System and method for automatically calculating recovery metrics with real-time telemetry and proposing recovery plans

Abstract

Various methods, apparatus / systems and media are provided for understanding the recovery of business services due to a loss of availability occurring in an information technology infrastructure. The system and method of the present invention automatically predicts or detects the probability of an availability incident and improves the determination of the severity of the incident based on technology component attribute data, incident history data or other metadata by using machine learning models to determine the associated risk and impact, and the machine learning models go into an alert state to determine the capacity requirements / availability of alternative affected infrastructure and initiate the orchestration of recovery, total recovery time, and potential data loss.

Description

Related Applications

[0001] This application claims the benefit of priority to U.S. Provisional Patent Application No. 63 / 189,881, filed May 18, 2021, the entirety of which is incorporated herein by reference. [Technical field]

[0002] The present disclosure relates generally to information technology (IT), and more particularly to a method and apparatus for implementing or realizing a smart simulation recovery module that automatically estimates the total recovery time and amount of data loss that may occur in recovering an application, infrastructure, or business process that may require reconstructing and recovering an application or group of applications supporting that business process due to a destructive malware attack or the event of such an attack, delayed system maintenance, or unforeseen system failure. [Background technology]

[0003] The developments described in this section are known to the inventors, but unless otherwise noted, it should not be assumed that any development described in this section constitutes prior art or that such developments are known to those of skill in the art merely by virtue of their inclusion in this section.

[0004] As today's IT environment grows rapidly, so does the threat and regulatory backdrop. Organizationally-critical entities may need to understand the time and cost impacts of recovery of critical business services and processes, including IT. Business processes and services are typically comprised of interwoven technology, people, and processes across business units, support teams, and management. It is essential for organizationally-critical entities to ensure that they can predict the time to recovery of a business service or process or other organizationally-critical unit-of-measure to a reliable state and compare it against a Recovery Time Objective (RTO) and / or industry-standard recovery metrics, to ensure that technology recovery issues can be remedied before recovery times exceed RTOs and become incidents. Summary of the Invention [Problem to be solved by the invention]

[0005] Business organizations within organizationally critical institutions may ascertain technology recovery through various attributes such as business product recovery, technology product recovery, business process recovery, technology component recovery, etc. Telemetry data and metadata provided by the organizational system of record may enable them to predict recovery times such as analyzed return to business, recovery point objectives, MTBF (mean time before failure), MTTR (mean time to recover, repair, respond or resolve), MTTA (mean time to confirmation), and MTTF (mean time to failure) to build new recovery capabilities and act to increase the resilience of organizationally critical institutions. Thus, it is believed that a need exists for systems and methods to predict technology recovery times based on business requirements and determine potential risks and impacts to increase business resilience and propose or implement automated recovery strategies. [Means for solving the problem]

[0006] The present disclosure, through one or more aspects and / or embodiments and / or specific configurations or subcomponents, provides, among other things, various systems, servers, devices, methods, media, programs, and platforms for implementing a smart simulation recovery module that automatically estimates the total recovery time and amount of data loss required to recover an application, infrastructure, or business process that may occur when an application or a group of applications supporting a business process, including IT, must be rebuilt and restored due to a destructive malware attack or the event of such an attack. In an exemplary embodiment, the amount of data loss may be an index that requires calculation. One example of the purpose of the present disclosure is to determine the impact on an application, infrastructure, or service.

[0007] For example, but not limited to, the present disclosure, through one or more various aspects and / or embodiments and / or specific configurations or subcomponents, also provides various systems, servers, devices, methods, media, programs, and platforms for implementing a smart simulation recovery module that implements an active machine learning module configured to receive and maintain current and historical application data, asset data, data recovery data, business process data, technical product data, application transaction data, incident and change management data, and threat intelligence data to calculate recovery capability / recovery indicators for critical business processes and services. The active machine learning module may be configured to monitor critical business processes and services to identify potential operational risks, where expected recovery times are not consistent with actual recovery times due to regulations, business objectives, technical designs, or suboptimal business processes, but not limited to, the present disclosure. The active machine learning module may be further configured to identify the business processes or services to calculate the potential operational risks for the entire company or organizational units and to launch an orchestration engine to prepare for recovery when a potential availability incident is detected.

[0008] The present disclosure, through one or more various aspects and / or embodiments and / or specific configurations or subcomponents, also provides various systems, servers, devices, methods, media, programs, and platforms for implementing a smart simulation recovery module that may be configured to provide automatic adjustment based on important telemetry data, such as backup information including last known good state (trusted state), changes in technology capabilities, and time of event, among others. In addition, the smart simulation recovery module may be further configured to automatically schedule recovery tests to validate simulation results based on important criteria. Similarly, the smart simulation recovery module may be further configured to allow users to select different time periods for disruptive events and adjust the recovery capabilities of the application based on future solutions. In this way, the smart simulation recovery module may provide a platform for application and / or business operations teams to review the possible impacts of transitioning to new technologies on the application.

[0009] In one aspect of the disclosure, a method is disclosed for automatically predicting and analyzing recovery time to a reliable state of an application, infrastructure, or business process using real-time telemetry with one or more processors and one or more memories, the method may include: establishing a communication link between a plurality of data sources and an event bus, implementing a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure or business process from the plurality of data sources via the event bus, using the machine learning model to automatically predict a probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data, determining an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure or business process must be rebuilt and / or restored in the event of a destructive attack, and dynamically providing an estimate of a total recovery time and / or a total rebuild time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0010] In other aspects of the present disclosure, the plurality of real-time telemetry data may include, but is not limited to, application data, asset data, data resiliency data, business process data, technology product data, application transaction data, and threat intelligence data for calculating resiliency capabilities and / or recovery metrics of critical infrastructure or business processes and services.

[0011] In a further aspect of the present disclosure, the method may further comprise monitoring the critical infrastructure or the business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0012] In yet another aspect of the present disclosure, the method may further include automatically detecting the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data, and performing automatic functionality repair and / or functionality modification based on the inferred data in response to the destructive attack event.

[0013] In a further aspect of the present disclosure, the method may further comprise initiating a fully autonomous remediation process of the affected environment in response to the destructive attack event.

[0014] In other aspects of the present disclosure, the event bus may be configured to provide one or more communication channels between technical asset data sources, application transaction data sources, and threat intelligence data sources to analyze and execute remediation actions in real time, although the present disclosure is not limited thereto.

[0015] In yet another aspect of the present disclosure, the method may further include, upon receiving the plurality of real-time telemetry data, dynamically tracking information asset data within an organization, dynamically tracking the application or applications within the organization, and dynamically tracking resilience and recovery attribute data of technology products used in the organization.

[0016] In a further aspect of the present disclosure, the method may further comprise recording pending infrastructure or business related changes, affected assets, implementation timeframes, and an assessment of human-based risks and impacts in determining the associated risk and impact of the amount of data loss.

[0017] In other aspects of the present disclosure, the machine learning model may be configured to go into an alert state, determine the capacity requirements and / or availability of alternative affected infrastructure, and initiate the orchestration of recovery, the total recovery time, and the amount of data loss, although the present disclosure is not limited thereto.

[0018] In yet another aspect of the present disclosure, the method may further include automatically providing simulation results of recovery and automatically scheduling a recovery test to verify the simulation results.

[0019] In a further aspect of the present disclosure, the machine learning model may be further configured to identify business processes or services to calculate potential business risk to the entire organization or organizational units when a potential availability incident is detected, and to trigger an orchestration engine to perform recovery.

[0020] In another aspect of the present disclosure, the method may further comprise preparing a centralized repository of historical recovery incident data as an input for the probabilistic data used in predictive recovery analysis, the centralized repository mapping application inventory to business operations modules to determine upstream and / or downstream availability impacts to improve decision making, the business operations modules configured to identify business processes, services, products, and their importance to the organization's business operations.

[0021] In yet another aspect of the present disclosure, the method may further comprise performing one or more of a recovery process to rebuild the application or the group of applications, a recovery process to a last known trusted state of the application or the group of applications, and a simulation / testing of the recovery process.

