 2 A block diagram of a storage device 224 is also shown, which may be a storage device such as a Figure 1The storage device 124 of the computer 101 described above can store training data 226 in a file for training the cognitive module 210. For example, the training data can include a corpus of non-compliant source code, IaC code, practical manuals, CI / CD pipeline configuration files, and other non-compliant data provided and used during CI / CD delivery on the cloud platform, as well as compliant code that updates the source code, IaC code, and other non-compliant files to comply with compliance rules and policies. The storage device 224 can also store crowdsourced training data 228 in a file for training the test cognitive module 222 and the cognitive module 210. The crowdsourced training data 228 can include, for example, a corpus of non-compliant source code, IaC code, practical manuals, CI / CD pipeline configuration files, and other non-compliant data provided and used during CI / CD delivery on the cloud platform, as well as compliant code that updates the source code, IaC code, and other non-compliant files to comply with compliance rules and policies.

[0044] The storage device 224 may also store source code 230 files and IaC code 232 files. The source code 230 files may be any programming language source code, including Java, JavaScript, Python, Node JS, Golang or other programming languages. The IaC code 232 files may include various configuration format files, such as HCL, JSON or YAML file formats, which have functions and / or program instructions to supply the configuration of infrastructure components in the runtime environment. For example, the storage device 224 may store utility manuals 234, each utility manual having a type of IaC code 232 file written in YAML, which includes a statement specifying the final state infrastructure to supply the runtime environment. The storage device 224 may store other types of pipeline configuration files 238 used during CI / CD delivery on the cloud platform, such as configuration files for artifacts, stack template files, role files, and project object model (pom) files. The storage device 224 may also store runtime processing logs 242, which may be scanned to diagnose the cause of CI / CD pipeline failures, such as incorrect syntax, incorrect variable values, job failures, etc.

[0045] The storage device 224 may additionally store compliance code 236 and compliance rules and policy files 240. The compliance rules and policy files 240 may include specifications of security standards that will be followed by, for example, the serverless module 216, the microservice module 218, and / or the gateway API module 220, and verified before deployment in production. The specifications of the security standards may list any number of compliance rules to prevent exposure to various vulnerabilities, such as encryption standards and key lengths for specific data types and information, password protection requirements that specify minimum password lengths and required inclusion of specific character types, and rule sets specified for different network security standards, as well as other compliance rules. The compliance code 236 includes code that updates source code, IaC code, and other files in the CI / CD pipeline to comply with the compliance rules and policies specified in the compliance rules and policy files 240 in the generation of, for example, the serverless module 216, the microservice module 218, and / or the gateway API module 220 for deployment.

[0046] According to various aspects of the present invention, Figure 2 The environment 205 also shows a user device 246 (which may be a reference Figure 1 The computer system of the end user device 103 described above), the company server 252 (which may be such as the computer system of the reference Figure 1 remote server 104 described above), and remote server 256 (which may be a computer system such as that described in reference Figure 1 104) can each communicate via WAN 244, which can be such as the computer system of reference Figure 1 The corporate server 252 may include a security and compliance service 254, which may provide compliance rules and policy files 240 communicated to the server 206 via the WAN 244, which are stored in a Figure 2 In the storage device 224 shown.

[0047] The user device 246 may include an integrated development environment (IDE) tool 248 and an IaC tool 250, which provide a software development environment and other software development tools for software developers. The IDE tool 248 can generate source code, such as source code 230, which can be any programming language source code, including Java, JavaScript, Python, Node JS, Golang or other programming languages, and the IaC tool 250 can generate IaC code, such as IaC code 232, which can include various configuration format files, such as HCL, JSON or YAML file formats. For example, a software developer can use the IDE tool 248 and the IaC tool 250 to write Java code or Java scripts for serverless functions, microservices and / or gateway APIs. In this example, the IDE tool 248 can generate source code 230 and an IaC tool, and the IaC tool can generate IaC code 232 for the serverless module 216, the microservice module 218 and / or the gateway API module 220. In various embodiments, the cognitive module 210 may process the source code 230 and the IaC code 232 and other data provided and used in the CI / CD pipeline to detect that the code does not comply with the compliance rules and policies of the compliance rules and policy files 240, and generate compliance code 236 to update the source code 230 and the IaC code 232 and other non-compliant files to comply with the compliance rules and policies.

