Method, computer system and computer program for security risk analysis

Abstract

To solve the problem in which a computing application is not taken into account vulnerability or security analysis because of the complexity of the analysis.SOLUTION: A method, a computer system and a computer program product for security risk analysis are provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates generally to the field of computer processing, and more particularly to machine learning and security. [Background technology]

[0002] Information technology cyber-attacks are on the rise, and as a result, security measures are constantly in need of new and improved methods to negate the effectiveness of cyber-attacks. Cloud computing environments and users of microservices and computing applications, such as microservices, can benefit from increased security measures.

[0003] Having the ability to detect security attacks and computer processing vulnerabilities will reduce risk in an operational computing environment early. Early detection of security problems will also reduce the cost of mitigating security problems. Summary of the Invention [Problem to be solved by the invention]

[0004] Security detection methods consist of searching for vulnerabilities in libraries and base images, but computing applications are not considered in vulnerability or security analysis due to the complexity of the analysis. For example, microservices are vulnerable to security issues because the software services run in public environments or networks.

[0005] A vulnerability in one microservice can easily propagate from one software service to many others within a microservices architecture. Understanding security risks before application deployment can help security professionals and site reliability engineers prepare for potential security breaches.

[0006] A security breach may include the manipulation of programming code that creates files during runtime. A further security breach may include programming code that accesses multiple components in a cloud environment using Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) without validation.

[0007] Programming code that uses older encryption methods is also a security breach or risk in cloud computing environments. Additionally, both cloud and non-cloud computing environments are at risk of security breaches in programming code. For example, a security breach could include a reported security or vulnerability issue, an operating system call with a security issue, or an external library with a configuration-level or environment-level security issue. A further example could include building Kubernetes or K8s, as this build typically involves multiple dependencies. [Means for solving the problem]

[0008] Embodiments of the present invention disclose methods, computer systems, and computer program products for security risk analysis. Embodiments of the present invention may include collecting behavioral data. Embodiments of the present invention may include building a pipeline. Embodiments of the present invention may include localizing security issues using the behavioral data on an unsupervised model. Embodiments of the present invention may include building a semantic graph using left-shifted data. Embodiments of the present invention may include building a mapping between the behavioral data and the left-shifted data. Embodiments of the present invention may include clustering the collected dataset. Embodiments of the present invention may include creating an active learning cycle using ground truth.

[0009] In another aspect of the exemplary embodiments, the method, computer system, and computer program product include utilizing an unsupervised model to identify a top list of representative information about each software application.

[0010] In another aspect of the exemplary embodiments, the method, computer system, and computer program product provide a method for implementing ... Shift Left It involves using the data to build a semantic graph.

[0011] In another aspect of the exemplary embodiments, the method, computer system, and computer program product include automatically clustering collected data sets by security issue.

[0012] In another aspect of the example embodiments, the method, computer system, and computer program product include creating an active learning cycle by collecting feedback from subject matter experts to improve the accuracy of security risk identification by the model over time. [Brief explanation of the drawings]

[0013] These and other objects, features, and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments thereof, which is to be read in connection with the accompanying drawings. Various features of the drawings are not to scale, as the illustrations are for clarity purposes to facilitate understanding of the invention by those skilled in the art, together with the detailed description.

[0014] [Figure 1] FIG. 1 illustrates a networked computing environment in accordance with at least one embodiment.

[0015] [Figure 2] 1 is an operational flowchart illustrating a process for shift-left security risk analysis in accordance with at least one embodiment.

[0016] [Figure 3] FIG. 2 is a block diagram of internal and external components of the computer and server shown in FIG. 1 according to at least one embodiment.

[0017] [Figure 4] FIG. 2 is a block diagram of an exemplary cloud computing environment including the computer system shown in FIG. 1, according to one embodiment of the present disclosure.

[0018] [Figure 5] FIG. 5 is a block diagram of functional layers of the example cloud computing environment of FIG. 4, in accordance with one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0019] Although detailed embodiments of the claimed structures and methods are disclosed herein, it is understood that the disclosed embodiments are merely exemplary of the claimed structures and methods, which may be embodied in various forms. However, the present invention may be embodied in many different ways and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments.

[0020] As previously discussed, information technology cyber-attacks are on the rise, and as a result, security measures are constantly in need of new and improved methods to neutralize cyber-attacks. Cloud computing environments and users of microservices and computing applications, such as microservices, can benefit from enhanced security measures. The ability to detect security attacks or computer processing vulnerabilities early will significantly reduce risk in operational computing environments and reduce the cost of mitigating security issues.

