Analysis and implementation of security updates

Patent metadata

Field	Value
Publication number	US-11556330-B2
Application number	US-202017102695-A
Country	US
Kind code	B2
Filing date	Nov 24, 2020
Priority date	Nov 24, 2020
Publication date	Jan 17, 2023
Grant date	Jan 17, 2023

Abstract

A method and a system for automating security updates in a multi-tiered architecture of a system environment. The method includes receiving a software update note relating to a multi-tiered architecture system environment and determining a patch in the software update note is initially compatible with the system environment. The method also includes predicting, by a patch acceptance machine learning model, the patch is patchable within the system environment and predicting, by an installation machine learning model, an installation patch time for the patch on the system environment. The method also includes installing the patch at the installation patch time on the system environment, and validating the patch installation using a validation machine learning model.

First claim

What is claimed is:

1. A computer-implemented method of training machine learning models for automating security updates in a multi-tiered architecture system environment, the computer-implemented method comprising:
retrieving historical patch information relating to a system environment;
extracting descriptive data from the historical patch information, wherein the descriptive data includes unstructured data fields and structured data fields;
extracting installation information from each patch in the historical patch information, the installation information includes a date of installation and a time of installation;
determining an installation duration for each patch in the historical patch information;
generating training samples from the installation information and the installation duration;
assembling training datasets from the training samples for a patch acceptance machine learning model and an installation machine learning model; and
training the patch acceptance machine learning model and the installation machine learning model using the training datasets.

2. The computer-implemented method of claim 1 , further comprising:
retrieving log files relating to the system environment, wherein the log files include historical implementation log files, historical system error log files, and short dump log files;
retrieving historical system operation characteristics from the system environment;
computing error rates from the historical implementation log files and the historical system error log files;
computing dump rates from the short dump log files;
extracting additional characteristics from the historical system operation characteristics;
generating additional training samples from the error rates, the dump rates, and the additional characteristics;
assembling an additional training dataset from the additional training samples; and
training a validation machine learning model, wherein the validation machine learning model is trained to validate patch installations performed on the system environment.

3. The computer-implemented method of claim 2 , wherein the additional characteristics include a response time rate, a requisition queue size rate, a table lock average time rate, and an update average time.

4. The computer-implemented method of claim 2 , wherein the validation machine learning model is a long short term memory (LSTM) neural network.

5. The computer-implemented method of claim 1 , wherein generating the training samples comprises:
generating a first set of samples for the patch acceptance machine learning model, wherein each sample in the first set of samples include structured and unstructured data from the historical patch information as features;
generating a second set of samples for the installation machine learning model, wherein each sample in the second set of samples includes an installation time for each of the historical patches as a feature; and
applying a dimension reduction technique to the structured and the unstructured data to generate a vector representation of the features for each sample in the first set of samples.

6. The computer-implemented method of claim 1 , wherein the patch acceptance machine learning model is trained to output a day of a week and a period of implementation for acceptable patches.

7. The computer-implemented method of claim 1 , wherein the installation machine learning model is trained to output an installation time period for acceptable patches on the system environment.

8. The computer-implemented method of claim 1 , wherein the installation machine learning model and the patch acceptance machine learning model are support-vector machines trained using supervised learning techniques.

9. A computer-implemented method of automating security updates in a system environment, the computer-implemented method comprising:
receiving a software update note relating to the system environment, wherein the system environment comprises a multi-tiered architecture system environment;
determining a patch in the software update note is initially compatible with the system environment;
predicting, by a patch acceptance machine learning model, the patch is acceptable in the system environment;
predicting, by an installation machine learning model, an installation time period for the patch on the system environment;
installing the patch during the installation time period on the system environment; and
validating a patch installation relating to the patch using a validation machine learning model, wherein an annotation component is configured to generate a validation training dataset for the validation machine learning model based on error rates and additional characteristics.

10. The computer-implemented method of claim 9 , further comprising:
determining an unsuccessful patch installation using the validation machine learning model; and
generating an alert based on the unsuccessful patch installation.

11. The computer-implemented method of claim 9 , wherein the validation machine learning model is a long short term memory (LSTM) neural network and/or the installation machine learning model and the patch acceptance machine learning model are support-vector machines trained using supervised learning techniques.

12. The computer-implemented method of claim 9 , further comprising:
receiving a second software update note relating to the multi-tiered architecture;
determining a plurality of patches in the second software update note are initially compatible in the system environment;
predicting, by the patch acceptance machine learning model, each patch of the plurality of patches are acceptable in the system environment;
predict, by the installation machine learning model, installation time periods for each patch of the plurality of the patches on the system environment;
assembling a patch list based on the acceptable patches and the corresponding installation time periods;
computing an installation calendar for the system environment based on the patch list;
installing the plurality of patches on the system environment based on the installation calendar; and
validating a plurality of patch installations relating to plurality of patches using the validation machine learning model.

13. The computer-implemented method of claim 9 , further comprising:
generating training datasets for the patch acceptance machine learning model, and the installation machine learning model; and
extracting the additional characteristics from historical system operation characteristics related to the system environment.

14. A system of automating security updates in a multi-tiered architecture system environment, the system comprising:
a memory;
a processor;
local data storage having stored thereon computer executable code;
a system information database configured to store historical patch information and log files relating to a system environment, wherein the system environment comprises a multi-tiered architecture system environment;
a patch acceptance machine learning model configured to predict patch compatibility between a patch and the system environment;
an installation machine learning model configured to predict an installation time period for the patch and the system environment;
a validation machine learning model configured to validate a patch installation performed on the system environment; and
an annotation component configured to generate training datasets for the patch acceptance machine learning model, the installation machine learning model, and the validation machine learning model, wherein the annotation component is further configured t

Assignees

• Kyndryl Inc

Inventors

• Zaina Fabio Zanforlin
• De Bem Ferreira Leonardo
• Galeazzi Silvana
• Milanez Marco Antonio
• Varga Sergio
• Bianchi Thiago

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/08

  Learning methods · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title