[0022] In one aspect of the present disclosure, a system for automatically predictively analyzing recovery time to a reliable state of an application, infrastructure, or business process using real-time telemetry is disclosed, which may include a processor and a memory operatively connected to the processor via a communication interface and storing computer-readable instructions that, when executed, may cause the processor to perform the following steps: establish a communication link between a plurality of data sources and an event bus; implement a machine learning model configured to receive a plurality of real-time telemetry data and historical event data related to an application or applications supporting an infrastructure or business process from the plurality of data sources via the event bus; use the machine learning model to automatically predict probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data; determine, based on the probability data, an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure or business process must be rebuilt and / or restored in the event of a destructive attack; and dynamically provide an estimate of a total recovery time and / or a total rebuild time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0023] In a further aspect of the present disclosure, the processor is further configured to monitor the critical infrastructure or the business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0024] In yet another aspect of the present disclosure, the processor is further configured to automatically detect the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data, and in response to the destructive attack event, perform automatic functionality repairs and / or functionality modifications based on the inferred data.

[0025] In a further aspect of the present disclosure, the processor is further configured to initiate a fully autonomous remediation process for the affected environment in response to the destructive attack event.

[0026] In yet another aspect of the present disclosure, the processor, upon receiving the plurality of real-time telemetry data, is further configured to dynamically track information asset data within an organization, dynamically track the application or applications within the organization, and dynamically track resilience and recovery attribute data of technology products used in the organization.

[0027] In a further aspect of the present disclosure, the processor is configured to, in determining the associated risk and the impact of the amount of data loss, further record pending infrastructure or business related changes, affected assets, implementation timeframes, and an assessment of human induced risks and impacts.

[0028] In yet another aspect of the present disclosure, the processor is further configured to automatically generate simulation results of recovery and automatically schedule recovery tests to verify the simulation results.

[0029] In another aspect of the present disclosure, the processor is further configured to prepare a centralized repository of past recovery incident data as an input for the probabilistic data used in predictive recovery analysis, the centralized repository mapping application inventory to business operations modules to determine upstream and / or downstream availability impacts to improve decision making, the business operations modules configured to identify business processes, services, products, and their importance to the organization's business operations.

[0030] In yet another aspect of the present disclosure, the processor is further configured to execute one or more of a recovery process to rebuild the application or the group of applications, a recovery process to a last known trusted state of the application or the group of applications, and a simulation / testing of the recovery process.

[0031] In one aspect of the present disclosure, a non-transient computer-readable medium configured to store instructions for automatically predictively analyzing recovery time to a reliable state of an application, infrastructure, or business process through real-time telemetry is disclosed, which, when executed, may cause a processor to perform the following steps: establish a communication link between a plurality of data sources and an event bus; implement a machine learning model configured to receive from the plurality of data sources via the event bus a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure or business process; use the machine learning model to automatically predict probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data; determine, based on the probability data, an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure or business process must be rebuilt and / or restored in the event of a destructive attack; and dynamically provide an estimate of a total recovery time and / or a total rebuild time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0032] In a further aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform a procedure for monitoring the critical infrastructure or the business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0033] In yet another aspect of the present disclosure, the instructions, when executed, may further cause the processor to automatically detect the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data, and to perform automatic functionality repair and / or functionality modification based on the inferred data in response to the destructive attack event.

[0034] In a further aspect of the present disclosure, the instructions, when executed, may further cause the processor to execute a procedure for initiating a fully autonomous remediation process for an affected environment in response to the destructive attack event.

[0035] In yet another aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform, upon receiving the plurality of real-time telemetry data, dynamically tracking information asset data within an organization, dynamically tracking the application or applications within the organization, and dynamically tracking resilience and recovery attribute data of technology products used in the organization.

[0036] In a further aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform a procedure of recording pending infrastructure or business related changes, affected assets, implementation timeframes, and an assessment of human-based risks and impacts in determining the associated risk and the impact of the amount of data loss.

[0037] In yet another aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform steps of automatically providing simulation results of recovery and automatically scheduling recovery tests to verify the simulation results.

[0038] In another aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform steps of preparing a centralized repository of past recovery incident data as an input for the probabilistic data used in predictive recovery analysis, the centralized repository mapping application inventory to business operations modules to determine upstream and / or downstream availability impacts to improve decision making, the business operations modules configured to identify business processes, services, products, and their importance to an organization's business operations.

[0039] In yet another aspect of the present disclosure, the instructions, when executed, may further cause the processor to perform one or more of a recovery process to rebuild the application or the group of applications, a recovery process to a last known trusted state of the application or the group of applications, and a simulation / testing of a recovery process.

[0040] Further explanation of the present disclosure will be given in the following detailed description by way of non-limiting examples of preferred embodiments of the present disclosure, with reference to the following figures, in which like reference numerals refer to like structures / components throughout the various figures: [Brief description of the drawings]

[0041] [Figure 1] FIG. 2 illustrates components of a computer system that implements a smart simulation recovery module in one exemplary embodiment. [Diagram 2] FIG. 1 illustrates an example of a network environment including a smart simulation recovery device in an exemplary embodiment. [Diagram 3] FIG. 1 is a system diagram illustrating an architecture for implementing a smart simulation recovery device with a smart simulation recovery module in an exemplary embodiment. [Figure 4]FIG. 4 is a system diagram illustrating the major components that implement the smart simulation recovery module of FIG. 3 in one exemplary embodiment. [Diagram 5] FIG. 5 illustrates an example architecture for automated predictive analysis of information technology (IT) process recovery through real-time telemetry, as implemented by the smart simulation recovery module of FIG. 4 in an exemplary embodiment. [Figure 6] FIG. 2 is an end-to-end flow diagram illustrating an implementation of a smart simulation recovery module in an exemplary embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0042] One or more of the various aspects and / or embodiments and / or particular configurations or subcomponents of the present disclosure are intended to provide one or more of the advantages detailed above and / or below.

[0043] Also, the examples may be embodied as one or more non-transitory computer-readable mediums having stored thereon instructions for one or more aspects of the technology as illustrated and described in the examples herein, in some examples, the instructions including executable code that, when executed by one or more processors, causes the processors to perform the steps necessary to implement the method of the examples of the technology as illustrated and described herein.

[0044] The illustrated embodiments are illustrated and described in terms of functional blocks and / or units and / or modules, as is customary in the field of the present disclosure. Those skilled in the art will appreciate that such blocks and / or units and / or modules are physically realized by electronic circuits (or optical circuits), such as logic circuits, discrete components, microprocessors, hardwired circuits, memory elements, wiring connections, etc., that may be formed by semiconductor-based fabrication techniques or other fabrication techniques. When the blocks and / or units and / or modules are realized by a microprocessor or the like, the microprocessor or the like may be programmed with software (e.g., microcode, etc.) that performs various functions described herein, and may be driven by firmware and / or software in some cases. Additionally, each block and / or unit and / or module may be realized as dedicated hardware, or a combination of dedicated hardware that performs some functions and a processor (e.g., one or more programmed microprocessors and associated circuits, etc.) that performs other functions. In addition, each block and / or unit and / or module of each illustrated embodiment may be physically divided into two or more interacting separate blocks and / or units and / or modules without departing from the scope of the concept of the present invention. Furthermore, the blocks and / or units and / or modules of each illustrated embodiment may be physically combined into a more complex block and / or unit and / or module without departing from the scope of the present disclosure.

[0045] 1 illustrates an example system of hardware and software components with embedded firmware that may be used to implement a smart simulation recovery module for automated, predictive analysis of information technology (IT) process recovery to a reliable state using real-time telemetry in accordance with embodiments described herein. Illustrated generally in FIG. 1 is a system 100 that may include a computer system 102, which may be shown generally as a computer system.

[0046] The computer system 102 may include instructions executable to cause the computer system 102, alone or in conjunction with other devices described, to perform one or more of any of the methods or computer-based functions disclosed herein. The computer system 102 may operate as a standalone device or may be connected to other systems or peripheral devices. For example, the computer system 102 may include or be included within one or more of any computer, server, system, communication network, or cloud environment. For that matter, the instructions may operate in such a cloud-based computing environment.