[0048] The remote server 256 may include a crowdsourced data aggregator service 258 that provides crowdsourced training data 228 in communication to the server 206 via the WAN 244. The crowdsourced training data may be anonymized and facilitate inclusion of the best of breed solutions on an ongoing basis, regardless of where the solutions are developed. The crowdsourced training data 228 may be used to train the test cognitive module 222 to verify that the crowdsourced training data 228 improves the detection of the test cognitive module 222. If the crowdsourced training data 228 improves the detection of the test cognitive module 222, the crowdsourced training data 228 may be used to train the cognitive module 210, otherwise the crowdsourced training data may be discarded.

[0049] Figure 3 An illustration of an exemplary DevSecOps workflow according to aspects of the present invention is described. In an embodiment, the illustration 300 depicts a security and compliance service 304 of an enterprise cloud platform 302, which will be such as referring to Figure 2 The security and compliance information of the described compliance rules and policy files 240 are provided to the software development pipeline, which generates compliance script updates 322 to update the software in the development pipeline to comply with the security and compliance policies of the enterprise. Figure 33 is a software developer 308, which receives a requirement 306 for developing software and uses a development tool provided in a developer environment 310 to develop software according to the requirement 306. Figure 3 As shown, the security and compliance service 304 of the enterprise cloud platform 302 additionally provides security and compliance information that must then follow the IaC code generated by the IaC tool 312, source code 314, and IDE 316 in the software development pipeline. The security and compliance information is provided to the cognitive engine 318 trained by the trainer 320 to detect non-compliant software and generate compliance script updates 322 to update the code in the development pipeline to comply with the security and compliance policies of the enterprise.

[0050] Figure 4 A flow chart of an exemplary method according to various aspects of the present invention is shown. The steps of the method may be Figure 2 Executed in an environment with reference to Figure 2 The components depicted in FIG.

[0051] In step 402, requirements are specified for infrastructure services or application deployments using serverless functions or API gateways. The specification of these requirements can initiate the DevSecOps development process. In an embodiment, as shown in FIG. Figure 2 As described above, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 receives the requirement.

[0052] At step 404, the requirements are reviewed with reference to any defined architecture documents to identify any serverless functions that must be designed and built. Figure 2 As depicted, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 reviews the requirements.

[0053] In step 406, source code may be written for the serverless function and the API gateway. For example, a developer may write Java code or Java script for the serverless function and the API gateway, the pom.xml file is used to handle build dependencies, and the template.yml file is used to configure the service that defines the serverless function, specifies the event that triggers the function, and specifies the resources for deploying the function. In an embodiment, as shown in FIG. Figure 2 As described, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 uses the IDE tool 248 and the IaC tool 250 to write serverless functions and an API gateway.

[0054] At step 408, the serverless function and API gateway definitions are entered into template.yml. In an embodiment, as shown in FIG. Figure 2As described, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 writes serverless function and API gateway definitions in a template.yml file using the IDE tool 248 and the IaC tool 250.

[0055] In step 410, the identities and access roles for the serverless functions and API gateways are defined in the role files. The role files include the tasks performed by the roles, handlers, modules, variables, metadata with role dependencies, template files, and other configuration artifacts. In an embodiment, as shown in FIG. Figure 2 As described, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 defines identities and access roles for serverless functions and an API gateway in a role file using the IDE tool 248 and the IaC tool 250 .

