Risk assessment of a container build

Patent metadata

Field	Value
Publication number	US-11775655-B2
Application number	US-202117317043-A
Country	US
Kind code	B2
Filing date	May 11, 2021
Priority date	May 11, 2021
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

An artificial intelligence (AI) platform to support optimization of container builds and virtual machine mounts in a distributed computing environment. A provisioning file is subject to natural language processing (NLP) and a corresponding vector representation of the file is created and subject to evaluation by a set of artificial neural networks (ANN). A first ANN assesses the representation of the file with respect to compliance and operability, and the second ANN selectively assesses the representation of the file with respect to provisioning efficiency. The provisioning file is selectively process based on the provisioning efficiency, with the processing directed at provisioning a container build or mounting a VM.

First claim

What is claimed is:

1. A computer system comprising:
a processor operatively coupled to memory; and
an artificial intelligence (AI) platform in communication with the processor and the memory, the AI platform comprising:
a representation manager configured to employ natural language processing (NLP) to convert a received metadata file associated with provisioning into one or more vector representations;
a neural network manager configured to identify a subject of the provisioning and selectively leverage a first artificial neural network (ANN) responsive to the identified subject, the selective leverage including the first ANN to assign a first score to each of the one or more vector representations, the first score to convey a compliance factor corresponding to operability of the one or more vector representations;
the neural network manager configured to selectively leverage a second ANN responsive to the first score assignment from the first ANN, the second ANN configured to assign a second score to the received metadata file, wherein the second score corresponds to provisioning efficiency; and
the processor to selectively provision a container or virtual machine (VM) responsive to the second score.

2. The computer system of claim 1 , wherein the first score assignment further comprises the first ANN to identify a stored vector representation proximal to the metadata file and measure a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

3. The computer system of claim 2 , further comprising responsive to the first score associated with the one or more stored vector representations exceeding a risk threshold, the first ANN configured to identify a stored compliant vector representation closest to the metadata file and measure the distance between the identified stored compliant vector representation and the metadata file, and wherein the selective leveraging of the second ANN is based on the distance measurement.

4. The computer system of claim 2 , wherein an object of the provisioning is the VM, and further comprising:
the representation manager to convert a VM image file into one or more VM vector representations;
the neural network manager to evaluate the one or more VM vector representations against the second ANN, the second ANN configured to generate a context score, wherein the context score corresponds to a risk associated with mounting the VM; and
the processor to selectively mount the VM responsive to the context score.

5. The computer system of claim 1 , wherein the first score functions as a compliance indicator of the received metadata file, and the second score functions as a provisioning indicator.

6. The computer system of claim 1 , wherein the provisioning is a container build, and further comprising the representation manager configured to convert container image layers within the image container build into one or more image layer vector representations, and assign the first score to each of the one or more image layer vector representations.

7. A computer program product comprising:
a computer readable storage device; and
program code embodied with the computer readable storage device, the program code executable by a processor to:
employ natural language processing (NLP) to convert a received metadata file associated with provisioning into one or more vector representations;
identify a subject of the provisioning, and responsive to the identification to selectively leverage a first artificial neural network (ANN) to assign a first score to each of the one or more vector representations, the first score conveying a compliance factor corresponding to operability of the one or more vector representations;
selectively leverage a second ANN responsive to the first score assignment from the first ANN, the second ANN assigning a second score to the received metadata file, wherein the second score corresponds to provisioning efficiency; and
selectively provision a container or a virtual machine (VM) responsive to the assigned second score.

8. The computer program product of claim 7 , wherein assignment of the first score further comprises the program code to identify a stored vector representation proximal to the metadata file and measure a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

9. The computer program product of claim 8 , further comprising responsive to the first score associated with the one or more stored vector representations exceeding a risk threshold, the first ANN configured to identify a stored compliant vector representation closest to the metadata file and measure the distance between the identified stored compliant vector representation and the metadata file, and wherein the program code to selectively leverage the second ANN is based on the distance measurement.

10. The computer program product of claim 8 , wherein an object of the provisioning is the VM, and further comprising program code to:
convert a VM image file into one or more VM vector representations;
evaluate the one or more VM vector representations against the second ANN, the second ANN configured to generate a context score, wherein the context score corresponds to a risk associated with mounting the VM; and
selectively mount the VM responsive to the context score.

11. The computer program product of claim 7 , wherein the first score functions as a compliance indicator of the received metadata file, and the second score functions as a provisioning indicator.

12. The computer program product of claim 7 , wherein the provisioning is a container build, and further comprising converting container image layers within the image container build into one or more image layer vector representations, and assigning the first score to each of the one or more image layer vector representations.

13. A computer-implemented method comprising:
employing natural language processing (NLP), converting a received metadata file associated with provisioning into one or more vector representations;
identifying a subject of the provisioning, and responsive to the identification selectively leveraging a first artificial neural network (ANN) to assign a first score to each of the one or more vector representations, the first score conveying a compliance factor corresponding to operability of the one or more vector representations;
selectively leveraging a second ANN responsive to the first score assignment from the first ANN, the second ANN assigning a second score to the received metadata file, wherein the second score corresponds to provisioning efficiency; and
selectively provisioning a container or a virtual machine (VM) responsive to the assigned second score.

14. The method of claim 13 , wherein assigning the first score further comprising identifying a stored vector representation proximal to the metadata file and measuring a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

15. The method of claim 14 , further comprising responsive to determining that the first score associated with the one or more stored vector representations exceeds a risk threshold, the first ANN identifying a stored compliant vector representation closest to the metadata file and measuring the distance between the identified stored compliant vector representation and the metadata file, and wherein the selective levera

Assignees

• IBM

Inventors

• Malvankar Abhishek
• Ganci Jr John M
• Fonseca Carlos A
• Beller Charles E

Classifications

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/541

  via adapters, e.g. between incompatible applications · CPC title