[0021] Many security detection methods consist of searching for vulnerabilities in libraries and base images, but computing applications are not considered in vulnerability or security analysis due to the complexity of the analysis. Microservices or service mesh deployments in cloud-native environments are vulnerable to security issues because software services run in public environments or networks. This makes it easy for one security issue to propagate from one software service to many other services.

[0022] Gaining an understanding of security risks before an image build or application deployment will help security professionals and site reliability engineers prepare for potential breaches. Therefore, among other things, back-up operational experience and historical data is essential. Shift Left It may be advantageous to enable learning, mapping, and analysis of source code patterns and types of security issues that may arise in the code by feeding them into a learning model or environment.

[0023] The exemplary embodiments described below provide systems, methods, and program products for machine learning and security risk analysis. As such, embodiments of the present invention have the ability to improve the field of security by creating machine learning models to learn security patterns from behavioral data. More specifically, the behavioral data is used to build a language-independent knowledge graph to build basic information about security issues in a language-independent format. Shift Left The analysis is used to connect with operational information to formulate a security risk analysis and to predict, recommend, and explain the most likely causes of identified problems.

[0024] According to one embodiment, Shift Left The security risk analysis is created using machine learning. Shift Left The analysis is based on historical data, and Shift Left It may be created using real-time data collected throughout or during the activity. Shift Left The data may include, for example, source code, deployment configurations, deployment specifications, or environment variables, all of which may be used to extend the data with more detail. Shift Left may include practices or methods intended to early identify and prevent defects in the software delivery process. Shift Left aims to improve the quality of the software delivery process by moving tasks to the left as early as possible in the lifecycle. Shift Left The data may include data such as test data, configuration data, requirements, programming code, or any data used in the software delivery lifecycle.

[0025] One use case presented herein is creating predictive and preventative information technology management structures and systems. For example, Shift LeftThe security risk analysis can continuously perform security risk analysis and inform information processing engineers about proactively avoiding security risks. Additionally, the predictive model security risk output can provide further elaboration on security issues to help software and security developers discover and address security issues by providing code-level or configuration-level explanations.

[0026] According to one embodiment, machine learning is used to train and test models using datasets, such as operational data in a computing environment. Various types of machine learning models can be built and used to create predictive results to provide security risk analysis and output that are explainable at the code or configuration level to help identify security issues. Data or information from domains other than the information technology industry can be used to provide predictive results for security risks. Other domains may include, for example, research, compliance, safety data, pharmaceuticals, manufacturing, quality testing, retail, entertainment, social media, commerce, technology, medical, research activities, government, industry, food chain, law, or automotive.

[0027] Machine learning models may include, for example, artificial intelligence models, deep learning models, active learning models, neural networks, convolutional neural networks (CNNs), artificial neural networks (ANNs), and regression models. Deep learning may also be related to or known as layered learning or deep structured learning. The term model may be used to refer to various types of machine learning models, such as deep learning models, neural network models, trained models, attention-based models, classification models, regression models, or decision tree models.

[0028] Training, testing, and updating machine learning models may include using supervised, unsupervised, and semi-supervised machine learning procedures. Supervised learning may use a labeled dataset or a labeled training set to build, train, and update the model. Unsupervised learning may use all unlabeled data to train the model. Semi-supervised learning may use both labeled and unlabeled datasets to train the model. Supervised and semi-supervised learning may incorporate feedback or ground truth by individually checking the accuracy of the data, data labels, annotations, and data classification. Individuals may typically include subject matter experts with extensive knowledge in the specific domain of the dataset.

[0029] Cognitive analytics, such as natural language processing (NLP) and semantic analysis, can be used during model building and training. Cognitive analytics can analyze both structured and unstructured data that is incorporated into the machine learning (ML) process. Natural language processing (NLP) can be used to analyze the quality of data or feedback received for training and model building. Structured data can include highly organized data, such as spreadsheets, relational databases, or data stored in fixed fields. Unstructured data can include data that is unorganized and has an unconventional internal structure, such as portable document formats (PDFs), images, presentations, web pages, video content, audio content, emails, word processing documents, or multimedia content.