[0056] In step 412, the infrastructure stack may be defined in a utility manual file or in a template. The infrastructure stack models the data center infrastructure by defining the interrelationships of system components in a runtime environment. In an embodiment, as shown in FIG. Figure 2 As described, a developer using a user device 246 having an IDE tool 248 and an IaC tool 250 uses the IDE tool 248 and the IaC tool 250 to define an infrastructure stack for serverless functions and an API gateway in a description file or template.

[0057] At step 414, the system receives the IaC file and generates compliant code for the non-compliant code in the CI / CD pipeline. The compliant code can be one or more compliance script updates for one or more of the source code, IaC code, and / or other CI / CD pipeline code in various embodiments to update the non-compliant code to comply with security and compliance policies. In various embodiments, and as described in reference Figure 2 As described, cognitive module 210 receives the IaC file and generates compliance code 236 to update the code in the CI / CD pipeline to comply with the compliance rules and policy file 240 .

[0058] At step 416, the system appends the compliant code to the non-compliant code files in the CI / CD pipeline. For example, a separate compliant script update with compliant code is appended to a single file with non-compliant code, which in an embodiment may be a source code file, an IaC code file, and / or other CI / CD pipeline code files. In an embodiment, and as described with reference to Figure 2As described, the cognitive module 210 appends compliant code 236 to non-compliant code files such as source code 230 files, IaC code 232 files, or other pipeline configuration files 236 (including script files 234) in a CI / CD pipeline for production of, for example, a serverless module 216, a microservice module 218, and / or a gateway API module 220 for deployment.

[0059] At step 418, the system builds a CI / CD pipeline with the compliant code to generate a deployable image. For example, the system compiles the source code and the compliant code with the dependent code, and builds an executable instance of the compiled code. In various embodiments, and as described in reference Figure 2 As described, the continuous integration module 212 builds a CI pipeline with compliant code to generate a deployable image.

[0060] At step 420, the system verifies the enterprise-wide policy for the infrastructure service. For example, the system tests the executable instance of the compiled code with the compiled compliance code to verify that the compiled code complies with the compliance rules and policies of the enterprise. In an embodiment, and as described in reference Figure 2 As described, continuous integration module 212 tests executable instances of compiled code with compiled compliant code to verify that the compiled code complies with compliance rules and policy files 240 .

[0061] At step 422, the system executes the CI / CD pipeline and completes the build of the development scripts that meet the security and compliance policies of the enterprise, and deploys the configured image in the production environment. For example, the system completes the build including the compiled compliant code in the CI / CD pipeline that is confirmed to comply with the enterprise-wide policies for infrastructure services. In an embodiment, and as described in reference Figure 2 As described, the continuous delivery module 214 packages the build into a deployable image, such as a container or a virtual machine (VM) image, configures the deployable image for a runtime environment, and deploys the configured image in a production environment.

[0062] Figure 5 An illustration of an exemplary process flow diagram according to aspects of the present invention is shown. In an embodiment, Figure 5The process flow diagram of illustrates the generation of test data for crowdsourced test data from customers who submit test data for training cognitive modules. Customer raw data 502, such as source code, IaC code, and / or other pipeline configuration code, can be analyzed using static code analysis 504 that identifies security vulnerabilities. Customers who develop compliant code for security vulnerabilities can mark security vulnerabilities, also known as interactive issue tags 506. If a customer decides to contribute test data to be aggregated with crowdsourced training data 508, the training data is cleansed through a knowledge catalog 510 to anonymize customer-specific information and standardize tags to provide labeled cleansed data 512. The labeled cleansed data 512 is submitted to a crowdsourced data aggregator 528.