[0047] When deployed in a network, computer system 102 may operate in the capacity of a server or as a client user's computer in a server-client user network environment, as a client user's computer in a cloud computing environment, or as a peer computer system in a peer-to-peer (or distributed) network environment. Computer system 102, or portions thereof, may be implemented as or incorporated into a variety of devices, such as personal computers, tablet computers, set-top boxes, personal digital assistants, mobile devices, palmtop computers, laptop computers, stationary computers, communications devices, wireless smart phones, personal trusted devices, wearable devices, global positioning satellite (GPS) devices, web appliances, or any other machine capable of executing instructions (either sequential or otherwise) that define operations to be performed by the computer system. Although only one computer system 102 is shown, alternative embodiments may include any collection of systems or subsystems that individually or collectively execute instructions or perform functions. Throughout this disclosure, the term "system" should be interpreted to encompass any collection of systems or subsystems that individually or collectively execute one or more instructions to perform one or more computer functions.

[0048] As shown in FIG. 1, the computer system 102 may include one or more processors 104. The processors 104 are tangible and non-transient. The term "non-transient" as used herein should be interpreted as referring to a state that persists for a period of time, rather than a state that is permanent. Specifically, the term "non-transient" negates the notion of a temporary form, such as a particular carrier wave or signal, that exists only transiently at any time and place. The processor 104 is a component of an article of manufacture and / or machine. The processor 104 is configured to execute software instructions to perform functions as described in the embodiments herein. The processor 104 may be a general-purpose processor or may be part of an application-specific integrated circuit (ASIC). The processor 104 may also be a microprocessor, a microcomputer, a processor chip, a controller, a microcontroller, a digital signal processor (DSP), a state machine, or a programmable logic device. The processor 104 may also be a logic circuit, such as a programmable gate array (PGA), such as a field programmable gate array (FPGA), or other type of circuitry consisting of discrete gates and / or transistor logic. The processor 104 may be a central processing unit (CPU), a graphics processing unit (GPU), or both. Any of the processors described herein may also be comprised of multiple processors, parallel processors, or both. Multiple processors may be included in or connected to a single device, or may be included in or connected to multiple devices.

[0049] The computer system 102 may further comprise a computer memory 106. The computer memory 106 may communicatively comprise a static memory, a dynamic memory, or both. A memory, as described herein, is a tangible storage medium capable of storing data and executable instructions, and is non-transient while the instructions are stored. Again, the term "non-transient" as used herein should be interpreted as referring to the nature of a state that persists for some period of time, rather than the nature of a state being permanent. Specifically, the term "non-transient" negates the nature of a temporary state, such as a particular carrier wave or signal, which exists only transiently at any time and place. The memory is a component of an article of manufacture and / or a machine. A memory, as described herein, is a computer-readable medium from which data and executable instructions can be read by a computer. The memory described herein may be any form of storage medium known in the art, such as random access memory (RAM), read only memory (ROM), flash memory, electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, cache, removable disk, tape, compact disk read only memory (CD-ROM), digital versatile disk (DVD), floppy disk, Blu-ray disk, etc. The memory may be volatile or non-volatile memory, and may be secure and / or encrypted, or non-secure and / or unencrypted. Of course, the computer memory 106 may be any combination of memories or may be a single storage.

[0050] The computer system 102 may further include a display unit 108, such as any known display device, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid state display, a cathode ray tube (CRT), a plasma display, or the like.

[0051] The computer system 102 may further include one or more input devices 110, such as a keyboard, a touch input screen or pad, voice input, a mouse, a remote control device consisting of a wireless keypad, a microphone coupled to a voice recognition engine, a camera such as a video camera or a still camera, a cursor control device, a global positioning system (GPS) device, an altimeter, a gyroscope, an accelerometer, a proximity sensor, or any combination thereof. Those skilled in the art will appreciate that embodiments of the computer system 102 may include more than one input device 110. Additionally, those skilled in the art will appreciate that the above examples of input devices 110 are not exhaustive and that the computer system 102 may include any additional or alternative input device 110.

[0052] Computer system 102 may further include a media reader 112 configured to read any one or more instructions (e.g., software, etc.) from any memory described herein. The instructions may be used to implement one or more of the methods or processes described herein when executed by a processor. In a particular embodiment, the instructions may reside, in whole or at least in part, in memory 106 and / or in media reader 112 and / or in processor 110 while executing on computer system 102.

[0053] Computer system 102 may further include any additional devices, components, parts, peripherals, hardware, software, or any combination thereof, that are commonly understood and known to be included with or within a computer system, such as, but not limited to, a network interface 114, output device(s) 116, etc. Output device(s) 116 may be, but is not limited to, speakers, audio output, video output, remote control output, printer, or any combination thereof.

[0054] The components of the computer system 102 may communicate with each other via a communication link such as a bus 118. As shown in FIG. 1, the components may communicate with each other via an internal bus. However, one skilled in the art would recognize that any of the components may be connected via an expansion bus. Additionally, the bus 118 may be capable of communication according to any commonly understood and known standard, such as, but not limited to, a peripheral component interconnect, a peripheral component interconnect express, a parallel advanced technology attachment, a serial advanced technology attachment, or other standard.

[0055] The computer system 102 may communicate with one or more additional computer devices 120 via a network 122. The network 122 may be any network commonly understood and known in the art, such as, but not limited to, a local area network, a wide area network, the Internet, a telephone network, a WiFi network, a short-range network, etc. The short-range network may be, for example, Bluetooth, Zigbee, infrared, short-range communication, ultraband, or any combination thereof. Those skilled in the art will appreciate that additional understood and known networks 122 may be used in addition or instead, and furthermore, the examples of the network 122 are not limited to or exhaustive above. Also, although the network 122 is depicted as a wireless network in FIG. 1, those skilled in the art will appreciate that the network 122 may be a wired network.

[0056] The further computing device 120 is depicted in FIG. 1 as a personal computer. However, those skilled in the art will appreciate that in alternative embodiments of the present application, the computing device 120 may be any device capable of executing instructions (sequential or otherwise) that define the operations it is to perform, such as a laptop computer, a tablet PC, a personal digital assistant, a mobile device, a palmtop computer, a stationary computer, a communication device, a wireless phone, a personal trusted device, a web appliance, a server, and the like. Of course, those skilled in the art will appreciate that the above devices are merely exemplary, and that the device 120 may be any further device or apparatus that is commonly understood and known in the art and does not depart from the scope of the present application. For example, the computing device 120 may be the same as or similar to the computer system 102. Those skilled in the art will also appreciate that the device may be any combination of devices or apparatuses.

[0057] Of course, those skilled in the art will appreciate that the above-described components of computer system 102 are merely exemplary and not intended to be all-inclusive and / or comprehensive, and the above examples of such components are also merely exemplary and not intended to be all-inclusive and / or comprehensive.

[0058] In embodiments of the present disclosure, the methods described herein may be implemented by a hardware computer system executing a software program. Also, as a non-limiting example embodiment, the implementation may comprise modes of operation including distributed processing, component / object distributed processing, and parallel processing capabilities. A virtual computer system processing may be constructed to implement one or more of the methods or functions described herein, and the processors described herein may be used to support a virtual processing environment.

[0059] As described herein, the embodiments provide an optimal method for implementing a smart simulation recovery module that automatically estimates the total recovery time and amount of data loss required to recover an application, infrastructure, or business process when an application or group of applications supporting a business process, including IT, must be rebuilt and restored due to a destructive malware attack or (hereinafter the same) due to the event of such an attack, but the present disclosure is not limited thereto.

[0060] Please refer to Figure 2, which is a schematic diagram illustrating an example of a network environment 200 for implementing the smart simulation recovery device (SSRD) of the present disclosure.

[0061] In exemplary embodiments, the above-mentioned problems associated with conventional methods and systems may be eliminated by implementing or realizing the SSRD 202 shown in Figure 2 and a smart simulation recovery module that automatically estimates the total recovery time and data loss that may occur in the event of a destructive malware attack that requires the application or applications supporting the business process, including IT, to be rebuilt and restored. For example, the above-mentioned problems associated with conventional methods and systems may be eliminated by implementing or realizing the SSRD 202 shown in Figure 2 and a smart simulation recovery module that implements an active machine learning module configured to receive application data, asset data, data recovery data, business process data, technology product data, application transaction data, and threat intelligence to calculate resiliency / recovery metrics for critical business processes and services.