[0030] Received data may be processed using natural language processing (NLP) to extract meaningful information for training and building models. Semantic analysis may be used to infer the complexity, meaning, and intent of received information or data. Semantic analysis may also consider the syntactic structure of information at various levels to infer the meaning of words, phrases, sentences, and paragraphs of received, collected, or extracted data. Cognitive analysis may be used, for example, to generate outputs and predictions related to security risks and predicted security issues in a computing environment.

[0031] The input data or datasets used to train, test, and update a model can be, e.g., Shift Left The operational data may include operational data obtained from activities. For example, operational data may include data obtained from operational records (e.g., incident reports or change reports) or operational logs used to track system and network errors. The operational records may also track software analysis or data related to system and network infrastructure analysis, application management in cloud computing networks, enterprise operations, and system security in cloud or hybrid cloud network environments. The operational records may include operational logs or alerts, system logs, network logs, incident tickets, metrics, analytical tools, or analytical systems that track network or application activity. The activity may include normal operational logs, and the activity may include errors in the system. The operational records may include, for example, computational data related to events, alerts, metrics, logs, or messages.

[0032] The input data may also include computer programming code and sections of programming code, such as code snippets. Code snippets may be divided into segments, and different aggregation techniques may be used to improve classification. For example, a code snippet that creates a file during runtime can be manipulated over time with specific permissions, which is a security breach in a cloud environment. Another security breach includes a code snippet that accesses other components using Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) without validation in a cloud environment. Code snippets that use outdated encryption methods are also a security breach in a cloud environment. Programming code that uses outdated encryption methods is also a security breach or risk in a cloud computing environment.

[0033] Additionally, both cloud and non-cloud computing environments are at risk of security breaches in programming code. For example, a security breach may include an external library with a reported security or vulnerability issue, an operating system call with a security issue, or a configuration-level or environment-level security issue. A further example may include building Kubernetes or K8s, as the structure typically includes multiple dependencies.

[0034] Referring to FIG. 1, an exemplary networked computing environment 100 according to one embodiment is shown. The networked computing environment 100 may include a computer 102 having a processor 104 and a data storage device 106 enabled to execute a software program 108 and a security risk program 110a. The networked computing environment 100 may also include a server 112 enabled to execute a security risk program 110b, which may interact with a database 114 and a communications network 116. The computer 102 may also be known as a client computer, and the server 112 may also be known as a server computer. The networked computing environment 100 may include multiple computers 102 and servers 112, only one of which is shown. The communications network 116 may include various types of communications networks, such as a wide area network (WAN), a local area network (LAN), a telecommunications network, a wireless network, a public switched network, or a satellite network, or combinations thereof. It should be understood that FIG. 1 provides an illustration of one implementation only and is not intended to suggest any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements.

[0035] The computer 102 may communicate with the server 112 via a communications network 116. The communications network 116 may include connections such as wired, wireless communication links, or fiber optic cables. As discussed with reference to FIG. 3 , the server 112 may include internal components 902a and 904a, respectively, and the computer 102 may include internal components 902b and 904b, respectively. The server 112 may also operate in a cloud computing service model such as Software as a Service (SaaS), Analytics as a Service (AaaS), Blockchain as a Service (BaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS). The server 112 may also be located in a cloud computing deployment model such as a private cloud, a community cloud, a public cloud, or a hybrid cloud. The computer 102 may be, for example, a mobile device, a phone, a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing device capable of running programs, accessing a network, and accessing the database 114. According to various implementations of the present embodiment, the security risk programs 110a, 110b may interact with the database 114, which may be embedded in various storage devices, such as, but not limited to, the computer / mobile device 102, the server 112, or a cloud storage service.

[0036] According to this embodiment, a user operating a computer 102 or a server 112 (e.g., a server computer) may use security risk programs 110a, 110b (respectively) to predict and identify security risks in a computing environment. The security risk method is described in more detail below with respect to FIG. 2.

[0037] Referring now to FIG. 2, an exemplary security risk program 110a, 110b for use with the security risk programs 110a, 110b is shown in accordance with at least one embodiment. Shift Left An operational flow chart illustrating a security risk analysis process 200 is shown.

[0038] At 202, operational data is collected. The operational data is collected to train a machine learning model. The operational data may be used as a training dataset and a test dataset to train the model. The operational dataset may include, for example, analysis incident tickets, logs, metrics, results of analysis tools such as vulnerability advisors or change advisors. The operational datasets, such as test results and static analysis, may be used to build a pipeline. The operational data may be collected from one or more sources, databases, repositories, or knowledge bases, such as a log management system repository, a configuration management database or system, or an observability store.