[0063] Quality test data 516 that is supervised to establish a benchmark for test results can be input to the test cognitive engine 518 along with the labeled cleansed data 512 submitted to the crowdsourced data aggregator 528. The performance of the detection engine can be checked, as shown in reference numeral 520. For example, if the speed of the detection engine is improved, the number of false positives is reduced, and / or the number of false negatives is reduced, the detection engine performs better. If the detection engine performs better after adding a new training data set, as shown in reference numeral 522, the cognitive engine is retrained with the new data, as shown in reference numeral 534, and the cognitive engine 538 is ready for detecting non-compliant code, generating compliant code, and verifying compliant code in the CI / CD pipeline. As shown in reference numeral 536, the trust score of the submitter is increased and provided to the crowdsourced data aggregator 528. However, if the engine performance does not perform better after adding the new training data set, the training data is rejected as shown in reference numeral 524, and the trust score of the submitter is reduced as shown in reference numeral 526 and provided to the crowdsourced data aggregator 528.

[0064] In addition, homomorphic encryption (HE) can be used by a crowdsourced data aggregator for crowdsourced data used by cognitive modules to share data without exposing unencrypted crowdsourced data. Crowdsourced data aggregator 528 can submit labeled sanitized data 512 to HE processing engine 532 to encrypt labeled sanitized data 512 and then provide encrypted labeled sanitized data 512 including compliant code for security vulnerabilities to the customer. HE processing engine 532 also provides an encrypted risk score 530, which is given to the customer as an unencrypted risk score 514, which indicates the risk level of using the encrypted compliant code from the crowdsourced.

[0065] In addition, the crowdsourced data aggregator 528 can store the crowdsourced data on the blockchain. Contributors of the crowdsourced data will have the option of, for example, setting a cryptocurrency address associated with the contributed submission, and this provides an incentive for companies to share the best solutions they research and develop. Another company can use the submission and prevent an attempted attack, saving the company millions of dollars. By including a smart contract in the blockchain, the company can automatically pay the contributor of the submission a small reward for their contribution.

[0066] For example, Company A can define a way to check for and block a serious new vulnerability that allows an attacker to download all customer data from a web database. When Company A shares the solution with a crowdsourced data aggregator on the blockchain, its cryptocurrency address is linked to the submission. A week later, Company B’s intrusion detection system detects a failed attack in which someone attempted to hack into the database, and the submission shared by Company A prevented this attack. By including a smart contract in the submission, Company A can automatically receive a specific amount as a reward for their contribution and the amount Company B saved.

[0067] Figure 6-8 Flowcharts and / or block diagrams of the architecture, functions, and operations that may be implemented by systems, methods, and computer program products according to various embodiments of the present invention are shown. As described above with respect to any flow chart, depending on the technology involved, operations may be performed in an order different from the order shown in a given flow chart. For example, again depending on the technology involved, two operations shown in consecutive flow chart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that at least partially overlaps in time. And depending on the functions involved, some of the boxes shown may be executed without executing other boxes.

[0068] Figure 6 A flow chart of an exemplary method according to various aspects of the present invention is shown. The steps of the method may be Figure 2 Execute in the environment and refer to Figure 2 Specifically, Figure 6 The flowchart of FIG. 1 illustrates an exemplary method for generating compliant code to update code in a CI / CD pipeline to follow compliance rules and policies according to aspects of the present invention.

[0069] In step 602, the system receives compliance rules and policies. For example, there may be a compliance rule for database security that specifies that a verified password is required to access a particular database. As another example, there may be a compliance rule that specifies that a firewall for wireless access is configured with specific parameters in edge computing that are not default parameters. In an embodiment, the cognitive module includes a machine learning model that uses a long short-term memory (LSTM) algorithm that is initially trained with positive examples of code that follows the compliance rules (such as code that has a database access request after receiving a valid password for accessing a database) and counter-examples of code that does not follow the compliance rules (such as code that has a database access request without receiving a valid password for accessing a database). The cognitive module can process the code accordingly and detect code that does not follow the compliance rules. In an embodiment, and as described with reference to Figure 2 As described, the cognitive module 210 receives the compliance rules and policies in the compliance rules and policies file 240. Those skilled in the art will appreciate that the machine learning model may use other recurrent neural network algorithms, including a gated recurrent unit (GRU).