[0062] The SSRD 202 may be the same as or similar to the computer system 102 described in connection with FIG.

[0063] The SSRD 202 may store one or more applications, which may consist of executable instructions that, when executed by the SSRD 202, cause the SSRD 202 to perform operations, such as sending and receiving network messages, as well as other operations as shown and described below with reference to the figures. The applications may be implemented as modules or components of other applications. The applications may also be implemented as operating system extensions, modules, plug-ins, etc.

[0064] Moreover, the application may operate in a cloud-based computing environment. The application may operate within or as one or more virtual machines or one or more virtual servers that may be operated in the cloud-based computing environment. The application, and even the SSRD 202 itself, may be provided on one or more virtual servers operating in the cloud-based computing environment, rather than being tied to one or more specific physical networked computing devices. The application may operate on one or more virtual machines (VMs) that operate on the SSRD 202. In one or more embodiments of the present technology, the one or more virtual machines that operate on the SSRD 202 may be maintained or managed by a hypervisor.

[0065] In the network environment 200 of Figure 2, an SSRD 202 is connected to a number of server devices 204(1)-204(n), which host a number of data stores 206(1)-206(n), as well as a number of client devices 208(1)-208(n), via one or more communications networks 210. A communications interface of the SSRD 202 (such as, for example, network interface 114 of computer system 102 of Figure 1) operatively connects to and communicates with the SSRD 202 and / or the server devices 204(1)-204(n) and / or the client devices 208(1)-208(n), which are all connected to one another via communications network 210. However, other types and / or numbers of communications networks or systems, with other types and / or numbers of connections and / or configurations between other devices and / or elements, may be used.

[0066] Communications network 210 may be the same as or similar to network 122 described in connection with Figure 1. However, SSRD 202 and / or server devices 204(1)-204(n) and / or client devices 208(1)-208(n) may be connected to each other in another topology. Network environment 200 may also include other network devices known in the art (and thus not described herein), such as, for example, one or more routers and / or switches.

[0067] By way of example only, communication network 210 may include one or more local area networks (LANs) or one or more wide area networks (WANs) and may utilize Ethernet or industry standard protocol TCP / IP, although other types and / or numbers of protocols and / or communication networks may be utilized. Communication network 202 of this example may utilize any suitable interface mechanism or network communication technology, such as, for example, any suitable form of communication traffic (e.g., voice, modem, etc.), the Public Switched Telephone Network (PSTN), an Ethernet-based Packet Data Network (PDN), or combinations thereof.

[0068] SSRD 202 may be a standalone device or may be integrated with one or more other devices or apparatus (e.g., one or more of server devices 204(1)-204(n)). In one particular example, SSRD 202 may be hosted on one of server devices 204(1)-204(n), although other configurations are possible. Additionally, one or more units of SSRD 202 may be located within the same or different communications networks, such as one or more public, private, or cloud networks.

[0069] The multiple server devices 204(1)-204(n) may be the same as or similar to the computer system 102 and computer device 120 described in relation to FIG. 1, and may have any configuration or combination of configurations described in relation to the same figure. For example, any of the server devices 204(1)-204(n) may have one or more processors, memories, communication interfaces, etc., which may be connected to each other by a communication link such as a bus. However, other numbers and / or types of network devices may be used. The server devices 204(1)-204(n) of this example may process requests received from the SSRD 202 via the communication network 210, for example, in accordance with HTTP-based and / or JavaScript Object Notation (JSON) protocols. However, other protocols may be used.

[0070] Server devices 204(1)-204(n) may be hardware or software, or may be a system with multiple servers in a pool that may be an internal or external network. Server devices 204(1)-204(n) host data stores 206(1)-206(n) configured to store metadata, data quality rules, and newly generated data.

[0071] Although server devices 204(1)-204(n) are depicted as individual devices, one or more of the processes of each server device 204(1)-204(n) may be distributed to one or more separate network computing devices that collectively constitute one or more of server devices 204(1)-204(n). Additionally, server devices 204(1)-204(n) are not limited to any particular configuration. That is, server devices 204(1)-204(n) may be comprised of multiple network computing devices operating in a master / slave approach, where any one of server devices 204(1)-204(n) operates to manage and / or coordinate the operation of the remaining network computing devices.

[0072] The server devices 204(1)-204(n) may operate as multiple network computing devices in, for example, a cluster architecture, a peer-to-peer architecture, a virtual machine, or a cloud architecture. In other words, the technology disclosed in this specification should not be construed as being limited to a single environment, and other configurations and architectures are also contemplated.

[0073] Client devices 208(1)-208(n) may also be the same as or similar to computer system 102 or computing device 120 described in connection with Figure 1 and may have any configuration or combination of configurations described in connection with that figure. As used herein, a "client device" refers to any computing device that interfaces with communications network 210 to obtain resources from one or more server devices 204(1)-204(n) or other client devices 208(1)-208(n).

[0074] In example embodiments, example client devices 208(1)-208(n) may comprise any type of computing device capable of supporting implementation of SSRD 202, which may be configured to implement a smart simulation recovery module that automatically estimates the total recovery time and amount of data loss required to recover an application, infrastructure, or business process in the event that an application or applications supporting a business process, including IT, must be rebuilt and restored in the event of a destructive malware attack, although the disclosure is not limited thereto.

[0075] Thus, client devices 208(1)-208(n) may be mobile computing devices, stationary computing devices, laptop computing devices, tablet computing devices, virtual machines (including cloud-based computers), etc., hosting document collaborative software such as, for example, chat applications, email applications, voice-to-text applications, etc.

[0076] Client devices 208(1)-208(n) may execute an interface application, such as a standard web browser, a standalone client application, or the like, that may provide an interface for communicating with SSRD 202 via communications network 210 to communicate user requests. Client devices 208(1)-208(n) may further include a display device (e.g., a display screen, a touch screen, etc.) and / or an input device (e.g., a keyboard, etc.) among other components.

[0077] Although an exemplary network environment 200 is shown and described herein, which includes SSRD 202, server devices 204(1)-204(n), client devices 208(1)-208(n), and communication network 210, other types and / or numbers of systems and / or devices and / or components and / or elements having other topologies may be used. Those skilled in the relevant art will appreciate that the example systems described herein are merely exemplary, as numerous variations are possible in the specific hardware and software used to implement the examples.

[0078] One or more of the devices depicted in network environment 200, such as SSRD 202, server devices 204(1)-204(n), and client devices 208(1)-208(n), may be configured to operate as virtual instances on the same physical machine. For example, one or more of SSRD 202, server devices 204(1)-204(n), and client devices 208(1)-208(n), may operate on the same physical machine rather than as separate devices communicating over communications network 210. Additionally, there may be more or fewer SSRDs 202, server devices 204(1)-204(n), or client devices 208(1)-208(n) than are depicted in FIG. 2.

[0079] Also, any system or device of any example may be replaced by two or more computing systems or devices, i.e., principles and advantages of distributed processing, such as redundancy and replication, may be implemented as appropriate to enhance the robustness and performance of the device or system of each example. By way of example only, each example may be implemented by one or more computer systems extending across any suitable network utilizing any suitable interface mechanism or traffic technology, such as any suitable form of communication traffic (e.g., voice, modem, etc.) alone, wireless traffic network, cellular traffic network, packet data network (PDN), Internet, intranet, combinations thereof, etc.

[0080] FIG. 3 is a system diagram 300 for implementing an SSRD with a smart simulation recovery module (SSRM) in one exemplary embodiment.

[0081] As shown in FIG. 3, the SSRD 302 with the SSRM 306 may be connected to a server 304 and one or more data stores 312 (i.e., multiple data sources) via a communication network 310. The SSRD 302 may also be connected to multiple client devices 308(1)-308(n) via the communication network 310, although the disclosure is not limited thereto. In exemplary embodiments, the SSRM 306 may be implemented within the client devices 308(1)-308(n), although the disclosure is not limited thereto. In exemplary embodiments, the client devices 308(1)-308(n) may implement the SSRM 306 to automatically estimate the total recovery time and amount of data loss required to recover an application, infrastructure, or business process in the event of a destructive malware attack that requires the application or applications supporting the business process, including IT, to be rebuilt and restored, although the disclosure is not limited thereto.