[0039] At 204, a pipeline is built. A pipeline may be built as a set of automated processes. For example, a DevOps pipeline builds, tests, and deploys computational data. A pipeline may include, for example, a computer ticketing system. A pipeline may be built, for example, with one pipeline of data that may process development data from a ticketing system and another pipeline of data that may process operational or production data. The ticketing system may have security protocols and may be used by the DevOps pipeline with continuous delivery of the collected computational data. A DevOps pipeline may include, for example, a system that combines Internet technology operations with software development.

[0040] The development section of the pipeline may include planning, adapting, prototyping, validating, creating, and releasing new features. The operational pipeline may include preventing, detecting, responding to, and predicting client impact events. The DevOps pipeline may be run in a cloud computing environment, and the pipeline may be used to create application logs, system logs, metrics, and analysis tool logs.

[0041] At 206, the security issue is localized. The security issue may be localized based on the operational data collected in step 202 and the pipeline data created in step 204. Location information may be extracted from data obtained by building an unsupervised model to identify each software application or a top list of representative information about the application. For example, the top list of representative information may include component names and service names. The top list of representative information or data may be identified using, for example, analysis incident tickets, logs, metrics, and results of analysis tools with an unsupervised model.

[0042] Unsupervised machine learning algorithms can be used to identify relevant information such as authorizations or names of services using topic modeling, clustering, or a priori or ontologies. As an example, see the following expression: P(word=Auth, topic=1|θ d , β1)=P(word=Auth | topic=1, β 1) P(topic=1|θ d ), where each topic has a word distribution (word=Auth|topic=1, β1) that is global across all documents, and each topic has a word distribution (topic=1|θ d) where β1 represents the probability of a token, which is the joint probability of the word and topic label. P represents probability, θ_d represents the topic proportion of document d, and β_k represents the distribution across the vocabulary of topic k.

[0043] Security issues can be localized and Shift Left The localization or identified security problem may include the location of the problem or the source of the problem. For example, a problem may be localized by knowing what code or library is executing when an error occurs, so the connection information may be located in the code or function. Shift Left For each security issue, the problem or issue can be localized using application logs and system logs. The security issues can be found using the unsupervised model built above.

[0044] Location information and representative keywords or words can be extracted. The location information and representative keywords can be extracted by using a built unsupervised model. The information or unsupervised model output can be correlated to match the same location information from different sources. The information or unsupervised model output can also be correlated to excluded references that are not identified at that location.

[0045] At 208, a semantic graph is constructed. The semantic graph includes information such as source code, configuration information, and build information. Shift LeftThe data may be built, constructed, or created using the data. A build may refer to the process of converting files into a software product. For example, files such as code and libraries are converted into a software product, and the build includes information about file versions. Based on the localized security issues, the security issues may be correlated by attributing the localized issues as a graph representation. The semantic graph may include a graph that indicates or represents a programming language. The source code, configuration information, and build information may be obtained and updated over time. The source code may be collected, for example, from a git repository. The semantic graph may include Shift Left The data can be used to update to show changes over time. For example, changes to source code can be Shift Left The data may be presented as a graph showing changes over time.

[0046] 210, the operational data and Shift Left A mapping is constructed between the operational data and the Shift Left The data is used to build a mapping to identify which parts or sections of code or configuration contain the source of the security issue. The mapping can be built, for example, using the time a new build was deployed along with locations from the operational data, which would point to the source code files (e.g., version or date) that were modified in the build.

[0047] At 212, the collected data sets are automatically clustered. The collected data sets are automatically clustered by security issue. Clustering the collected data sets allows for learning of patterns of security issues. The patterns of security issues can be provided to a baseline vulnerability calculator, such as a Common Vulnerability Scoring System, to calculate risk.

[0048] The clustered dataset and semantic graph can be used to learn security classes or classifications of code. For example, using the vector embedding graph and security classification information, a model can be built on the graph using a neural network. The graph embedding can be used to convert the property graph into a vector or set of vectors. A graph neural network, such as a gated graph neural network, a graph long-short-term memory (LSTM) neural network, or a graph convolutional network, can be applied. The training data or training dataset can include, for example, graph embeddings or classes. For example, the graph can be embedded, and the graph embedding can be fed into a graph neural network. The graph neural network will provide classifications such as attack vectors, access complexity, authentication, confidentiality impact, integrity impact, and availability impact. A model can also be built starting with a graph and ending with a classification.