[0070] At step 604, the system receives and processes source code. For example, source code in a CI / CD development pipeline can be input into a cognitive module for processing and detecting non-compliant code. When processing the source code, features are extracted from the source code and compared with features in a machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the source code. In various embodiments, and as described in reference Figure 2 As depicted, cognitive module 210 receives and processes source code 230 .

[0071] At step 606, the system receives and processes the IaC code. For example, the IaC code in the CI / CD development pipeline can be input into the cognitive module for processing and detecting non-compliant code. When processing the IaC code, features are extracted from the IaC code and compared with features extracted from examples of non-compliant code during training in the machine learning model to detect non-compliant code in the IaC code. In an embodiment, and as described in reference Figure 2 As depicted, cognitive module 210 receives and processes IaC code 232 .

[0072] At step 608, the system receives and processes the playbook. For example, a playbook in a CI / CD development pipeline can be input into a cognitive module for processing and detecting non-compliant code. When processing the playbook, features are extracted from the playbook and compared with features extracted from examples of non-compliant code during training in a machine learning model to detect non-compliant code in the playbook. In various embodiments, and as described in reference Figure 2As depicted, the cognitive module 210 receives and processes the practical manual 234 .

[0073] At step 610, the system receives and processes other pipeline configuration files in addition to the playbook. For example, other pipeline configuration files in the CI / CD development pipeline can be input into the cognitive module for processing and detecting non-compliant code. When processing the pipeline configuration file, features are extracted from the pipeline configuration file and compared with features extracted from examples of non-compliant code during training in the machine learning model to detect non-compliant code in the pipeline configuration file. In an embodiment, and as described in reference Figure 2 As depicted, the cognitive module 210 receives and processes the pipeline configuration file 238 .

[0074] At step 612, the system receives and processes the runtime processing logs. For example, runtime processing logs in a CI / CD development pipeline, including pipeline logs generated during testing in the CI / CD development pipeline, can be input into the cognitive module for processing and detecting non-compliant code. When processing the runtime processing logs, features are extracted from the runtime processing logs and compared with features extracted from examples of non-compliant code during training in the machine learning model to detect non-compliant code in the runtime processing logs. In various embodiments, and as described in reference Figure 2 As depicted, cognitive module 210 receives and processes runtime processing log 242 .

[0075] At step 614, the system generates compliant code for non-compliant code detected during code processing. For example, the cognitive module 210 can generate code or scripts to update non-compliant code detected by the machine learning model when processing source code, IaC code, utility manuals, other pipeline configuration files, and runtime processing logs. The system can append compliant code to the file where the non-compliant code was detected. And the system can verify that the code file with the attached compliant code follows the security and compliance policies. In various embodiments, and as described in reference Figure 2 As depicted, cognitive module 210 generates compliant code 236 for non-compliant code detected during code processing.

[0076] Figure 7 A flow chart of an exemplary method according to various aspects of the present invention is shown. The steps of the method may be Figure 2 Execute in the environment and refer to Figure 2 to describe the elements described in, in particular, Figure 7 The flowchart of FIG. 1 illustrates an exemplary method for updating a cognitive engine using customer data according to aspects of the present invention.

[0077] At step 702, the system receives customer test data. For example, the customer data may be marked as examples of source code, IaC code, and / or other pipeline configuration code that have identified security vulnerabilities. In addition, the customer test data may also include updated code that fixes the security vulnerabilities. In an embodiment, and as described in reference Figure 2 As described, the test awareness module 222 receives customer test data.

[0078] At step 704, the system receives quality test data. The quality test data is managed to establish a benchmark for test results used to test the performance of the test cognitive module trained using the customer test data. In an embodiment, and as described in reference Figure 2 As depicted, the test awareness module 222 receives quality test data.