[0082] Although the SSRD 302 is shown and described in FIG. 3 as including an SSRM 306 in an exemplary embodiment, the SSRD 302 may include other rules, policies, modules, data stores, applications, etc. In exemplary embodiments, a data store 312 may be embedded within the SSRD 302. Although a single data store 312 is depicted in FIG. 3, in exemplary embodiments, multiple data stores 312 may be provided. The data store 312 may comprise one or more data storage devices configured to store information data corresponding to application data, asset data, data recovery data, business process data, technical product data, application transaction data, threat intelligence, historical event data, etc., but the disclosure is not limited thereto. For example, the data store 312 may comprise one or more memories configured to store information such as rules, programs, production requirements, testing requirements, control requirements, regulatory requirements, business requirements, and other general policies within an organization, but the disclosure is not limited thereto. In exemplary embodiments, SSRM 306 may be storage platform agnostic and configured to be deployed across multiple storage tiers with both structured and unstructured data.

[0083] In exemplary embodiments, the SSRM 306 can be configured to receive a continuous feed of data in real time from the data store 312 and the server 304 via the communications network 310 .

[0084] Additionally, in each exemplary embodiment, the data store 312 may be one or more cloud-based data stores, or combinations thereof, public, private, or hybrid, that support user authentication, data store security, integration with existing data stores and developments, and a store with an open API specification definition file (i.e., in JSON format) corresponding to the application, although the disclosure is not limited thereto.

[0085] In example embodiments, SSRM 406 may be implemented through a user interface, such as a web user interface, a build automation tool used primarily for Java projects, a private Jenkins, etc. (although the disclosure is not limited thereto), and may be integrated with public, private, or hybrid cloud platforms and distributed file system platforms through SSRM 406 and authentication services (although the disclosure is not limited thereto).

[0086] As described below, the SSRM 306 may be configured to implement a machine learning model configured to establish a communication link between a plurality of data sources (i.e., data store 312) and an event bus, receive from the plurality of data sources via the event bus a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure or business process, use the machine learning model to automatically predict probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data, determine based on the probability data an associated risk and impact of an amount of data loss that may occur in the event of having to reconstruct and / or recover the application or applications supporting the business process in the event of a destructive attack, and dynamically provide an estimate of a total recovery time and / or a total reconstruction time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0087] A number of client devices 308(1)-308(n) are depicted as being in communication with the SSRD 302. In this regard, the number of client devices 308(1)-308(n) may be “clients” of the SSRD 302 and are described as such herein. However, it is understood and appreciated that the number of client devices 308(1)-308(n) are not necessarily “clients” of the SSRD 302 or any of the entities described herein in connection with the SSRD 302. Any additional or alternative relationship, or no relationship at all, may exist between one or more of the number of client devices 308(1)-308(n) and the SSRD 302.

[0088] Any of the client devices in the plurality of client devices 308(1)-308(n) may be, for example, a smartphone, a personal computer, etc. Of course, the plurality of client devices 308(1)-308(n) may be any other device described herein. In exemplary embodiments, the server 304 may be the same as or equivalent to the server device 204 shown in FIG. 2.

[0089] The method may be performed over a communications network 310, which may be comprised of multiple networks as previously described. For example, in one exemplary embodiment, one or more of the multiple client devices 308(1)-308(n) may communicate with the SSRD 302 over broadband or cellular communications. Of course, such embodiments are exemplary only and are not limiting or exhaustive.

[0090] FIG. 4 is a system diagram that implements the smart simulation recovery module of FIG. 3 in one exemplary embodiment.

[0091] As shown in Figure 4, system 400 may include an SSRD 402 in which a smart simulation recovery module (SSRM) 406 may be embedded, one or more data stores (i.e., multiple data sources) 412, a server 404, client devices 408(1)-408(n), and a communication network 410. In exemplary embodiments, SSRD 402, SSRM 406, data store 412, server 404, client devices 408(1)-408(n), and communication network 410 shown in Figure 4 may be the same as or similar to SSRD 302, SSRM 306, data store 312, server 304, client devices 308(1)-308(n), and communication network 310 shown in Figure 3, respectively.

[0092] 4, the SSRM 406 may include a communication module 414, an implementation module 416, a prediction module 418, a calculation module 420, an execution module 422, a monitoring module 424, a detection module 426, a remediation module 428, an initiation module 430, a tracking module 432, a recording module 434, and a scheduling module 436. In exemplary embodiments, the data store 412 may be external to the SSRD 402 and may consist of various systems maintained and operated by the organization. Alternatively, in exemplary embodiments, the data store 412 may be embedded within the SSRD 402 and / or the SSRM 406.

[0093] The method may be performed via a communications module 414 and a communications network 410. The communications network 410 may consist of multiple networks as previously described. For example, in one exemplary embodiment, each component of the SSRM 406 may communicate with the server 404 and the data store 412 via the communications module 414 and the communications network 410. Of course, such embodiments are exemplary only and are not limiting or exhaustive.

[0094] In example embodiments, the communications network 410 and communications module 414 may be configured to establish links between the data store 412, the client devices 408(1)-408(n), and the SSRM 406.

[0095] In exemplary embodiments, the communication module 414, the implementation module 416, the prediction module 418, the calculation module 420, the execution module 422, the monitoring module 424, the detection module 426, the repair module 428, the launch module 430, the tracking module 432, the recording module 434, and the scheduling module 436 may each be implemented by a microprocessor or the like, which may be programmed with software (e.g., microcode, etc.) to perform the various functions described herein, and in some cases may be driven by firmware and / or software. Alternatively, the communication module 414, the implementation module 416, the prediction module 418, the calculation module 420, the execution module 422, the monitoring module 424, the detection module 426, the repair module 428, the launch module 430, the tracking module 432, the recording module 434, and the scheduling module 436 may each be implemented as dedicated hardware, or a combination of dedicated hardware for some functions and a processor (e.g., one or more programmed microprocessors and associated circuitry, etc.) for other functions. Additionally, in each exemplary embodiment, the communication module 414, the implementation module 416, the prediction module 418, the calculation module 420, the execution module 422, the monitoring module 424, the detection module 426, the repair module 428, the activation module 430, the tracking module 432, the recording module 434 and the scheduling module 436 may each be physically divided into two or more separate interacting blocks and / or units and / or devices and / or modules without departing from the scope of the inventive concept.

[0096] In each exemplary embodiment, the communication module 414, the implementation module 416, the prediction module 418, the calculation module 420, the execution module 422, the monitoring module 424, the detection module 426, the repair module 428, the activation module 430, the tracking module 432, the recording module 434, and the scheduling module 436 of the SSRM 406 may each be invoked by a corresponding API, although the disclosure is not limited in this respect.

[0097] FIG. 5 illustrates an example architecture for automated predictive analysis of business process recovery using real-time telemetry, as implemented by SSRM 406 of FIG. 4 in one exemplary embodiment.

[0098] As shown in FIG. 5, an example architecture diagram 500 may include multiple data sources 512 connected to an event bus 503, and an artificial intelligence (AI) / machine learning (ML) module 502 connected to the event bus 503. Data may flow from the data sources 512 to the event bus 503. Data may flow from the event bus 503 to the AI / ML 502. Data may flow from the AI / ML 502 to an incident / event change recorder 504 to a trust data recorder 506 to an orchestration engine 508, which may trigger a process recovery / test simulation process 510. Result data from the process recovery / test simulation process is fed back to the event bus 503 for consumption by the AI / ML module 502.

[0099] In example embodiments, data may flow bidirectionally between the AI / ML module 502 and the data lake 513. In the SSRM 406, data from the data lake 513 and data from the event bus 503 may be used to trigger the process recovery / test reporting process 514.

[0100] In example embodiments, the AI / ML module 502 may be configured to receive application data, asset data, data recovery data, business process data, technical product data, application transaction data, and threat intelligence data from corresponding data sources 512 and calculate recoverability / recovery metrics for critical business processes and services. The SSRM 406 may monitor critical business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technical designs, or suboptimal business processes.

[0101] In example embodiments, when a potential availability incident is detected, AI / ML module 502 may be further configured to identify the business processes or services, calculate the potential business risk to the entire company or organizational unit, and initiate orchestration engine 508 to prepare for recovery.

