Determining application security and correctness using machine learning based clustering and similarity

Patent metadata

Field	Value
Publication number	US-11831729-B2
Application number	US-202117207166-A
Country	US
Kind code	B2
Filing date	Mar 19, 2021
Priority date	Mar 19, 2021
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint. The operations further include, based on the comparing, determining a disparity between software applications installed on the particular computing device and the reference computing device, and storing, in the persistent storage, a representation of the disparity.

First claim

What is claimed is:

1. A computing system comprising:
persistent storage configured to store representations of software applications installed on computing devices; and
one or more processors configured to perform operations comprising:
retrieving, from the persistent storage, (i) a first plurality of representations of a first plurality of software applications installed on a particular computing device of the computing devices and (ii) a second plurality of representations of a second plurality of software applications installed on a reference computing device of the computing devices;
determining a corresponding importance value for each respective software application of the first plurality of software applications and the second plurality of software applications;
generating (i) a device fingerprint of the particular computing device by processing the first plurality of representations and the corresponding importance values thereof by a machine learning model that has been trained to generate device fingerprints based on representations of software applications and corresponding importance values thereof and (ii) a reference device fingerprint of the reference computing device by processing the second plurality of representations and the corresponding importance values thereof by the machine learning model, wherein the device fingerprint represents a transformation by the machine learning model of the first plurality of representations according to the corresponding importance values thereof, and wherein the reference device fingerprint represents a transformation by the machine learning model of the second plurality of representations according to the corresponding importance values thereof;
comparing the device fingerprint to the reference device fingerprint;
based on comparing the device fingerprint to the reference device fingerprint, determining a disparity between software applications installed on the particular computing device and the reference computing device; and
storing, in the persistent storage, a representation of the disparity.

2. The computing system of claim 1 , wherein:
retrieving the first plurality of representations and the second plurality of representations comprises retrieving, for each respective computing device of the computing devices, a corresponding plurality of representations of a corresponding plurality of software applications installed on the respective computing device,
determining the corresponding importance value comprises determining, for each respective computing device of the computing devices, corresponding importance values for the corresponding plurality of software applications installed on the respective computing device,
generating the device fingerprint and the reference device fingerprint comprises generating, for each respective computing device, a corresponding device fingerprint by processing the corresponding plurality of representations and the corresponding importance values thereof by the machine learning model,
comparing the device fingerprint to the reference device fingerprint comprises determining, based on the corresponding device fingerprint determined for each respective computing device, two or more clusters of the computing devices,
a first cluster of the two or more clusters includes the particular computing device and the reference computing device,
the operations further comprise:
obtaining a selection of the first cluster, and
obtaining a selection of the reference computing device from the first cluster.

3. The computing system of claim 2 , wherein determining the disparity between software applications installed on the particular computing device and the reference computing device comprises:
determining, for each respective computing device that is part of the first cluster, a corresponding disparity between software applications installed on the respective computing device that is part of the first cluster and the reference computing device.

4. The computing system of claim 1 , wherein:
retrieving the first plurality of representations and the second plurality of representations comprises retrieving, for each respective computing device of the computing devices, a corresponding plurality of representations of a corresponding plurality of software applications installed on the respective computing device,
determining the corresponding importance value comprises determining, for each respective computing device of the computing devices, corresponding importance values for the corresponding plurality of software applications installed on the respective computing device,
generating the device fingerprint and the reference device fingerprint comprises generating, for each respective computing device, a corresponding device fingerprint by processing the corresponding plurality of representations and the corresponding importance values thereof by the machine learning model,
the operations further comprise obtaining a selection of the reference computing device from the computing devices, and
comparing the device fingerprint to the reference device fingerprint comprises, based on obtaining the selection of the reference computing device, determining, for each respective computing device, a similarity value indicative of a similarity between the respective computing device and the reference computing device.

5. The computing system of claim 4 , wherein determining the disparity between software applications installed on the particular computing device and the reference computing device comprises determining, for each respective computing device having a similarity value that exceeds a threshold similarity value, a corresponding disparity between software applications installed on the respective computing device and the reference computing device.

6. The computing system of claim 5 , wherein:
comparing the device fingerprint to the reference device fingerprint further comprises determining a ranking of the computing devices based on the similarity value determined for each respective computing device, and
the operations further comprise displaying representations of computing devices that have similarity values that exceed the threshold similarity value, wherein the representations are displayed arranged according to the ranking.

7. The computing system of claim 1 , wherein determining the disparity between software applications installed on the particular computing device and the reference computing device comprises:
identifying a compliant software application that is installed on both the particular computing device and the reference computing device;
identifying a missing software application that is installed on the reference computing device but is not installed on the particular computing device; or
identifying an unauthorized software application that is installed on the particular computing device but is not installed on the reference computing device.

8. The computing system of claim 7 , wherein the operations further comprise:
retrieving, from the persistent storage, the representation of the disparity;
receiving a selection of a category comprising at least one of: (i) a compliant category corresponding to the compliant software application, (ii) a missing category corresponding to the missing software application, or (iii) an unauthorized category corresponding to the unauthorized software application;
filtering the first plurality of representations based on the category; and
causing display of results of the filtering.

9. The computing system of claim 1 , wherein the operations further comprise:
retrieving, from the persistent storage, the representation of the disparity;
displaying, by way of a user interface,

Assignees

• Servicenow Inc

Inventors

• Herzog Shay
• Bhagat Aakash Umeshbhai
• Zateikin Olga
• Bitterfeld Robert
• Garty Asaf

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L67/34 Primary

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• G06F18/23

  Clustering techniques · CPC title

• G06N20/00

  Machine learning · CPC title