Pattern-based detection using data injection

Patent metadata

Field	Value
Publication number	US-11327953-B2
Application number	US-201916692100-A
Country	US
Kind code	B2
Filing date	Nov 22, 2019
Priority date	Dec 18, 2013
Publication date	May 10, 2022
Grant date	May 10, 2022

Abstract

Pattern based detection of data usage is facilitated using data injection. Data values are injected in one or more storage locations accessible to a plurality of services or included in service requests. Service interactions among the services are compared to a set of patterns. The set of patterns are configured to match the data values. By comparing the service interactions to the patterns, one or more of the service interactions are determined to include individual ones of the data values. Data are generated indicating a presence of the data values in the services.

First claim

What is claimed is:

1. A system, comprising:
one or more processors and one or more memories to store computer-executable instructions that, when executed, cause the one or more processors to:
generate a plurality of patterns to match respective ones of the plurality of predefined data values that correspond to respective types of data to be detected, wherein the plurality of predefined data values were injected into a plurality of services;
cause a plurality of service requests or responses to be generated among the plurality of services, wherein the plurality of services are configured to compare the plurality of service requests or responses to the plurality of patterns;
receive, from the plurality of services, data indicative of one or more data flows of the one or more predefined data values between the plurality of services;
receive, from the plurality of services, additional data indicative of one or more additional data flows of the one or more predefined data values between the plurality of services;
detect one or more changes among the plurality of services based at least in part on a comparison of the one or more data flows to the one or more additional data flows; and
generate a notification or an alarm based on the detected one or more changes among the plurality of services.

2. The system as recited in claim 1 , wherein the one or more additional data flows represent a different time window than the one or more data flows.

3. The system as recited in claim 1 , wherein the one or more additional data flows represent a different execution environment than the one or more data flows.

4. The system as recited in claim 1 , wherein the one or more data flows are represented using a first call graph, and wherein the one or more additional data flows are represented using a second call graph.

5. The system as recited in claim 4 , wherein the one or more changes among the plurality of services are represented using a call graph delta between the first call graph and the second call graph.

6. The system as recited in claim 4 , wherein the one or more changes among the plurality of services correspond to one or more nodes in the first call graph or second call graph, and wherein the one or more nodes in the first call graph or second call graph are highlighted in a report.

7. A method, comprising:
generating a plurality of patterns to match respective ones of the plurality of predefined data values that correspond to respective types of data to be detected, wherein the plurality of predefined data values were injected into a plurality of services;
causing a plurality of service requests or responses to be generated among the plurality of services, wherein the plurality of services are configured to compare the plurality of service requests or responses to the plurality of patterns;
receiving, from the plurality of services, data indicative of one or more data flows of the one or more predefined data values between the plurality of services;
receiving, from the plurality of services, additional data indicative of one or more additional data flows of the one or more predefined data values between the plurality of services;
detecting one or more changes among the plurality of services based at least in part on a comparison of the one or more data flows to the one or more additional data flows; and
generating a notification or an alarm based on the detected one or more changes among the plurality gf services.

8. The method as recited in claim 7 , wherein the one or more additional data flows represent a different time window than the one or more data flows.

9. The method as recited in claim 7 , wherein the one or more additional data flows represent a different execution environment than the one or more data flows.

10. The method as recited in claim 7 , wherein the one or more data flows are represented using a first call graph, and wherein the one or more additional data flows are represented using a second call graph.

11. The method as recited in claim 10 , wherein the one or more changes among the plurality of services are represented using a call graph delta between the first call graph and the second call graph.

12. The method as recited in claim 10 , wherein the one or more changes among the plurality of services correspond to one or more nodes in the first call graph or second call graph, and wherein the one or more nodes in the first call graph or second call graph are highlighted in a report.

13. One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:
generating a plurality of patterns to match respective ones of the plurality of predefined data values that correspond to respective types of data to be detected, wherein the plurality of predefined data values were injected into a plurality of services;
causing a plurality of service requests or responses to be generated among the plurality of services, wherein the plurality of services are configured to compare the plurality of service requests or responses to the plurality of patterns;
receiving, from the plurality of services, data indicative of one or more data flows of the one or more predefined data values between the plurality of services;
receiving, from the plurality of services, additional data indicative of one or more additional data flows of the one or more predefined data values between the plurality of services;
detecting one or more changes among the plurality of services based at least in part on a comparison of the one or more data flows to the one or more additional data flows; and
generating a notification or an alarm based on to the detected one or more changes among the plurality of services.

14. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the one or more additional data flows represent a different time window than the one or more data flows.

15. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the one or more additional data flows represent a different execution environment than the one or more data flows.

16. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the one or more data flows are represented using a first call graph, and wherein the one or more additional data flows are represented using a second call graph.

17. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein the one or more changes among the plurality of services are represented using a call graph delta between the first call graph and the second call graph.

18. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein the one or more changes among the plurality of services correspond to one or more nodes in the first call graph or second call graph, and wherein the one or more nodes in the first call graph or second call graph are highlighted in a report.

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Porter Brandon William
• Zhuo Donghui

Classifications

• G06F16/23 Primary

  Updating · CPC title

• G06F16/2365 Primary

  Ensuring data consistency and integrity · CPC title