Determining application security and correctness using machine learning based clustering and similarity

Patent metadata

Field	Value
Publication number	US-12309235-B2
Application number	US-202318381345-A
Country	US
Kind code	B2
Filing date	Oct 18, 2023
Priority date	Mar 19, 2021
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint. The operations further include, based on the comparing, determining a disparity between software applications installed on the particular computing device and the reference computing device, and storing, in the persistent storage, a representation of the disparity.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining a plurality of representations of a plurality of software applications installed on a computing device;
determining corresponding importance values comprising, for each respective software application of the plurality of software applications, a corresponding importance value;
generating a device fingerprint of the computing device by processing the plurality of representations of the plurality of software applications and the corresponding importance values by a machine learning model that has been trained to generate device fingerprints based on representations of software applications and importance values thereof, wherein the device fingerprint represents a transformation by the machine learning model of the plurality of representations of the plurality of software applications according to the corresponding importance values; and
storing a representation of the device fingerprint.

2. The computer-implemented method of claim 1 , wherein the transformation of the plurality of representations performed by the machine learning model is conditioned on the corresponding importance values.

3. The computer-implemented method of claim 1 , wherein determining a particular importance value of the corresponding importance values for a particular software application of the plurality of software applications comprises:
determining, for the particular software application, (i) a first frequency associated with execution of the particular software application on the computing device and (ii) a second frequency associated with execution of the particular software application across a plurality of other computing devices; and
determining, for the particular software application, the particular importance value based on (i) the first frequency and (ii) an inverse of the second frequency.

4. The computer-implemented method of claim 1 , wherein the corresponding importance values comprise one or more of: (i) a numerical value selected from a predetermined numerical scale or (ii) a categorical value selected from a plurality of predetermined categories.

5. The computer-implemented method of claim 1 , wherein generating the device fingerprint comprises:
determining that the corresponding importance values exceed a threshold importance value; and
based on determining that the corresponding importance values exceed the threshold importance value, generating the device fingerprint by processing the plurality of representations and the corresponding importance values by the machine learning model.

6. The computer-implemented method of claim 1 , wherein a particular representation of the plurality of representations comprises a representation of an attribute of a software processes associated with a corresponding software application of the plurality of software applications.

7. The computer-implemented method of claim 1 , wherein the device fingerprint comprises one or more of: (i) a character string generated by the machine learning model or (ii) a vector generated by the machine learning model.

8. The computer-implemented method of claim 1 , further comprising:
generating a reference device fingerprint of a reference computing device by processing, by the machine learning model, a second plurality of representations of a second plurality of software applications installed on the reference computing device;
determining a disparity between the computing device and the reference computing device based on comparing the device fingerprint to the reference device fingerprint; and
storing, in a persistent storage, a representation of the disparity.

9. The computer-implemented method of claim 8 , wherein:
obtaining the plurality of representations comprises obtaining, for each respective computing device of a plurality of computing devices, a corresponding plurality of representations of a corresponding plurality of software applications installed on the respective computing device,
generating the device fingerprint comprises generating, for each respective computing device of the plurality of computing devices, a corresponding device fingerprint by processing the corresponding plurality of representations by the machine learning model,
comparing the device fingerprint to the reference device fingerprint comprises determining, based on the corresponding device fingerprint determined for each respective computing device, two or more clusters of the computing devices,
a first cluster of the two or more clusters includes the computing device and the reference computing device,
the method further comprises:
obtaining a selection of the first cluster, and
obtaining a selection of the reference computing device from the first cluster.

10. The computer-implemented method of claim 8 , wherein:
obtaining the plurality of representations comprises obtaining, for each respective computing device of a plurality of computing devices, a corresponding plurality of representations of a corresponding plurality of software applications installed on the respective computing device,
generating the device fingerprint comprises generating, for each respective computing device of the plurality of computing devices, a corresponding device fingerprint by processing the corresponding plurality of representations by the machine learning model,
the method further comprises obtaining a selection of the reference computing device from the plurality of computing devices, and
comparing the device fingerprint to the reference device fingerprint comprises, based on obtaining the selection of the reference computing device, determining, for each respective computing device of the plurality of computing devices, a similarity value indicative of a similarity between the respective computing device and the reference computing device.

11. The computer-implemented method of claim 10 , wherein determining the disparity between the computing device and the reference computing device comprises determining, for each respective computing device having a similarity value that exceeds a threshold similarity value, a corresponding disparity between the respective computing device and the reference computing device.

12. The computer-implemented method of claim 10 , wherein:
comparing the device fingerprint to the reference device fingerprint further comprises determining a ranking of the plurality of computing devices based on the similarity value determined for each respective computing device, and
the method further comprises displaying representations of computing devices that have similarity values that exceed a threshold similarity value, wherein the representations are displayed arranged according to the ranking.

13. The computer-implemented method of claim 8 , wherein determining the disparity between the computing device and the reference computing device comprises:
identifying a compliant software application that is installed on both the computing device and the reference computing device;
identifying a missing software application that is installed on the reference computing device but is not installed on the computing device; or
identifying an unauthorized software application that is installed on the computing device but is not installed on the reference computing device.

14. The computer-implemented method of claim 8 , further comprising:
retrieving, from the persistent storage, the representation of the disparity;
displaying, by way of a user interface, a visual representation of the disparity and a suggested modification to the plurality of software applications; and
based on displayin

Assignees

• Servicenow Inc

Inventors

• Herzog Shay
• Bhagat Aakash Umeshbhai
• Zateikin Olga
• Bitterfeld Robert
• Garty Asaf

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06F18/23

  Clustering techniques · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• G06N20/00

  Machine learning · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title