[0079] At step 706, the system trains the test cognitive module using the customer test data as training data. The test cognitive module includes a machine learning model using an LSTM algorithm that was initially trained with quality test data that includes positive examples of code that complies with compliance rules and negative examples of code that does not comply with compliance rules. The system trains the test cognitive model with the customer data, which may include positive examples of code that does not have the identified security vulnerability and / or negative examples of code that has the identified security vulnerability. In an embodiment, and as described with reference to Figure 2 As described, the server 206 trains the test cognitive module 222 using the client test data as training data.

[0080] At step 708, the system determines whether detection in the test cognitive module is improved after training using the customer test data as training data. For example, if the detection speed is improved, the number of false positives is reduced, and / or the number of false negatives is reduced, then the test cognitive module is performing better. If detection in the test cognitive module is not improved, then at step 710 the system rejects the training data and the process ends. If detection in the test cognitive module is improved, then the steps of the exemplary method are continued at step 712. In an embodiment, and as described with reference to Figure 2 As described, the server 206 determines whether detection in the test cognitive module 222 is improved after training with the client test data as training data.

[0081] At step 712, the system retrains the cognitive module using the customer test data as training data. In one embodiment, the machine learning model of the cognitive module uses an LSTM algorithm and is trained with customer data, which may include positive examples of code that does not have the identified security vulnerability and / or negative examples of code that has the identified security vulnerability. In an embodiment, and as described in reference Figure 2As described, server 206 trains cognitive module 210 using client test data as training data.

[0082] At step 714, the system saves the retrained cognitive module and, in embodiments, the customer training data. In addition to learning security vulnerabilities through training, the cognitive module can learn as it processes code throughout iterations of code development in a CI / CD pipeline for a single enterprise. In this way, the cognitive module can be customized by and for a single enterprise. In embodiments, and as described with reference to Figure 2 As described, the server 206 stores the retrained cognitive module 210 in a directory such as a reference directory. Figure 1 The updated cognitive engine is then stored in the persistent storage of the described persistent storage 113. And the updated cognitive engine is ready for detecting non-compliant code, generating compliant code, and verifying compliant code in the CI / CD pipeline.

[0083] Figure 8 A flow chart of an exemplary method according to various aspects of the present invention is shown. The steps of the method may be Figure 2 Executed in an environment with reference to Figure 2 The elements depicted in the figure are described, in particular, Figure 8 The flowchart of FIG. 1 illustrates an exemplary method for updating a cognitive engine using crowdsourced data according to aspects of the invention.

[0084] At step 802, the system receives crowdsourced test data. For example, the crowdsourced test data may be labeled as examples of source code, IaC code, and / or other pipeline configuration code that have identified security vulnerabilities. In addition, the crowdsourced test data may also include updated code that fixes security vulnerabilities. The crowdsourced test data may be cleansed to anonymize customer-specific information, and the tags may be standardized to provide labeled cleansed data. In an embodiment, and as described with reference to Figure 2 As described, the test awareness module 222 receives crowdsourced test data.

[0085] At step 804, the system trains the test cognitive module using the crowdsourced training data. The test cognitive module includes a machine learning model using an LSTM algorithm, and the system trains the test cognitive model using the crowdsourced training data, which may include positive examples of code without the identified security vulnerability and / or negative examples of code with the identified security vulnerability. In an embodiment, and as described with reference to Figure 2 As depicted, server 206 trains test cognitive module 222 using crowdsourced training data.

[0086] At step 806, the system determines whether detection in the test cognitive module is improved after training using the crowdsourced training data. For example, if the detection speed is improved, the number of false positives is reduced, and / or the number of false negatives is reduced, then the test cognitive module performs better. If detection in the test cognitive module is not improved, the system rejects the training data at step 808 and continues to perform the steps of the exemplary method at step 810. If detection in the test cognitive module is improved, then the steps of the exemplary method are continued at step 812. In an embodiment, and as described with reference to Figure 2 As described, the server 206 determines whether detection in the test cognitive module 222 is improved after training using the crowdsourced training data.

