Apparatus and computer-implemented method for allocating computing resources in method for protecting computer-aided development environment in distributed development process from failure and threats
The method dynamically allocates computational resources in computer-aided development environments based on effectiveness metrics, improving the recognition and mitigation of failures and threats in distributed development processes.
Patent Information
- Application Number
- JP2024182932
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-10-19
- Filing Date
- 2024-10-18
- Publication Date
- 2025-05-02
AI Technical Summary
Existing methods for protecting computer-aided development environments in distributed development processes struggle to efficiently allocate computational resources to effectively recognize and mitigate failures and threats.
A computer-implemented method and apparatus for dynamically allocating computational resources based on metrics that quantify the quality and effectiveness of techniques for recognizing failures and threats, using a parameterized function to determine resource allocation offers and adjust based on learning parameters.
This approach automates the load balancing of computational resources, ensuring that techniques with higher effectiveness in identifying failures and threats receive more resources, thereby enhancing the overall security and efficiency of the development environment.
Smart Images
Figure 2025071054000001_ABST
Abstract
Description
[Technical field]
[0001] The invention takes as its starting point an apparatus and a computer-implemented method for allocating computing resources in a method for protecting a computer-aided development environment in a distributed development process against failures and threats. Summary of the Invention
[0002] A computer-implemented method for allocating computing resources during a method for protecting a computer-aided development environment from faults and threats in a distributed development process provides for performing, within the method for protecting, a number of techniques for recognizing faults and / or threats in the computer-aided development environment, determining for each technique metrics that quantify the quality and / or meaningfulness of the technique, determining for these techniques respective offers for the allocation of computing resources for implementing the respective techniques depending on the metrics, and allocating the computing resources to the techniques depending on the respective offers, thereby automating the load balancing of resources for the techniques.
[0003] It may be contemplated that the offers are taken from a prepared budget, or that the budget is determined depending on a metric and the offers are taken from the budget determined depending on this metric.
[0004] It may be envisaged that the metrics are determined depending on the number of bugs found by the methodology or the number of lines of code analyzed by the methodology, thereby allocating resources depending on this number.
[0005] This number may be normalized by a normalization parameter and the metric may be intended to represent the number normalized by the parameter, so that comparable offers can be determined by the same function for different types of metrics.
[0006] It may be contemplated that the offers for each approach are determined with a function parameterized by at least one parameter, which maps metrics to offers depending on the at least one parameter, or that the function maps metrics and budgets to offers depending on the at least one parameter, which at least one parameter is statically set or learned, meaning that static circumstances and changing learnable circumstances are taken into account.
[0007] It may be provided that the at least one parameter is learned in dependence on the metric, whereby the metric-dependent allocation is self-learning. It may be contemplated that metrics and offers for each approach are determined in an iterative process, and computing resources are allocated repeatedly in the iterative process depending on the metrics or offers determined for each iteration.
[0008] Computational resources may be contemplated to include time slots of computation time, memory areas of memory, or bandwidth of a data line. It may be contemplated that the computational resources are provided on a server.
[0009] It may be envisaged that the computer-aided development environment in a distributed development process is provided on distributed devices, which means that the approach monitors the development environment on the distributed devices.
[0010] It may be contemplated that at least one of the multiple techniques for recognizing faults and / or threats is executed on one of the distributed devices to which this at least one of the multiple techniques is assigned.
[0011] An apparatus for allocating computing resources during a method for protecting a computer-aided development environment in a distributed development process from failures and threats is provided, the apparatus including at least one processor and at least one memory, the at least one processor configured to execute instructions, and upon execution of the instructions by the at least one processor, the apparatus executes the method, and the at least one memory stores the instructions.
[0012] A computer program may be contemplated which is executable by a computer and comprises instructions which, when executed by the computer, cause the method to proceed. Further advantageous embodiments can be seen from the following description and the drawings. [Brief description of the drawings]
[0013] [Figure 1] FIG. 1 illustrates a computer-aided development environment. [Diagram 2] 2 is a flow diagram with method steps for allocating computing resources during a method for protecting a computer-aided development environment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0014] FIG. 1 illustrates a computer-aided development environment 100 . The development environment 100 includes a server 102 and distributed devices 104 . The development environment 100 includes an apparatus 106 for allocating computing resources in a method for protecting the computer-aided development environment 100 from failures and threats in a distributed development process.
[0015] The device 106 includes at least one processor 108 and at least one memory 110 . The at least one processor 108 is configured to execute instructions, and upon execution of the instructions by the at least one processor 108, the device 106 performs a method described below for allocating computing resources in a method for protecting the computer-aided development environment 100 from failures and threats in a distributed development process.
[0016] At least one memory 110 stores instructions. The distributed devices 104 and the server 102 are configured to cooperate in this example to implement multiple techniques for recognizing faults and / or threats within a method for protection.