[0049] Security patterns can be classified. Security patterns can be collected from many software engineers who share their patterns on public and private databases. A security pattern can be, for example, a design pattern or a description of how to design or implement a system with a particular type of security. Categorizing security patterns into known classes or types of attacks can aid in calculating the risk level of a security issue. For example, attack vector, access complexity, authentication, confidentiality impact, integrity impact, and availability impact are classifications. Mapping security patterns to security types can be identified, for example, using the existing Common Vulnerabilities and Exposures (CVE) database, which maps patterns to Common Vulnerabilities and Exposures (CVSS) scores. Patterns from the Common Vulnerabilities and Exposures (CVE) database can be used to calculate a pattern vulnerability score using the Common Vulnerability Scoring System (CVSS).

[0050] Security patterns may be based on and classified by learning from past security incidents, for example, from sources from cloud history such as incident tickets, logs, and metrics, or from configuration comments. The security risk programs 110a, 110b may, for example, capture the semantics of code and configuration data to enable security issues to be automatically captured in a language-independent manner. Benefits of capturing security issues in a language-independent manner may include enabling user-provided artifacts, such as tickets written in different programming languages, to be able to translate or convert similar information from various languages ​​into the ability to identify recurring security issues or patterns.

[0051] The security patterns may be fed into a classifier and the model output may include, for example, a class and a type. A security risk level or security risk calculation may include, for example, using the classification model output and the Common Vulnerability Scoring System (CVSS) to calculate a vulnerability score. Time and environmental score metrics may be added to reflect the impact of the situation. The impact of the situation may include, for example, the impact on an operating system or a particular network provider. Example vulnerability scoring and metrics for time and environmental score metrics may also be calculated using a Common Vulnerability Scoring System calculator.

[0052] At 214, an active learning cycle is created that uses the ground truth. The active learning cycle may include an active learning feedback model or component that incorporates the ground truth, for example, by enabling software developers or subject matter experts the ability to provide feedback that can be consumed by the learning model. The active learning component may enable capturing expert knowledge, which may include capturing real-time data. Continuous validation, tuning, and correction of model inaccuracies over time using subject matter experts to update classifications may be used as an active learning component. The active learning cycle may be retrained at any time, for example, periodically, online or in offline mode.

[0053] The active learning component may, for example, employ a hyperplane that represents only labeled data (i.e., separates data points on one side of the plane or another) and use experts to modify the labels to provide transductive learning (i.e., infer inferences from specific examples or information). The active learning component may utilize supervised and semi-supervised models to introduce real-time information or expert feedback that is added as ground truth. Active learning may be used, for example, by obtaining subject matter experts (SMEs) or software developer feedback as ground truth during the model training, testing, and validation phases. User knowledge or expert knowledge may be captured as real-time data.

[0054] Active learning cycles are beneficial because data sources may not always fully represent security issues. Allowing user feedback to adjust or correct information allows the model to improve its accuracy in identifying security risks over time. Subject matter experts can provide information that allows the learning model to adjust over time to correct for any inaccuracies in the model or data sources.

[0055] As an example, an active learning system or model may use behavioral data and Shift Left Automatically mapping data can be used to identify which parts of code or configuration are the source of a security issue. A learning model can be used to build a graph using data from a repository. The data from the repository is used by the learning model to create a graphical representation of the data. For example, the learning model can be used to derive meta-information from a subtree or sub-graph. For each repository or database, information such as source code, configuration information (e.g., libraries), and build specifications is collected. The learning model can be used to provide a sub-graph for a node. The sub-graph can have data or metadata represented as labels. A graph convolution operation can be used to average a node's features with the features of its neighbors. Unlike image or text data, node neighborhoods may be unordered and may be of variable size. For example, sub-graphs node A and node X can be processed through one or more graph convolutional networks (GCNs), followed by a pooling function and then processed by a multilayer perceptron (MLP) network. The output can provide a softmax layer that represents meta-information for one or more node features.

[0056] It will be appreciated that Figure 2 is provided only as an illustration of one embodiment and is not intended to suggest any limitations as to how different embodiments may be implemented. Many modifications to the embodiment shown may be made based on design and implementation requirements.

[0057] Figure 3 is a block diagram 900 of the internal and external components of the computer shown in Figure 1 in accordance with an exemplary embodiment of the present invention. It should be understood that Figure 3 is intended to be an illustration of only one implementation and is not intended to suggest any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made based on design and implementation requirements.

