Unified Network Topology Eviction for Cloud Incident Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional incident response strategies struggle to adapt to the dynamic and distributed nature of cloud environments, leading to challenges in visibility, control, and delayed response times due to the elastic and geographic spread of cloud resources, as well as the inadequacy of legacy security tools in cloud settings.
Innovation Solution
A system generates a unified network topology using a unified data schema to map multiple data sources, updates and evicts representations of resources based on event records, and applies eviction policies to maintain an accurate network representation, facilitating faster incident detection and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security tools and methodologies are used in cloud environments, then legacy infrastructure protection is maintained, but visibility and protection adequacy in cloud environments deteriorate
Solution Approach 1:
The patent transforms the monitoring approach by changing parameters from traditional security tool metrics to cloud-native event data parameters. It collects and processes cloud event records with specific parameters (resource identifiers, event types, timestamps) to build a dynamic topology that adapts to cloud environment characteristics, thereby improving both reliability and adaptability simultaneously
Solution Approach 2:
The patent replaces traditional mechanical security monitoring systems with an automated information processing system. It uses automated collection, processing, and analysis of cloud event records to generate network topology representations, substituting manual or legacy mechanical monitoring approaches with automated computational methods better suited for dynamic cloud environments
2Loss of information
If comprehensive monitoring is implemented across all cloud services and workloads, then visibility is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex cloud monitoring task into distinct components: event record collection from multiple sources, event processing and enrichment, network topology generation, and incident detection. This segmentation allows each component to handle specific aspects independently, improving visibility while managing system complexity through modular architecture
Solution Approach 2:
The patent introduces an intermediary network topology representation layer between raw cloud event data and incident detection. This topology serves as a simplified intermediary model that captures essential resource relationships without requiring direct processing of all raw event data, thereby improving visibility while reducing the complexity of analysis operations
3Productivity
If cloud resources are dynamically provisioned and de-provisioned in response to demand, then scalability is improved, but visibility and control maintenance deteriorates
Solution Approach 1:
The patent implements a dynamic network topology representation that automatically updates as cloud resources are provisioned or de-provisioned. The system continuously processes event records to add new resources or remove decommissioned resources from the topology, maintaining accurate visibility without hindering the speed of dynamic resource provisioning
Solution Approach 2:
The patent establishes a feedback loop where cloud event records continuously inform the network topology representation. As resources are dynamically created or removed, event records provide feedback that triggers automatic updates to the topology, ensuring visibility is maintained in real-time without interfering with the productivity of automated provisioning processes
Data Source
AI summary
A system and method for evicting a resource from a unified network topology (UNT) of a computing environment, is disclosed. The method includes: generating a representation of a UNT for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each corresponding to a unique data source; receiving an event record at a first time, the event record including a resource identifier; updating in the UNT a representation corresponding to the resource based on extracted data from the event record at the first time; determining that a time period has lapsed from the first time which is greater than a threshold; detecting that a number of event records which include the resource identifier is less than a threshold value; and removing the representation of the resource from the unified network topology.