[0017] In this example, at least one of the distributed devices 104 is assigned to one approach for recognizing faults and / or threats. Server 102, in this example, provides the computational resources to be allocated.
[0018] Computational resources include, for example, time slots of computation time on the server 102 , memory areas in the memory of the server 102 , or bandwidth of data lines between the server and the distributed devices 104 .
[0019] The method for allocating computing resources is implemented in this example in an iterative process. The method for allocating computing resources includes step 202 .
[0020] In step 202, within the method for protection, multiple techniques for recognizing faults and / or threats are implemented. Each technique may, for example, be executed, at least in part, as one process or as multiple processes on server 102 .
[0021] Each technique may be performed, at least in part, as one process or as multiple processes on at least one of the distributed devices 104, for example. Each technique is allocated computational resources for at least a portion of the processes executed on the server 102. In a first iteration, the allocation of computational resources may be done randomly or based on a set allocation or evenly among all techniques.
[0022] The method for allocating computing resources includes step 204 . In step 204, for each technique, metrics are determined that quantify the quality and / or meaningfulness of the technique.
[0023] The computer-aided development environment is provided in a distributed development process, inter alia, on distributed devices 104. Metrics are determined within the distributed development process. For example, at least one of a plurality of techniques for recognizing faults and / or threats is executed on one of the distributed devices 104 to which the at least one of the plurality of techniques is assigned.
[0024] Metrics may be determined, for example, depending on the number of bugs found by the method or the number of lines of code analyzed by the method. This number quantifies quality, for example, in the sense that a higher number represents better quality than a lower number.
[0025] The numbers are normalized by a normalization parameter, and the metric may be intended to represent the number normalized by the parameter. This allows the use of numbers that are not directly comparable to each other. An example of normalization by a normalization parameter is to divide or multiply the metric by the value of the normalization parameter.
[0026] The method for allocating computing resources includes a step 206 . In step 206, for the techniques, respective offers for allocation of computing resources for implementing the respective techniques are determined depending on the metrics.
[0027] The offers, in one example, are drawn from a budget reserved for the iteration process. A budget may refer to available computation time, disposable funds, or permitted power consumption. In this example, the budget defines an upper limit on the offers allowed overall in an iteration.
[0028] In one example, a budget is determined depending on a metric, and offers are drawn for each iteration from the budget determined depending on the metric. The budget is reduced by the offers taken, for example, in the first iteration, and this reduced budget is available for the iterations following the first iteration.
[0029] The offers for each approach are determined, for example, by a function parameterized by at least one parameter. The function, in one example, maps a metric to an offer depending on at least one parameter.
[0030] The function, in one example, maps metrics and budgets to offers depending on at least one parameter. The at least one parameter may be statically set or may be learned.
[0031] An example of a parameter function is the addition or multiplication of a metric and a value of the parameter. An example of a statically set parameter is a parameter that has a number of different values, for example depending on the time, which different values result in different offers. For example, a first value of the parameter is defined for a period of time during the night and a second value of the parameter is defined for a period of time during the day. For example, the first value is greater than the second value in order to allocate more computing resources to a technique during the night than during the day. For example, the first value is less than the second value in order to allocate more computing resources to a technique during the day than during the night.
[0032] At least one parameter for a function assigned to a particular metric is learned, for example, in dependence on the particular metric, such that, for the at least one parameter, an offer for a particular technique results in allocating more computational resources to the particular technique as the metric increases.
[0033] The method for allocating computing resources includes a step 208 . In step 208, computational resources are allocated to the methods depending on the respective offers.
[0034] In this example, techniques are allocated more or less computational resources depending on the height of the offer, e.g., techniques with higher offers are allocated more computational resources than techniques with lower offers.
[0035] For example, metrics about one or more developments and / or operations of the device 104 are obtained. For example, the development and / or operation of the one or more devices 104 may be monitored relying on the metrics.
[0036] This monitoring is done by technique, with resources allocated to each technique. For each technique, metrics and offers are determined in an iterative process, and computing resources are allocated repeatedly in the iterative process depending on the metrics or offers of that technique determined for each iteration.
[0037] Computing resources are provided, inter alia, on the servers 102 based on the allocation. Then, step 202 is executed. It may be contemplated that the offers will be determined for each methodology by agents assigned to the respective methodology.
[0038] In a method for reinforcement learning, an agent, in particular at least one parameter, may learn to make offers depending on a reward, which may be, for example, a metric or may be determined for each technique depending on the metric of the respective technique.
[0039] Exemplary approaches to awareness for development on operations (DEVOps) environments include the following: Requirement analysis Secure coding static automated security testing (SAST) White box dynamic automated security testing (DAST) Black box DAST Digital sign Security analysis Security monitoring Security audit Security patch Security scan Security config Secure transfer Exemplary metrics of awareness for a development on operations (DEVOps) environment include:
[0040] Bug Density This metric can be used to measure, for example, The number of confirmed bugs in a piece of software or a component of that software during a set length of development, as determined by this technique, divided by the code size of the piece of software or component. It is defined as: This allows bug density to be monitored and reduced over time.