[0058] Data processing systems 902, 904 are representative of any electronic device capable of executing machine-readable program instructions. Data processing systems 902, 904 are representative of smartphones, computer systems, PDAs, or other electronic devices. Examples of computing systems, environments, or configurations, or combinations thereof, that may be represented by data processing systems 902, 904 include, but are not limited to, personal computer systems, server computer systems, thin client, thick client, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network PCs, minicomputer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0059] The computer 102 and the server 112 may each include a set of internal components 902a, b and external components 904a, b, as shown in Figure 3. Each of the sets of internal components 902a, b includes one or more processors 906, one or more computer-readable RAMs 908, and one or more computer-readable ROMs 910 on one or more buses 912, as well as one or more operating systems 914 having one or more application programs 915 and one or more computer-readable storage media 915. The one or more operating systems 914, software programs 108, and security risk program 110a in the client computer 102 and the security risk program 110b in the network server 112 may be stored on one or more computer-readable storage media 915 for execution by the one or more processors 906 via the one or more RAMs 908 (which typically include cache memory). In the embodiment shown in Figure 3, each of the computer-readable storage media 915 is an internal hard drive magnetic disk storage device. Alternatively, each of the computer-readable storage media 915 is a semiconductor storage device such as a ROM 910, an EPROM, a flash memory, or any other computer-readable tangible storage device capable of storing computer programs and digital information.

[0060] Each set of internal components 902a,b also includes an R / W drive or interface 918 for reading from and writing to one or more computer-readable tangible storage devices 920, such as a CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk, or semiconductor storage device. Software programs, such as software program 108 and security risk program 110a, 110b, may be stored on one or more of the respective portable computer-readable tangible storage devices 920, read via the corresponding R / W drive or interface 918, and loaded onto the corresponding hard drive 916.

[0061] Each set of internal components 902a, b may also include a network adapter (or switch port card) or interface 922, such as a TCP / IP adapter card, a wireless Wi-Fi interface card, or a 3G / 4G / 5G wireless interface card or other wired or wireless communication link. The software program 108 and security risk program 110a in the computer 102 and the security risk program 110b in the network server 112 are downloadable from a network (e.g., the Internet, a local area network, or other wide area network) and an external computer (e.g., a server) via the respective network adapter or interface 922. From the network adapter (or switch port adapter) or interface 922, the software program 108 and security risk program 110a in the computer 102 and the security risk program 110b in the network server computer 112 are loaded onto the corresponding hard drive 916. The network may include copper wire, optical fiber, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof.

[0062] Each of the set of external components 904 a,b can include a computer display monitor 924, a keyboard 926, and a computer mouse 928. The external components 904 a,b can also include touch screens, virtual keyboards, touchpads, pointing devices, and other human interface devices. Each of the set of internal components 902 a,b also includes a device driver 930 for interfacing to the computer display monitor 924, the keyboard 926, and the computer mouse 928. The device driver 930, the R / W drive or interface 918, and the network adapter or interface 922 include hardware and software (stored in the storage device 916 or the ROM 910, or a combination thereof).

[0063] Although this disclosure includes detailed descriptions related to cloud computing, it should be understood in advance that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be practiced in conjunction with any other type of computing environment now known or later developed.

[0064] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0065] Characteristics include: On-Demand Self-Service: Cloud consumers unilaterally provision computing capabilities, such as server time and network storage, automatically as needed without requiring human interaction with the service provider. Broad Network Access: Capabilities that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs) are available over the network and accessed through standard mechanisms. Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, so that different physical and virtual resources are dynamically allocated and reallocated according to demand. There is a sense of location independence, in that consumers generally have no control or knowledge over the exact location of the provided resources but can specify location at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Capabilities can be rapidly provisioned, sometimes automatically and elastically, to quickly scale out, and rapidly released to quickly scale in. To consumers, the capabilities available for provisioning often appear unlimited, and any amount can be purchased at any time. Pay-per-use services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0066] The service models are as follows: Software as a Service (SaaS): The functionality offered to the consumer is the use of the provider's applications running on a cloud infrastructure or hybrid cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The functionality offered to the consumer is the deployment of consumer-created or acquired applications, created using programming languages ​​and tools supported by the provider, on a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating system, or storage, but does control the deployed applications and, in some cases, the application hosting environment configuration. Analytics as a Service (AaaS): The functionality offered to the consumer is the use of a web-based or cloud-based network (i.e., infrastructure) to access an analytics platform. The analytics platform may include access to analytics software resources, or may include access to associated databases, corpora, servers, operating systems, or storage. The consumer does not manage or control the underlying web-based or cloud-based infrastructure, including databases, corpora, servers, operating systems, or storage, but does control the deployed applications and, in some cases, the application hosting environment configuration.Infrastructure as a Service (IaaS): The capability offered to consumers is to provision processing, storage, network, and other underlying computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and, in some cases, limited control over the selection of networking components (e.g., host firewalls).