[0102] In example embodiments, SSRM 406 may include an asset inventory module that may be configured to dynamically track information assets within an organization, although the disclosure is not limited in this respect.

[0103] In example embodiments, SSRM 406 may have an application inventory module that may be configured to dynamically track applications within an organization, although the disclosure is not limited in this respect.

[0104] In example embodiments, SSRM 406 may have a product catalog module that may be configured to dynamically track resilience and recovery attributes of technology products used by the organization, although the disclosure is not limited in this respect.

[0105] In example embodiments, the SSRM 406 may include a configuration orchestration engine 508 that may be configured to perform automated repairs and / or modifications, and may additionally initiate fully autonomous recovery of an affected environment, although the disclosure is not limited in this respect.

[0106] In example embodiments, SSRM 406 may have a change recording module that may be configured to record pending IT-related changes, affected assets, implementation timeframes, and even human-based risk and impact assessments, although the disclosure is not limited thereto.

[0107] In example embodiments, SSRM 406 may have a business operations module that may be configured to identify business processes, services, products, and their importance to an organization's business operations, although the disclosure is not limited in this respect.

[0108] In exemplary embodiments, but not limited to, SSRM 406 may include a threat intelligence module that may be configured to identify threats that the organization faces or has, or that may target or are currently targeting the organization. This information may be used to protect against, prevent, and identify threats that seek to exploit valuable resources.

[0109] In example embodiments, SSRM 406 may include a regulatory compliance module that may be configured to identify regulatory agencies and regulations for business data and / or application data, although the disclosure is not limited in this respect.

[0110] The event bus 503 can be configured to provide one or more communication channels between technology assets, application transactions, and threat intelligence to analyze, prepare, and execute remediation actions in real time.

[0111] In example embodiments, SSRM 406 may have a data lake module that may be configured to provide a central location (i.e., data lake 513) for historical recovery incident data as input for predictive analytics of recovery. This data lake 513 may map application inventory to business operations modules and determine upstream / downstream availability impacts for improved decision making. In example embodiments, data lake 513 may store metrics from recovery events and provide real-time recovery data to AI / ML processes for improved automated AI / ML decision making in the recovery process and increased learning and understanding of outages and recovery processes.

[0112] In example embodiments, SSRM 406 may have a trusted data module that may be configured to retrieve data from a trusted data store to recover one or more applications, although the disclosure is not limited in this respect.

[0113] The process recovery / test reporting process 514 is a recovery process that performs reconstruction / recovery to a last known good state (trusted state) and simulation (test) of the recovery process.

[0114] 4 and 5. The communications module 414 may be configured to establish communications links between the plurality of data sources 512 and the event bus 503. The implementation module 416 may be configured to implement the machine learning models generated by the AI / ML module 502. The machine learning models may be configured to receive real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure or business process from the plurality of data sources 512 via the event bus 503.

[0115] In example embodiments, the prediction module 418 may be configured to use the machine learning model to automatically predict probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data.

[0116] In example embodiments, calculation module 420 may be configured to determine, based on the probability data, the associated risk and impact of the amount of data loss that may occur in the event of a destructive attack requiring the application or applications supporting the infrastructure or business process to be rebuilt and / or restored.

[0117] In example embodiments, execution module 422 may be configured to dynamically provide estimated data on a total recovery time and / or a total rebuild time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0118] In exemplary embodiments, the plurality of real-time telemetry data may include, but is not limited to, application data, asset data, data resiliency data, business process data, technology product data, application transaction data, threat intelligence data, etc., for calculating resiliency capabilities and / or recovery metrics of critical infrastructure or business processes and services.

[0119] In example embodiments, the monitoring module 424 may be configured to monitor the critical infrastructure or business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0120] In example embodiments, detection module 426 may be configured to automatically detect the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data. Execution module 422 may be configured to perform automatic remediation and / or modification based on the inference data in response to the destructive attack event.

[0121] In example embodiments, the activation module 430 may be configured to initiate a fully autonomous remediation process for the affected environment in response to the destructive attack event.

[0122] In example embodiments, the event bus 503 can be configured to analyze and execute remediation actions in real time by providing one or more communication channels between technical asset data sources, application transaction data sources, and threat intelligence data sources.

[0123] In example embodiments, upon receiving the plurality of real-time telemetry data, tracking module 432 may be configured to dynamically track information asset data within an organization, dynamically track the application or applications within the organization, and dynamically track resilience and recovery attribute data of technology products used in the organization.

[0124] In example embodiments, in determining the associated risk and the impact of the amount of data loss, a recording module 434 may be configured to record pending IT-related changes, affected assets, implementation timeframes, and even an assessment of human-based risks and impacts.

[0125] In example embodiments, the machine learning module 502 may be configured to enter an alert state based on multiple factors such as, but not limited to, time of day, time month, and other operating conditions, determine the capacity requirements and / or availability of alternative affected infrastructure, and initiate the orchestration of recovery, the total recovery time, and the amount of data loss.

[0126] In example embodiments, the execution module 422 may be configured to automatically provide simulation results of recovery, and the scheduling module 436 may be configured to automatically schedule recovery tests to verify the simulation results.

[0127] In example embodiments, when a potential availability incident is detected, the machine learning model 502 may be further configured to identify business processes or services to calculate a potential business risk to the entire organization or organizational units, and to launch an orchestration engine to execute recovery. Also, in example embodiments, the systems and methods disclosed herein may be capable of analyzing possible changes in the regulatory environment that may force an organization to streamline parts of its organization or business units or processes (i.e., splitting up a bank), and identifying the set of technologies and / or operations that are affected.

[0128] FIG. 6 is a flow diagram illustrating the implementation of the smart simulation recovery module in one exemplary embodiment.

[0129] The method 600 may include establishing communication links between a plurality of data sources and an event bus (step S602).

[0130] Method 600 may include implementing a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting a business process from the plurality of data sources via the event bus (step S604).

[0131] Method 600 may include automatically predicting a probability of an availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model (step S606).

[0132] Method 600 may include determining (step S608) based on the probability data the associated risk and impact of the amount of data loss that may occur in the event of a destructive attack requiring the application or applications supporting the infrastructure or business process to be rebuilt and / or restored.

[0133] Method 600 may include dynamically providing estimated data for a total recovery time and / or a total rebuild time for the application or group of applications based on determining the associated risk and impact of the amount of data loss (step S610).

[0134] In example embodiments, method 600 may further include monitoring the critical infrastructure or business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0135] In example embodiments, method 600 may further include automatically detecting the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data, and performing automatic remediation and / or modification based on the inferred data in response to the destructive attack event.

[0136] In example embodiments, method 600 may further comprise initiating a fully autonomous remediation process for the affected environment in response to the destructive attack event.

[0137] In example embodiments, method 600 may further include, upon receiving the plurality of real-time telemetry data, dynamically tracking information asset data within an organization, dynamically tracking the application or applications within the organization, and dynamically tracking resilience and recovery attribute data of technology products used by the organization.

[0138] In example embodiments, method 600 may further include recording pending business related changes, affected assets, implementation timeframes, and assessments of human-based risks and impacts in determining the associated risk and impact of the amount of data loss.

[0139] In example embodiments, method 600 may further include automatically providing simulation results of the recovery and automatically scheduling a recovery test to verify the simulation results.

[0140] In example embodiments, method 600 may further include, when a potential availability incident is detected, having the machine learning model: identify business processes or services to calculate potential business risk to the entire organization or an organizational unit; and trigger an orchestration engine to execute recovery.

[0141] In example embodiments, method 600 may further include providing a centralized repository of past recovery incident data as an input for the probabilistic data used in predictive recovery analysis, the centralized repository mapping application inventory to business operations modules to determine upstream and / or downstream availability impacts to improve decision making, the business operations modules configured to identify business processes, services, products, and their importance to the organization's business operations.

[0142] In each exemplary embodiment, method 600 may further include performing one or more of a recovery process to rebuild the application or applications, a recovery process to a last known good state (trusted state) of the application or applications, and a simulation / testing of the recovery process.