[0041] Bug Fix Speed This metric measures, for example, the speed at which discovered bugs are removed. This allows you to observe and increase the productivity of your development team.
[0042] Critical Risk Assessment This metric measures, for example, the relationship between the severity of a bug and the value of the vulnerability caused by this bug to a potential attacker. This allows the priority of the bug to be defined.
[0043] Most severe vulnerability types This metric measures, for example, the most critical and most frequently occurring vulnerability types for bugs. This may provide a training plan for the development team to impart knowledge about bugs and their workarounds.
[0044] Number of enemies per app This metric measures, for example, how many adversaries an app has. This metric can be determined by a threat model or risk analysis. This allows for the determination of apps within the development environment that are more at risk than other apps within the development environment, so that the treatment of these apps can be adapted.
[0045] Malicious repetition rate This metric measures, for example, how often an adversary uses the same strategy or procedure. This may provide adequate training in threat defense.
[0046] Risk points for each device This metric measures, for example, the number of vulnerabilities per device 104 . This allows for prioritization of vulnerabilities based on their severity, allowing, for example, more attention to be given to critical vulnerabilities that are exploitable from the Internet.
[0047] Number of continuous supply cycles per month This metric might measure, for example, the number of successful deliveries to production per month. This allows you to measure how quickly code changes are ready in production.
[0048] Number of problems during training This metric measures, for example, the number of problems found and removed during training. This allows the effectiveness of the trainee to be measured. [Explanation of symbols]
[0049] 100 Computer-Aided Development Environment 102 Server 104 Distributed Equipment 106 Apparatus for allocating computational resources 108 processors 110 Memory 202 Implementing multiple techniques for recognizing failures and / or threats within the method for protecting 204 For each method, determine metrics that quantify the quality and / or meaningfulness of the method. 206 determining, for the techniques, respective offers for allocation of computational resources for implementing the respective techniques in dependence on the metrics; 208 Allocating computational resources to the methods depending on each offer.
Claims
1. 1. A computer-implemented method for allocating computing resources during a method for protecting a computer-aided development environment (100) from faults and threats in a distributed development process, comprising: executing (202) a number of techniques for recognizing faults and / or threats in the computer-aided development environment (100) within the method for protecting; determining (204) for each technique metrics that quantify the quality and / or meaningfulness of the technique; determining (206) for the techniques respective offers for allocation of computing resources for implementing the respective techniques in dependence on the metrics; and allocating (208) the computing resources to the techniques in dependence on the respective offers.
2. 2. The method of claim 1, wherein the offer is taken from a prepared budget (206), or a budget is determined depending on the metrics and the offer is taken from the budget determined depending on the metrics (206).
3. 3. The method of claim 1 or 2, wherein the metrics are determined (204) depending on the number of bugs found by the technique or the number of lines of code analyzed by the technique.
4. 4. The method of claim 3, wherein the number is normalized by a normalization parameter (204), and the metric represents the number normalized by the parameter.
5. 5. The method of claim 1, wherein the offers for the respective techniques are determined with a function parameterized by at least one parameter (206), the function mapping the metrics to the offers in dependence on the at least one parameter, or the function mapping the metrics and the budget to the offers in dependence on the at least one parameter, the at least one parameter being statically set or learned.
6. 6. The method of claim 5, wherein the at least one parameter is learned in dependence on the metric.
7. 7. The method of claim 1, wherein the metrics and offers for each technique are determined in an iterative process, and the computing resources are allocated repeatedly in the iterative process depending on the metrics or offers determined for each iteration.
8. 8. The method according to claim 1, wherein the computational resources comprise time slots of computation time, memory areas of memory, or bandwidth of data lines.
9. The method according to any one of claims 1 to 8, characterized in that the computational resources are provided on a server (102).
10. 10. The method of claim 1, wherein the computer-aided development environment in the distributed development process is provided on distributed devices (104).
11. The method of claim 10, characterized in that at least one of the plurality of techniques for recognizing the faults and / or the threats is executed on one of the distributed devices (104) to which the at least one of the plurality of techniques is assigned.
12. 12. An apparatus (106) for allocating computing resources during a method for protecting a computer-aided development environment (100) from failures and threats in a distributed development process, the apparatus (106) comprising at least one processor (108) and at least one memory (110), the at least one processor (108) configured to execute instructions, the apparatus (106) performing the method of any one of claims 1 to 11 upon execution of the instructions by the at least one processor (108), and the at least one memory (110) storing the instructions.
13. A computer program executable by a computer and comprising instructions which, when executed by the computer, perform the method according to any one of claims 1 to 11.