[0067] Deployment models include: Private cloud: The cloud infrastructure operates exclusively for one organization. It may be managed by this organization or a third party and may exist on-premises or off-premises. Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by this organization or a third party and may exist on-premises or off-premises. Public cloud: The cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services. Hybrid cloud: The cloud infrastructure remains a unique entity but is a combination of two or more clouds (private, community, or public) tied together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0068] Cloud computing environments are service-oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0069] Referring now to FIG. 4 , an exemplary cloud computing environment 1000 is shown. As shown, the cloud computing environment 1000 includes one or more cloud computing nodes 1050 with which local computing devices used by cloud consumers may communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 1000A, a desktop computer 1000B, a laptop computer 1000C, or an automobile computer system 1000N, or a combination thereof. The cloud computing nodes 1050 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as a private, community, public, or hybrid cloud, or a combination thereof, as described above. This enables the cloud computing environment 1000 to provide infrastructure, platform, or software, or a combination thereof, as a service, such that cloud consumers do not need to maintain resources on their local computing devices. It should be understood that the types of computing devices 1000A-N shown in FIG. 4 are intended to be illustrative only, and that computing node 1050 and cloud computing environment 1000 can communicate with any type of computer device via any type of network or network-addressable connection or combination thereof (e.g., using a web browser).

[0070] Referring now to Figure 5, there is shown a set of functional abstraction layers 1100 provided by the cloud computing environment 1000. It should be understood in advance that the components, layers, and functions shown in Figure 5 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0071] Hardware and software layer 1102 includes hardware and software components. Examples of hardware components include mainframe 1104, RISC (reduced instruction set computer) architecture-based servers 1106, servers 1108, blade servers 1110, storage devices 1112, and networks and networking components 1114. In some embodiments, software components include network application server software 1116 and database software 1118.

[0072] The virtualization layer 1120 provides an abstraction layer over which the following examples of virtual entities may be provided: virtual servers 1122, virtual storage 1124, virtual networks including virtual private networks 1126, virtual applications and operating systems 1128, and virtual clients 1130.

[0073] In one example, management layer 1132 may provide the functions described below. Resource provisioning 1134 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 1136 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may comprise application software licenses. Security provides identity verification for cloud consumers and tasks and protection of data and other resources. User portal 1138 provides consumer and system administrator access to the cloud computing environment. Service level management 1140 provides cloud computing resource allocation and management to meet required service levels. Service level agreement (SLA) planning and fulfillment 1142 provides proactive provisioning and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0074] The workload layer 1144 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation 1146, software development and lifecycle management 1148, virtual classroom instruction delivery 1150, data analytics processing 1152, transaction processing 1154, and security risk analysis 1156. The security risk programs 110a, 110b provide a way to provide security risk analysis using machine learning.

[0075] The present invention may be a system, method, or computer program product, or combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium 915 (or medium) having computer-readable program instructions for causing a processor 906 to perform aspects of the present invention.

[0076] The computer-readable storage medium 915 may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. The computer-readable storage medium 915 may be, for example, without limitation, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer-readable storage medium 915 includes the following: a portable computer diskette, a hard disk, a random access memory (RAM) 908, a read-only memory (ROM) 910, an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a punch card or a mechanically encoded device such as a raised structure in a groove in which instructions are recorded, and any suitable combination of the foregoing. Computer-readable storage medium 915, as used herein, is not to be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0077] The computer-readable program instructions described herein can be downloaded from the computer-readable storage medium 915 to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface 922 in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage in the computer-readable storage medium 915 within the corresponding computing / processing device.

[0078] Computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the “C” programming language, the Python programming language, or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions to personalize the electronic circuitry by utilizing state information of the computer-readable program instructions to perform aspects of the present invention.

[0079] Aspects of the present invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations or block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams, or combinations thereof, can be implemented by computer-readable program instructions.