[0143] In exemplary embodiments, the SSRD 402 may include a memory (such as memory 106 shown in FIG. 1), which may be a non-transient computer readable medium. The medium may be configured to store instructions for implementing the SSRM 406, which may automatically perform predictive analysis of the recovery of a business process to a reliable state through real-time telemetry, as disclosed herein. The SSRD 402 may further include a media reader (such as media reader 112 shown in FIG. 1), which may be configured to read any one or more instructions (e.g., software, etc.) from any memory described herein. The instructions may be executed by a processor embedded within the SSRM 406 or within the SSRD 402 to implement one or more methods or processes described herein. In a specific embodiment, the instructions may reside in whole or at least in part within the memory 106 and / or the media reader 112 and / or the processor 104 (see FIG. 1) while executing in the SSRD 402.

[0144] For example, the instructions, when executed, may cause the processor 104 to: establish a communication link between a plurality of data sources and an event bus; implement a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure or business process from the plurality of data sources via the event bus; use the machine learning model to automatically predict a probability of an availability incident based on the received plurality of real-time telemetry data and the historical event data; determine, based on the probability data, an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure or business process must be rebuilt and / or restored in the event of a destructive attack; and dynamically provide an estimate of a total recovery time and / or a total rebuild time for the application or applications based on determining the associated risk and impact of the amount of data loss.

[0145] In example embodiments, the instructions, when executed, may cause the processor 104 to perform procedures to monitor the critical infrastructure or the business processes and services to identify potential business risks where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

[0146] In example embodiments, the instructions, when executed, may cause processor 104 to automatically detect the availability incident using the machine learning model based on the received plurality of real-time telemetry data and the historical event data, and to perform automatic functionality repair and / or functionality modification based on the inferred data in response to the destructive attack event.

[0147] In example embodiments, the instructions, when executed, may cause the processor 104 to execute procedures to initiate a fully autonomous remediation process for the affected environment in response to the destructive attack event.

[0148] In example embodiments, the instructions, when executed, may cause the processor 104 to perform steps of dynamically tracking information asset data within an organization, dynamically tracking the application or applications within the organization, and dynamically tracking resilience and recovery attribute data of technology products used in the organization upon receiving the plurality of real-time telemetry data.

[0149] In example embodiments, the instructions, when executed, may cause the processor 104 to perform procedures to record pending IT-related changes, affected assets, implementation timeframes, and even human-based risk and impact assessments in determining the associated risk and the impact of the amount of data loss.

[0150] In example embodiments, the instructions, when executed, may cause processor 104 to perform procedures for automatically providing simulation results of recovery and automatically scheduling recovery tests to verify the simulation results.

[0151] In example embodiments, the instructions, when executed, may cause the processor 104 to perform the following procedures when a potential availability incident is detected: cause the machine learning model to: identify business processes or services and calculate potential business risk to the entire organization or an organizational unit; and invoke an orchestration engine to perform recovery.

[0152] In example embodiments, the instructions, when executed, may cause the processor 104 to perform steps to prepare a centralized repository of past recovery incident data as an input for the probabilistic data used in predictive recovery analysis, the centralized repository mapping application inventory to business operations modules to determine upstream and / or downstream availability impacts to improve decision making, the business operations modules configured to identify business processes, services, products, and their importance to the organization's business operations.

[0153] In example embodiments, the instructions, when executed, may cause the processor 104 to execute procedures to perform one or more of a recovery process to rebuild the application or applications, a recovery process to a last known good state (trusted state) of the application or applications, and a simulation / testing of a recovery process.

[0154] According to the exemplary embodiments disclosed so far in FIGS. 1 to 6, technical improvements provided by the present disclosure may include, but are not limited to, a platform that realizes a smart simulation recovery module that automatically estimates the total recovery time and amount of data loss required to recover an application, infrastructure, or business process when an application or group of applications supporting a business process including IT must be rebuilt and restored due to a destructive malware attack event.

[0155] While the present invention has been described with reference to certain exemplary embodiments, it is to be understood that the language used is intended to be descriptive and illustrative rather than limiting. Changes may be made within the scope of the appended claims, as amended, without departing from the scope and spirit of each aspect of the present disclosure. While the present invention has been described with reference to specific means, materials and embodiments, the present invention is not limited to the specific disclosures, but rather extends to all functionally equivalent structures, methods and uses, as fall within the scope of the appended claims.

[0156] For example, a computer-readable medium may be described as being a single medium. However, the term "computer-readable medium" encompasses a single medium or multiple media, such as a centralized or distributed data store / center and / or associated caches or servers that store one or more instructions. Additionally, the term "computer-readable medium" encompasses any medium capable of storing, encoding or retaining instructions for execution by a processor or that causes a computer system to implement any one or more of the embodiments disclosed herein.

[0157] The computer readable medium may be comprised of one or more non-transitory computer readable media and / or one or more transitory computer readable media. In one non-limiting embodiment, the computer readable medium may be comprised of a solid-state memory, such as a package, such as a memory card, that contains one or more non-volatile read-only memories. The computer readable medium may also be a volatile re-writable memory, such as a random access memory. The computer readable medium may also include magneto-optical or optical media, such as a storage device, such as a disk, tape, etc., that collects carrier signals, such as signals transmitted over a transmission medium. Thus, the present disclosure should be construed to encompass any computer readable medium on which data or instructions may be stored, as well as other equivalents and successor media.

[0158] Although the present application describes certain embodiments that may be embodied as computer programs or code segments in a computer-readable medium, it should be understood that dedicated hardware implementations, such as application specific integrated circuits, programmable logic arrays, or other hardware devices, may also be constructed to perform one or more of the embodiments described herein. Potential applications of the various embodiments described herein may broadly include a variety of electronic and computer systems. Thus, the present application may encompass software implementations, firmware implementations, hardware implementations, or combinations thereof. Nothing in the present application should be interpreted as being implemented or capable of being implemented solely in software and not hardware.

[0159] Although components and functions that may be implemented in particular embodiments are described herein with reference to particular standards and protocols, the present disclosure is not limited to such standards and protocols. Such standards are over time superseded by faster or more efficient equivalents of essentially the same functionality. Thus, replacement standards or protocols having the same or similar functionality are considered equivalents.

[0160] The drawings of the embodiments described herein are intended to provide a basic understanding of each embodiment. The drawings are not intended to serve as a complete description of all of the features and components of an apparatus or system utilizing the structures and methods described herein. Numerous alternative embodiments may become apparent to those skilled in the art upon review of the present disclosure. Other embodiments may be derived and utilized from the present disclosure, and substitutions or changes may be made in structure and logic without departing from the scope of the present disclosure. Additionally, the drawings are merely symbolic and may not be drawn to scale. Proportions in the drawings may be exaggerated or reduced. Thus, the present disclosure and drawings are to be considered illustrative rather than limiting.

[0161] One or more embodiments of the present disclosure may be referred to herein, singly and / or collectively, as the "present invention." This is for convenience only, and is not intended to voluntarily limit the scope of the present application to any particular invention or inventive concept. In addition, while specific embodiments are shown and described herein, it is understood that the specific embodiments shown may be replaced by any subsequent arrangements designed to accomplish the same or similar purpose. The present disclosure is intended to encompass any and all subsequent adjustments and modifications of each embodiment. Combinations of the above embodiments and other embodiments not specifically described herein will be apparent to those of skill in the art upon review of this specification.

[0162] The Abstract of the Disclosure is submitted with the understanding that it will not interpret or limit the scope or meaning of the claims. In addition, the foregoing Detailed Description may group or describe various configurations in a single embodiment for the purpose of streamlining the disclosure. This disclosure should not be interpreted as reflecting an intention that the embodiments described in each claim require more configurations than are expressly recited in each claim. Rather, as the appended claims suggest, the subject matter of the invention may be directed to fewer components than are disclosed for any embodiment. In other words, the appended claims are incorporated into the Detailed Description with each claim defining an independent subject matter in its own right.

[0163] The subject matter disclosed hereinabove is illustrative and not limiting, and the appended claims are intended to embrace all such modifications, improvements and other embodiments that fall within the true spirit and scope of the present disclosure. Accordingly, to the maximum extent permitted by law, the scope of the present disclosure shall be determined by the broadest interpretation of the appended claims and their equivalents, and shall not be limited or restricted by the foregoing detailed description.

