Computing resource identification

Patent metadata

Field	Value
Publication number	US-10944771-B2
Application number	US-201715586017-A
Country	US
Kind code	B2
Filing date	May 3, 2017
Priority date	May 3, 2017
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

Systems and methods are disclosed for computing network operations. For example, methods may include identifying one or more partial matches between a value associated with a configuration item and a value associated with one or more computing resource types from a set of computing resource types; forming a search query based on the one or more partial matches; invoking a search of one or more information sources using the search query to obtain ranked search results; selecting one computing resource type from the set of computing resource types based on a ranking of the search results; and updating the configuration item to associate the configuration item with the selected computing resource type.

First claim

What is claimed is:

1. A system for normalizing configuration items to facilitate network operations, the system comprising:
a network interface;
a memory; and
a processor, wherein the memory includes instructions executable by the processor to cause the system to:
access a configuration item stored in a configuration management database (CMDB) associated with a computing resource;
identify one or more partial matches between one or more values associated with the configuration item and one or more corresponding values associated with one or more computing resource types, wherein the one or more values comprise alpha-numeric characters associated with the configuration item, and wherein the one or more corresponding values comprise alpha-numeric characters describing the one or more computing resource types;
form a string of alpha-numeric characters extracted from the one or more values based on the one or more partial matches;
send the string of alpha-numeric characters to one or more external information sources as a search query, and wherein the one or more external information sources comprise a network security information provider;
receive, from one or more external information sources, a list of search results from the one or more external information sources based on the search query, and wherein receiving the list of search results comprises:
scraping data stored by the network security information provider to obtain results associated with malware, and wherein the list of search results comprises the results associated with the malware;

display ranked results for the list of search results, wherein the search results are ranked based on a number of occurrences of the string in the search results;
identify one or more ranked candidate computing resource types based on a partial match between a respective record for the one or more ranked candidate computing resource types and a result from the ranked results; and
receive selection of a candidate computing resource type from the one or more ranked candidate computing resource types to update the configuration item to store, in the CMDB, an association between the configuration item and the candidate computing resource type.

2. The system of claim 1 , wherein the memory includes instructions executable by the processor to cause the system to:
detect a deviation from a normal range for a hardware metric for a device; and
correlate the deviation with an installation of a software on the device, wherein the configuration item is associated with the software, the one or more external information sources include one or more information sources listing network security threats, and the candidate computing resource type is a computer malware.

3. The system of claim 1 , wherein the one or more external information sources comprise a cloud-based search provider and wherein the memory includes instructions executable by the processor to cause the system to:
transmit the string to the cloud-based search provider as part of a search request.

4. The system of claim 1 , wherein ranking based on the number of occurrences comprises ranking based on a length of the string, a ratio of matched alpha-numeric characters of the string to each search result of the plurality of search results, a count of repeated occurrences of a term in the string, a proximity of search term occurrences, or a position of a particular search term in the string relative within the plurality of search results, or any combination thereof.

5. A system operable to normalize configuration items stored in a configuration management database (CMDB), wherein the configuration items are associated with computing resources to facilitate network operations, and wherein the system comprises:
a memory; and
a processor, wherein the memory includes instructions executable by the processor to cause the system to:
identify one or more partial matches between a value associated with a configuration item and a corresponding value associated with one or more computing resource types from a set of computing resource types, wherein the value comprises one or more alpha-numeric characters associated with the configuration item, and wherein the corresponding value comprises one or more alpha-numeric characters describing the one or more computing resource types;
form a search query comprising alpha-numeric characters extracted from the value based on the one or more partial matches;
invoke a search of one or more external information sources using the search query to obtain a plurality of search results, wherein the one or more external information sources comprise a network security information provider, and wherein invoking the search comprises:
scraping data stored by the network security information provider to obtain results associated with malware, wherein the plurality of search results comprises the results associated with the malware;

display a ranked list of search results comprising the plurality of search results, wherein the search results are ranked based on a number of occurrences of the search query in the plurality of search results;
receive selection of one computing resource type from the ranked list of search results; and
update the configuration item to associate the configuration item with the selected computing resource type.

6. The system of claim 5 , wherein the memory includes instructions executable by the processor to cause the system to:
detect a deviation from a normal range for a hardware metric for a device; and
correlate the deviation with an installation of a software on the device, wherein the configuration item is associated with the software, the one or more external information sources comprise one or more information sources listing network security threats, and the selected computing resource type is a computer malware.

7. The system of claim 6 , wherein the memory includes instructions executable by the processor to cause the system to:
responsive to detecting the deviation, invoke a discovery probe against the device to obtain probe data; and
determine, based at least in part on the probe data, the configuration item.

8. The system of claim 6 , wherein the plurality of search results are ranked based on the hardware metric.

9. The system of claim 6 , wherein the memory includes instructions executable by the processor to cause the system to:
invoke a security threat mitigation measure based on the updated configuration item.

10. The system of claim 6 , wherein the memory includes instructions executable by the processor to cause the system to:
store, display, or transmit a security alert message based on the updated configuration item.

11. The system of claim 5 , wherein the instructions to select the one computing resource type of the set computing resource types include instructions executable by the processor to cause the system to:
select one search result of the plurality of search results based on the ranking of the search results;
identify a partial match between the selected one search result of the plurality of search results and a value associated with the one computing resource type of the computing resource types; and
select the one computing resource type of the computing resource types based on the partial match between the selected one search result of the plurality of search results and the value associated with the one computing resource type of the computing resource types.

12. A method for associating computing resource types with a computing resource, the method comprising:
accessing a configuration item stored in a configuration management database (CMDB) associated with the co

Assignees

• Servicenow Inc

Inventors

• Borthakur Apolak
• Srivastava Manish
• Xia Yu

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F9/5061 Primary

  Partitioning or combining of resources · CPC title

• G06F8/61

  Installation · CPC title

• G06F16/24578

  using ranking · CPC title

• G06F16/9535

  Search customisation based on user profiles and personalisation · CPC title