Risk Assessment of a Container Build

Patent metadata

Field	Value
Publication number	US-2022366055-A1
Application number	US-202117317043-A
Country	US
Kind code	A1
Filing date	May 11, 2021
Priority date	May 11, 2021
Publication date	Nov 17, 2022
Grant date	—

Abstract

An artificial intelligence (AI) platform to support optimization of container builds and virtual machine mounts in a distributed computing environment. A provisioning file is subject to natural language processing (NLP) and a corresponding vector representation of the file is created and subject to evaluation by a set of artificial neural networks (ANN). A first ANN assesses the representation of the file with respect to compliance and operability, and the second ANN selectively assesses the representation of the file with respect to provisioning efficiency. The provisioning file is selectively process based on the provisioning efficiency, with the processing directed at provisioning a container build or mounting a VM.

First claim

What is claimed is:

1 . A computer system comprising:
a processor operatively coupled to memory; and an artificial intelligence (AI) platform in communication with the processor and the memory, the AI platform comprising:
a representation manager configured to employ natural language processing (NLP) to convert a received metadata file associated with provisioning into one or more vector representations;
a neural network manager configured to identify a subject of the provisioning and selectively leverage a first artificial neural network (ANN) responsive to the identified subject, the selective leverage including the first ANN to assign a first score to each of the one or more vector representations, the first score to convey a compliance factor corresponding to operability of the one or more vector representations;
a neural network manager configured to selectively leverage a second ANN responsive to the first score assignment from the first ANN, the second ANN configured to assign a second score to the representation of the received metadata file, wherein the second score corresponds to provisioning efficiency; and
the processor to selectively provision the container or VM responsive to the second score.

2 . The computer system of claim 1 , wherein the first score assignment further comprises the first ANN to identify a stored vector representation proximal to the metadata file and measure a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

3 . The computer system of claim 2 , further comprising responsive to the first score associated with the one or more stored vector representations exceeding a risk threshold, the first ANN configured to identify a stored compliant vector representation closest to the metadata file and measure the distance between the identified stored compliant vector representation and the metadata file, and wherein the selective leveraging of the second ANN is based on the distance measurement.

4 . The computer system of claim 2 , wherein the provisioning is a VM, and further comprising:
the representation manager to convert a VM image file into one or more VM vector representations; the neural network manager to evaluate the one or more VM vector representations against the second ANN, the second ANN configured to generate a context score, wherein the context score corresponds to a risk associated with mounting the VM; and the processor to selectively mount the VM responsive to the context score.

5 . The computer system of claim 1 , wherein the first score functions as a compliance indicator of the received metadata file, and the second score functions as a provisioning indicator.

6 . The computer system of claim 1 , wherein the provisioning is a container build, and further comprising the representation manager configured to convert container image layers within the image container build into one or more image layer vector representations, and assign the first score to each of the one or more image layer vector representations.

7 . A computer program product comprising:
a computer readable storage device; and program code embodied with the computer readable storage device, the program code executable by a processor to:
employ natural language processing (NLP) to convert a received metadata file associated with provisioning into one or more vector representations;
identify a subject of the provisioning, and responsive to the identification to selectively leverage a first artificial neural network (ANN) to assign a first score to each of the one or more vector representations, the first score conveying a compliance factor corresponding to operability of the one or more vector representations;
selectively leverage a second ANN responsive to the first score assignment from the first ANN, the second ANN assigning a second score to the representation of the received metadata file, wherein the second score corresponds to provisioning efficiency; and
selectively provision the container or VM responsive to the assigned second score.

8 . The computer program product of claim 7 , wherein assignment of the first score further comprises the program code to identify a stored vector representation proximal to the metadata file and measure a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

9 . The computer program product of claim 8 , further comprising responsive to the first score associated with the one or more stored vector representations exceeding a risk threshold, the first ANN configured to identify a stored compliant vector representation closest to the metadata file and measure the distance between the identified stored compliant vector representation and the metadata file, and wherein the program code to selectively leverage the second ANN is based on the distance measurement.

10 . The computer program product of claim 8 , wherein the provisioning is the VM, and further comprising program code to:
convert a VM image file into one or more VM vector representations; evaluate the one or more VM vector representations against the second ANN, the second ANN configured to generate a context score, wherein the context score corresponds to a risk associated with mounting the VM; and selectively mount the VM responsive to the context score.

11 . The computer program product of claim 7 , wherein the first score functions as a compliance indicator of the received metadata file, and the second score functions as a provisioning indicator.

12 . The computer program product of claim 7 , wherein the provisioning is a container build, and further comprising converting container image layers within the image container build into one or more image layer vector representations, and assigning the first score to each of the one or more image layer vector representations.

13 . A computer-implemented method comprising:
employing natural language processing (NLP), converting a received metadata file associated with provisioning into one or more vector representations; identifying a subject of the provisioning, and responsive to the identification selectively leveraging a first artificial neural network (ANN) to assign a first score to each of the one or more vector representations, the first score conveying a compliance factor corresponding to operability of the one or more vector representations; selectively leveraging a second ANN responsive to the first score assignment from the first ANN, the second ANN assigning a second score to the representation of the received metadata file, wherein the second score corresponds to provisioning efficiency; and selectively provisioning the container or VM responsive to the assigned second score.

14 . The method of claim 13 , wherein assigning the first score further comprising identifying a stored vector representation proximal to the metadata file and measuring a distance between the stored vector representation and the metadata file representation, and wherein the first score assignment is based on the measured distance.

15 . The method of claim 14 , further comprising responsive to determining that the first score associated with the one or more stored vector representations exceeds a risk threshold, the first ANN identifying a stored compliant vector representation closest to the metadata file and measuring the distance between the identified stored compliant vector representation and the metadata file, an

Assignees

• IBM

Inventors

• Malvankar Abhishek
• Ganci Jr John M
• Fonseca Carlos A
• Beller Charles E

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06N3/08

  Learning methods · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title