[0080] These computer-readable program instructions may be provided to processor 906 of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by processor 906 of the computer or other programmable data processing apparatus, result in means for performing the functions / acts specified in one or more blocks of the flowcharts or block diagrams, or combinations thereof. These computer-readable program instructions may also be stored on computer-readable storage medium 915 that can direct a computer, programmable data processing apparatus, or other device, or combinations thereof, to function in a particular manner, such that computer-readable storage medium 915 having instructions stored thereon comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts or block diagrams, or combinations thereof.

[0081] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to produce a computer-implemented process such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / acts specified in one or more blocks of the flowcharts or block diagrams or combinations thereof.

[0082] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be realized as a single step executed substantially simultaneously, partially or fully overlapping in time, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of a block or flowchart diagram, or combination thereof, and combinations of blocks in a block or flowchart diagram, or combination thereof, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0083] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements to technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A method for security risk analysis, comprising: a processor collecting operational data; a processor building a pipeline based on the collected operational data; a processor localizing a location of a security issue based on the behavioral data and the pipeline data on an unsupervised model; a processor constructing a semantic graph using the shift-left data; a processor constructing a mapping between the motion data and the shift left data; a processor clustering the collected data set by said security issue; a processor creating an active learning cycle using ground truth based on the clustered dataset, the active learning cycle mapping the behavioral data and the shift-left data to identify a source of the security issue.

2. The method of claim 1 , wherein the pipeline is built as an automated process that builds, tests, and deploys computational data.

3. The method of claim 1 or 2, wherein the unsupervised model identifies a top list of representative information about each software application.

4. The method of claim 1 , wherein the shift-left data includes source code, deployment configurations, deployment specifications, and environment variables.

5. The method of claim 1 , wherein the semantic graph is constructed using the shift-left data.

6. The method of claim 1 , wherein the collected data sets are automatically clustered by the security issues.

7. The method of claim 1 , wherein the active learning cycle enables feedback from subject matter experts to improve the accuracy of security risk identification by the model over time.

8. one or more processors; one or more computer-readable memories; one or more computer-readable tangible storage media; and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors by at least one of the one or more computer-readable memories. A computer system for security risk analysis, comprising: The computer system includes: collecting operational data; building a pipeline based on the collected operational data; localizing a location of a security issue based on the behavioral data and the pipeline data on an unsupervised model; building a semantic graph using shift-left data; establishing a mapping between the motion data and the shift-left data; clustering the collected data set according to the security issue; creating an active learning cycle using ground truth based on the clustered dataset, the active learning cycle mapping the behavioral data and the shift-left data to identify sources of the security issues; and A computer system capable of performing a method including:

9. The computer system of claim 8 , wherein the pipeline is built as an automated process for building, testing, and deploying computational data.

10. The computer system of claim 8 or 9, wherein the unsupervised model identifies a top list of representative information about each software application.

11. The computer system of claim 8 , wherein the shift-left data includes source code, deployment configurations, deployment specifications, and environment variables.

12. The computer system of claim 8 , wherein the semantic graph is constructed using the shift-left data.

13. The computer system of claim 8 , wherein the collected data sets are automatically clustered by the security issues.

14. 14. The computer system of claim 8, wherein the active learning cycle enables feedback from subject matter experts to improve the accuracy of security risk identification by the model over time.

15. A computer program for security risk analysis, comprising: The processor a procedure for collecting operational data; building a pipeline based on the collected operational data; localizing a location of a security issue based on the behavioral data and the pipeline data on an unsupervised model; Steps for building a semantic graph using shift-left data, and constructing a mapping between the motion data and the shift-left data; clustering the collected data set according to the security problem; creating an active learning cycle using ground truth based on the clustered dataset, the active learning cycle mapping the behavioral data and the shift-left data to identify sources of the security issues; and A computer program for executing

16. 16. The computer program of claim 15, wherein the pipeline is built as an automated process for building, testing, and deploying computational data.

17. 17. The computer program of claim 15 or 16, wherein the unsupervised model identifies a top list of representative information for each software application.

18. 18. The computer program of claim 15, wherein the shift-left data includes source code, deployment configurations, deployment specifications, and environment variables.

19. 19. The computer program of claim 15, wherein the semantic graph is constructed using the shift-left data.

20. 20. The computer program of claim 15, wherein the collected data sets are automatically clustered by the security issue.

Images