[0087] At step 810, since the detection in the test cognitive module was not improved, the system reduces the trust score of the submitter, and continues to perform the steps of the exemplary method at step 818. The trust score enables and supports setting a threshold for selecting submitters of crowdsourced updates to be included in future integrations. In an embodiment, and as described with reference to Figure 2 As described, when no improvement is detected in the test cognitive module 222 after training using the crowdsourced training data, the server 206 lowers the submitter's trust score.

[0088] At step 812, if detection was improved in the testing cognitive module at step 806, the system retrains the cognitive module using crowdsourced training data. In an embodiment, the machine learning model of the cognitive module is trained using an LSTM algorithm and using crowdsourced training data, which may include positive examples of code without the identified security vulnerability and / or negative examples of code with the identified security vulnerability. In an embodiment, and as described with reference to Figure 2 As depicted, server 206 trains cognitive module 210 using crowdsourced training data.

[0089] At step 814, the system saves the retrained cognitive module and, in an embodiment, saves the crowdsourced training data. In an embodiment, and as described in reference Figure 2 As described, the server 206 stores the retrained cognitive module 210 in a directory such as a reference directory. Figure 1 The described persistent storage 113 is stored in a persistent storage, and the updated cognitive engine is ready for detecting non-compliant code, generating compliant code, and verifying compliant code in a CI / CD pipeline.

[0090] At step 816, the system increases the trust score of the submitter. In an embodiment, and as described with reference to Figure 2As described, after training using crowdsourced training data, when detection in the test cognitive module 222 is improved, the server 206 increases the trust score of the submitter. And in step 818, the system saves the trust score of the submitter. In an embodiment, and as described with reference to Figure 2 As described, server 206 stores the trust score of the submitter.

[0091] In this way, new or updated solutions for identifying security vulnerabilities in embodiments of the present disclosure are evaluated by testing the cognitive engine. Solutions that improve the company's overall security posture may be adopted, while those that do not are discarded. Advantageously, the cognitive engine can use crowdsourced anonymized data to provide immediate training and value to new implementers of embodiments of the present disclosure. Furthermore, embodiments of the present disclosure enable the inclusion of best-incubated solutions on an ongoing basis, whether developed internally or externally by other companies.

[0092] In an embodiment, a service provider may provide for performing the processes described herein. In this case, the service provider may create, maintain, deploy, support, etc., a computer infrastructure that performs the process steps of the present invention for one or more customers. These customers may be, for example, any business that uses the technology. In return, the service provider may receive payment from the customer(s) under a subscription and / or fee agreement, and / or the service provider may receive payment from the sale of advertising content to one or more third parties.

[0093] In another embodiment, the present invention provides a computer-implemented method via a network. In this case, a method such as Figure 1 The computer infrastructure of computer 101 of the present invention can be used to obtain (e.g., create, purchase, use, modify, etc.) one or more systems for performing the processes of the present invention and deploy them to the computer infrastructure. In this sense, the deployment of the system can include one or more of the following: (1) downloading from a computer readable medium on a computer such as Figure 1 (1) installing program code on a computing device of computer 101; (2) adding one or more computing devices to the computer infrastructure; and (3) merging and / or modifying one or more existing systems of the computer infrastructure to enable the computer infrastructure to perform the process of the present invention.

[0094] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method comprising: receiving, by a processor, a plurality of infrastructure-as-code files that specify configuration of a runtime environment for a deployable image of source code in a continuous integration and continuous delivery pipeline for a cloud platform; generating, by the processor, compliant code for at least one of the plurality of infrastructure-as-code files; building, by the processor, the deployable image of the source code in the continuous integration and continuous delivery pipeline according to the configuration specified by the plurality of infrastructure-as-code files and the compliant code; as well as An instance of the image is deployed, by the processor, in the runtime environment.

2. The method according to claim 1, further comprising: The source code is received by the processor in the continuous integration and continuous delivery pipeline for the cloud platform.

3. The method according to claim 2, wherein: The source code is selected from the group consisting of: source code of a serverless function, source code of a microservice, and source code of an API gateway.

