Early validation of communication behavior

Patent metadata

Field	Value
Publication number	US-12255904-B2
Application number	US-202117236612-A
Country	US
Kind code	B2
Filing date	Apr 21, 2021
Priority date	Apr 21, 2021
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

One example method includes extracting an expected communication specification of a service that is in development in a build pipeline, stimulating the service to exercise communication variations of the service, capturing communication traffic involving the service and one or more endpoints, comparing the captured communication traffic to the expected communication specification, and based on the comparing, detecting, in the captured communication traffic, and flagging, any anomalous communication behavior of the service.

First claim

What is claimed is:

1. A method, comprising:
extracting an expected communication specification of a service, which is in development in a build pipeline, from a source code repository for the service, wherein the build pipeline runs each time source code changes are introduced to the source code repository for the service that is under the development;
stimulating the service to exercise communication variations of the service;
capturing communication traffic involving the service and one or more endpoints by using a packet filter and a proxy, wherein the captured communication traffic is a portion of all the communication traffic involving the service and the one or more endpoints, and the packet filter runs at a kernel level to intercept the communication traffic and reroute the intercepted communication traffic to the proxy, which logs the intercepted communication traffic as the captured communication traffic;
comparing the captured communication traffic to the expected communication specification; and
based on the comparing, detecting, in the captured communication traffic, and flagging, any anomalous communication behavior of the service.

2. The method as recited in claim 1 , wherein the expected communication specification identifies expected communications by the service, and includes one or more communication rules governing communication by the service.

3. The method as recited in claim 1 , wherein the method is performed by an evaluation service that is an element of the build pipeline.

4. The method as recited in claim 1 , wherein the expected communication specification identifies a network communications protocol, a domain name and/or IP address, a port number, a direction of communication origin, and the action to be taken in the event an anomaly is identified in the captured communication traffic.

5. The method as recited in claim 1 , wherein the method is implemented without any change to source code of the service by the packet filter.

6. The method as recited in claim 1 , wherein the captured communication traffic is outgoing traffic from the service, incoming traffic to the service, or traffic to and/or from a particular entity or group of entities taking place while the service is running the communication variations.

7. The method as recited in claim 1 , wherein the anomalous communication behavior comprises failure of the service to communicate with a specified endpoint, and/or communication by the service with a prohibited endpoint.

8. A computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
extracting an expected communication specification of a service, which is in development in a build pipeline, from a source code repository for the service, wherein the build pipeline runs each time source code changes are introduced to the source code repository for the service that is under the development;
stimulating the service to exercise communication variations of the service;
capturing communication traffic involving the service and one or more endpoints by using a packet filter and a proxy, wherein the captured communication traffic is a portion of all the communication traffic involving the service and the one or more endpoints, and the packet filter runs at a kernel level to intercept the communication traffic and reroute the intercepted communication traffic to the proxy, which logs the intercepted communication traffic as the captured communication traffic;
comparing the captured communication traffic to the expected communication specification; and
based on the comparing, detecting, in the captured communication traffic, and flagging, any anomalous communication behavior of the service.

9. The computer readable storage medium as recited in claim 8 , wherein the expected communication specification identifies expected communications by the service, and includes one or more communication rules governing communication by the service.

10. The computer readable storage medium as recited in claim 8 , wherein the computer readable storage medium is performed by an evaluation service that is an element of the build pipeline.

11. The computer readable storage medium as recited in claim 8 , wherein the expected communication specification identifies a network communications protocol, a domain name and/or IP address, a port number, a direction of communication origin, and the action to be taken in the event an anomaly is identified in the captured communication traffic.

12. The computer readable storage medium as recited in claim 8 , wherein the computer readable storage medium is implemented without any change to source code of the service by the packet filter.

13. The computer readable storage medium as recited in claim 8 , wherein the captured communication traffic is outgoing traffic from the service, incoming traffic to the service, or traffic to and/or from a particular entity or group of entities taking place while the service is running the communication variations.

14. The computer readable storage medium as recited in claim 8 , wherein the anomalous communication behavior comprises failure of the service to communicate with a specified endpoint, and/or communication by the service with a prohibited endpoint.

15. A system, comprising:
one or more hardware processors; and
a computer readable storage medium having stored therein instructions that are executable by the one or more hardware processors to perform operations comprising:
extracting an expected communication specification of a service, which is in development in a build pipeline, from a source code repository for the service, wherein the build pipeline runs each time source code changes are introduced to the source code repository for the service that is under the development;
stimulating the service to exercise communication variations of the service;
capturing communication traffic involving the service and one or more endpoints by using a packet filter and a proxy, wherein the captured communication traffic is a portion of all the communication traffic involving the service and one or more endpoints, and the packet filter runs at a kernel level to intercept the communication traffic and reroute the intercepted communication traffic to the proxy, which logs the intercepted communication traffic as the captured communication traffic;
comparing the captured communication traffic to the expected communication specification; and
based on the comparing, detecting, in the captured communication traffic, and flagging, any anomalous communication behavior of the service.

16. The system as recited in claim 15 , wherein the expected communication specification identifies expected communications by the service, and includes one or more communication rules governing communication by the service, and the expected communication specification identifies a network communications protocol, a domain name and/or IP address, a port number, a direction of communication origin, and the action to be taken in the event an anomaly is identified in the captured communication traffic.

17. The system as recited in claim 15 , wherein the system is performed by an evaluation service that is an element of the build pipeline.

18. The system as recited in claim 15 , wherein the system is implemented without any change to source code of the service by the packet filter.

19. The system as recited in claim 15 , wherein the captured communication traffic is outgoing traffic from

Assignees

• Emc Ip Holding Co Llc

Inventors

• Shafik Farida
• Beshara Shary
• Estrin Michael

Classifications

• H04L63/306

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• G06F8/60

  Software deployment · CPC title

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title