Shift-left security risk analysis

Patent metadata

Field	Value
Publication number	US-2022303302-A1
Application number	US-202117249997-A
Country	US
Kind code	A1
Filing date	Mar 22, 2021
Priority date	Mar 22, 2021
Publication date	Sep 22, 2022
Grant date	—

Abstract

A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

First claim

What is claimed is:

1 . A method for security risk analysis, the method comprising:
collecting operational data; building pipelines; localizing security issues using the operational data on an unsupervised model; constructing a semantic graph using shift-left data; constructing a mapping between the operational data and the shift-left data; clustering collected datasets; and creating an active learning cycle using ground truth.

2 . The method of claim 1 , wherein the pipelines are built as an automated process that builds, tests and deploys computing data.

3 . The method of claim 1 , wherein the unsupervised model identifies a top list of representative information for each software application.

4 . The method of claim 1 , wherein the shift-left data includes source code, deployment configurations, deployment specifications and environmental variables.

5 . The method of claim 1 , wherein the semantic graphs are constructed using the shift-left data.

6 . The method of claim 1 , wherein the collected datasets are clustered, automatically, by the security issues.

7 . The method of claim 1 , wherein the active learning cycle allows feedback from subject matter experts to improve precision of security risk identification by a model over time.

8 . A computer system for security risk analysis, comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors via at least one of the one or more computer-readable memories, wherein the computer system is capable of performing a method comprising: collecting operational data; building pipelines; localizing security issues using the operational data on an unsupervised model; constructing a semantic graph using shift-left data; constructing a mapping between the operational data and the shift-left data; clustering collected datasets; and creating an active learning cycle using ground truth.

9 . The computer system of claim 8 , wherein the pipelines are built as an automated process that builds, tests and deploys computing data.

10 . The computer system of claim 8 , wherein the unsupervised model identifies a top list of representative information for each software application.

11 . The computer system of claim 8 , wherein the shift-left data includes source code, deployment configurations, deployment specifications and environmental variables.

12 . The computer system of claim 8 , wherein the semantic graphs are constructed using the shift-left data.

13 . The computer system of claim 8 , wherein the collected datasets are clustered, automatically, by the security issues.

14 . The computer system of claim 8 , wherein the active learning cycle allows feedback from subject matter experts to improve precision of security risk identification by a model over time.

15 . A computer program product for security risk analysis, comprising:
one or more computer-readable tangible storage media and program instructions stored on at least one of the one or more computer-readable tangible storage media, the program instructions executable by a processor to cause the processor to perform a method comprising: collecting operational data; building pipelines; localizing security issues using the operational data on an unsupervised model; constructing a semantic graph using shift-left data; constructing a mapping between the operational data and the shift-left data; clustering collected datasets; and creating an active learning cycle using ground truth.

16 . The computer program product of claim 15 , wherein the pipelines are built as an automated process that builds, tests and deploys computing data.

17 . The computer program product of claim 15 , wherein the unsupervised model identifies a top list of representative information for each software application.

18 . The computer program product of claim 15 , wherein the shift-left data includes source code, deployment configurations, deployment specifications and environmental variables.

19 . The computer program product of claim 15 , wherein the semantic graphs are constructed using the shift-left data.

20 . The computer program product of claim 15 , wherein the collected datasets are clustered, automatically, by the security issues.

Assignees

• IBM

Inventors

• Hwang Jinho
• Shwartz Larisa
• Batta Raghav
• Nidd Michael Elton
• Krchak Jakub

Classifications

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• G06N3/08

  Learning methods · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title