4. The method according to claim 1, further comprising: The compliance code is appended to the at least one file.

5. The method according to claim 1, further comprising: receiving, by the processor, compliance rules of a security and compliance policy; as well as Code that does not comply with compliance rules is detected, by the processor, in at least one of the plurality of infrastructure-as-code files.

6. The method according to claim 1, further comprising: generating, by the processor, additional compliance code for the source code; as well as The source code and the additional conforming code are compiled by the processor.

7. The method according to claim 1, further comprising: Verifying, by the processor, that the plurality of infrastructure-as-code files having the compliant code adhere to security and compliance policies.

8. The method according to claim 1, further comprising: inputting, by the processor, features of each of the plurality of infrastructure-as-code files into a machine learning model; as well as The processor detects, from the machine learning model, at least one file among the plurality of infrastructure-as-code files that does not comply with the compliance rule of the security and compliance policy.

9. The method according to claim 8, wherein: The machine learning model uses a Long Short-Term Memory (LSTM) algorithm, which is initially trained with positive examples of a code that follows compliance rules and negative examples of another code that does not follow the compliance rules.

10. The method according to claim 9, wherein: Positive examples of the code that follows the compliance rule and negative examples of the other code that does not follow the compliance rule are crowdsourced.

11. The method according to claim 8, wherein: The detecting includes comparing, by the machine learning model, features of each of the plurality of infrastructure-as-code files with features extracted from counterexamples of code that do not follow compliance rules.

12. The method according to claim 1, wherein: The plurality of infrastructure-as-code files include one or more playbooks.

13. A computer program product comprising one or more computer-readable storage media on which are stored program instructions, the program instructions being executable to: inputting features of each of a plurality of code files in a continuous integration and continuous delivery pipeline for a cloud platform into a machine learning model, the machine learning model being trained using test data including examples of non-compliant code having security vulnerabilities; detecting, by the machine learning model, non-compliant code in at least one code file of the plurality of code files in the continuous integration and continuous delivery pipeline for the cloud platform; Building a deployable image of source code in the continuous integration and continuous delivery pipeline according to a configuration of a runtime environment specified by the plurality of code files, the image including the at least one code file of the plurality of code files, the at least one code file containing compliant code that fixes the security vulnerability; as well as An instance of the image is deployed in the runtime environment.

14. The computer program product of claim 13, wherein: The plurality of code files include infrastructure-as-code files.

15. The computer program product of claim 13, wherein: The program instructions are further executable to generate the compliant code for the at least one code file of the plurality of code files.

16. The computer program product of claim 13, wherein: The source code is selected from the group consisting of: source code of a serverless function, source code of a microservice, and source code of an API gateway.

17. A system comprising: A processor group, one or more computer-readable storage media, and program instructions stored collectively on the one or more computer-readable storage media, the program instructions executable to: detecting code that does not comply with compliance rules of a security and compliance policy in at least one of a plurality of infrastructure-as-code files in a continuous integration and continuous delivery pipeline for a cloud platform; appending compliant code that complies with the compliance rules of the security and compliance policy to the at least one file of the plurality of infrastructure-as-code files; as well as According to the configuration of the runtime environment specified by the plurality of infrastructure-as-code files, a deployable image of source code is deployed in the continuous integration and continuous delivery pipeline in the runtime environment, the image including the at least one file to which the compliant code following the compliance rules is attached.

18. The system of claim 17, wherein: The program instructions are further executable to generate the compliant code for the at least one file of the plurality of infrastructure-as-code files.

19. The system of claim 17, wherein: The program instructions are further executable to verify that the plurality of infrastructure-as-code files comply with compliance rules of the security and compliance policy, the plurality of infrastructure-as-code files including the at least one file to which the compliance code complying with the compliance rules is appended.

20. The system of claim 17, wherein: The program instructions executable to detect code include program instructions executable to apply LSTM analysis of the code in a machine learning model trained using crowdsourced data.

Images