Claims

1. 1. A method for automatically predictively analyzing recovery time to a reliable state of an application or infrastructure using real-time telemetry, the method comprising: a process of implementing or realizing a smart simulation and recovery module (SSRM) having a communication module, an implementation module, a prediction module, a calculation module, a detection module, and an execution module, each of which is invoked by a corresponding application programming interface (API), for automatically estimating the total recovery time and data loss that may occur in recovering an application or infrastructure that requires reconstructing and recovering an application or applications comprising information technology in the event of a destructive malware attack or the event of such an attack; establishing communication links between a plurality of data sources and an event bus by invoking the communication module via a first application programming interface (API); implementing a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure from a plurality of data sources via the event bus by invoking the implementation module via a second application programming interface (API); automatically predicting a probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the prediction module via a third application programming interface (API); automatically detecting the availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the detection module via a corresponding application programming interface (API); determining, based on the probability data, an associated risk and impact of an amount of data loss that may occur in the event of a destructive attack requiring the application or applications supporting the infrastructure to be rebuilt and / or restored, by invoking the calculation module via a fourth application programming interface (API); dynamically providing an estimate of a total recovery time and / or a total rebuild time for the application or group of applications based on determining the associated risk and impact of the amount of data loss by invoking the executive module via a fifth application programming interface (API); detecting the destructive attack event by invoking the detection module; performing automated repairs and / or modifications based on the inferred data in response to detecting the destructive attack event to reconstruct and / or restore the application or applications supporting the infrastructure; A method comprising:

2. 2. The method of claim 1, wherein the plurality of real-time telemetry data includes application data, asset data, data recovery data, business process data, technical product data, application transaction data, and threat intelligence data for calculating recovery capability and / or recovery indicators of critical infrastructure or business processes and services.

3. The method of claim 2 further comprising: monitoring said critical infrastructure or said business processes and services to identify potential business risks; wherein the expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

4. The method of claim 1 further comprising: initiating a fully autonomous remediation process for the affected environment in response to the destructive attack event; A method comprising:

5. 10. The method of claim 1, wherein the event bus is configured to provide one or more communication channels between technical asset data sources, application transaction data sources, and threat intelligence data sources to analyze and execute remediation activities in real time.

6. 2. The method of claim 1, further comprising, in receiving the plurality of real-time telemetry data, A process for dynamically tracking information asset data within an organization; dynamically tracking the application or applications within the organization; dynamically tracking resilience and recovery attribute data of technology products used by said organization; A method comprising:

7. 10. The method of claim 1, further comprising: determining the associated risk and the impact of the amount of data loss by: A process for recording pending infrastructure or business-related changes, affected assets, implementation timeframes, and an assessment of human-induced risks and impacts; A method comprising:

8. 10. The method of claim 1, wherein the machine learning model is configured to enter an alert state, determine capacity requirements and / or availability of alternative affected infrastructure, and initiate recovery, orchestration of the total recovery time and the amount of data loss. There is a way.

9. The method of claim 1 further comprising: automatically providing a simulation result of the recovery; automatically scheduling recovery tests to verify the simulation results; A method comprising:

10. 2. The method of claim 1, wherein the machine learning model is further configured to: identify business processes or services to calculate potential business risks to the entire organization or organizational units when a potential availability incident is detected; and trigger an orchestration engine to perform recovery.

11. The method of claim 1 further comprising: providing a centralized repository of historical recovery incident data as an input for said probability data used in predictive analysis of recovery; Equipped with The centralized repository maps application inventory to business operations modules and determines upstream and / or downstream availability impacts to improve decision making. and The method, wherein the business operations module is configured to identify business processes, services, products, and their importance to the organization's business operations.

12. The method of claim 1 further comprising: performing one or more of a recovery process to rebuild the application or applications, a recovery process to a last known trusted state of the application or applications, and a simulation / testing of the recovery process; A method comprising:

13. 1. A system for automatically predicting and analyzing recovery time to a reliable state of an application or infrastructure using real-time telemetry, comprising: A processor; a memory operatively connected to the processor via a communications interface and storing computer readable instructions; Equipped with The instructions, when executed, cause the processor to: a method for implementing a Smart Simulation and Recovery Module (SSRM) comprising a communication module, an implementation module, a prediction module, a calculation module, a detection module, and an execution module, each of which is invoked by a corresponding application programming interface (API), for automatically estimating the total recovery time and data loss required for application or infrastructure recovery in the event of a destructive malware attack or an event resulting from the need to reconstruct and recover an application or group of applications comprising information technology; establishing communication links between a plurality of data sources and an event bus by invoking the communication module via a first application programming interface (API); implementing a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure from the plurality of data sources via the event bus by invoking the implementation module via a second application programming interface (API); automatically predicting a probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the prediction module via a third application programming interface (API); automatically detecting the availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the detection module via a corresponding application programming interface (API); determining, based on the probability data, an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure must be rebuilt and / or restored in the event of a destructive attack by invoking the calculation module via a fourth application programming interface (API); dynamically providing estimated total recovery time and / or total rebuild time for the application or group of applications based on determining the associated risk and impact of the amount of data loss by invoking the execution module via a fifth application programming interface (API); detecting the destructive attack event by invoking the detection module; and performing automated repairs and / or modifications based on the inferred data in response to detecting the destructive attack event to reconstruct and / or restore the application or applications supporting the infrastructure; A system that executes the above.

14. 14. The system of claim 13, wherein the plurality of real-time telemetry data includes application data, asset data, data recovery data, business process data, technical product data, application transaction data, and threat intelligence data for calculating recovery capability and / or recovery indicators of critical infrastructure or business processes and services.

15. 15. The system of claim 14, wherein the processor is further configured to monitor the critical infrastructure or the business processes and services to identify potential business risks, where expected recovery times do not match actual recovery times due to regulations, business objectives, technology designs, or suboptimal business processes.

16. 14. The system of claim 13, wherein the processor is further configured to initiate a fully autonomous remediation process for an affected environment in response to the destructive attack event.

17. 14. The system of claim 13, wherein the event bus is configured to analyze and execute remediation activities in real time by providing one or more communication channels between technical asset data sources, application transaction data sources, and threat intelligence data sources.

18. a non-transient computer-readable medium configured to store instructions for automatically predictively analyzing recovery time to a reliable state of an application or infrastructure through real-time telemetry; The instructions, when executed, cause a processor to: a method for implementing a Smart Simulation and Recovery Module (SSRM) comprising a communication module, an implementation module, a prediction module, a calculation module, a detection module, and an execution module, each of which is invoked by a corresponding application programming interface (API), for automatically estimating the total recovery time and data loss required for application or infrastructure recovery in the event of a destructive malware attack or an event resulting from the need to reconstruct and recover an application or group of applications comprising information technology; establishing communication links between a plurality of data sources and an event bus by invoking the communication module via a first application programming interface (API); implementing a machine learning model configured to receive a plurality of real-time telemetry data and historical event data associated with an application or applications supporting an infrastructure from the plurality of data sources via the event bus by invoking the implementation module via a second application programming interface (API); automatically predicting a probability data of an availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the prediction module via a third application programming interface (API); automatically detecting the availability incident based on the received plurality of real-time telemetry data and the historical event data using the machine learning model by invoking the detection module via a corresponding application programming interface (API); determining, based on the probability data, an associated risk and impact of a possible amount of data loss in the event that the application or applications supporting the infrastructure must be rebuilt and / or restored in the event of a destructive attack by invoking the calculation module via a fourth application programming interface (API); dynamically providing estimated total recovery time and / or total rebuild time for the application or group of applications based on determining the associated risk and impact of the amount of data loss by invoking the execution module via a fifth application programming interface (API); detecting the destructive attack event by invoking the detection module; and performing automated repairs and / or modifications based on the inferred data in response to detecting the destructive attack event to reconstruct and / or restore the application or applications supporting the infrastructure; A medium that allows the execution of the above.

19. The non-transient computer-readable medium of claim 18, wherein the instructions, when executed, cause a processor to perform procedures that, in response to a destructive attack event, initiate a fully autonomous recovery process for an affected environment.

20. The non-transient computer-readable medium of claim 18, wherein the event bus is configured to analyze and execute remediation activities in real time by providing one or more communication channels between technical asset data sources, application transaction data sources, and threat intelligence data sources.

Images