Amazon Technologies, Inc.

Alexander Robin Gordon Lucas

Eric Jason Brandwine

Robert Eric Fitzgerald

Nachiketh Rao Potlapally

Customers of a computing resource service provider may operate computing resources provided by the computing resource service provider. Operational information from customer operated computing resources may be correlated with operational information from computing resources operated by the computing resource service provider or other entities, and correlated threat information may be generated.

Correlating threat information across sources of distributed computing systems

Customers of a computing resource service provider may operate one or more computing resources provided by the computing resource service provider. In addition, the customers may implement security applications and/or devices using the one or more computing resources provided by the computing resource service provider. Operational information from customer operated computing resources may be correlated with operational information from computing resources operated by the computing resource service provider or other entities and correlated threat information may be generated. Anomalous activity may be detected based at least in part on the correlated threat information.

Customers of a computing resource service provider may operate one or more computing resources, provided by the computing resource service provider, within a virtual network. The customers may request network scans of the computing resources with the virtual network. Scanning packets may be generated and encapsulated to ensure delivery to an appropriate destination within the virtual network. The information in the scanning packet may appear to be generated by a source within the virtual network.

Source specific network scanning in a distributed environment

Customers of a computing resource service provider may operate one or more computing resource provided by the computing resource service provider. In addition, the customers may implement security applications and/or devices using the one or more computing resources provided by the computing resource service provider. Operational information from customer operated computing resources may be correlated with operational information from computing resources operated by the computing resource service provider or other entities and correlated threat information may be generated. Anomalous activity may be detected based at least in part on the correlated threat information.

Correlating threat information across multiple levels of distributed computing systems

A computing resource service provider may provide customers with a block-level forensics service. Volume images of computing resource associated with customer may be generated and provided to the block-level forensics service. The block-level forensics service or component thereof may generate a volume based at least in part on the volume image and may perform forensics analysis of the volume. A result of the forensic analysis may be provided to the customer.

Block-level forensics for distributed computing systems

Customers of a computing resource service provider may utilize computing resources of the computing resources service provided to implement one or more computer systems. Furthermore, the customer may cause a host-based firewall to be executed by the one or more computer systems. The host-based firewall may collect network traffic information. The customer may then be provided with the network traffic information and be prompted to provide decisions associated with the network traffic information. The decisions may be used to generate a set of rules which may be enforced by the host-based firewall.

Host-based firewall for distributed computer systems

A computing resource service provider may provide customers with a block-level forensics service. Logical volumes associated a customer may be used to instantiate computing resources provided by a computing resource service provide for use by the customer. The block-level forensics service or component thereof may monitor the logical volume based at least in part on a log generated as a result of the logical volume being implemented as a log-structured storage system. Operations to the log may be collected by the block-level forensics service and malicious activity may be detected based at least in part on operations to the log.

Transparent volume based intrusion detection

A method for implementing network security policies in a multi-tenant network environment may include receiving a request for implementation of at least one network security policy on one or more computing devices of a service provider cloud environment. The network security policy identified by the request may be retrieved. The network security policy may be encrypted using encrypting credentials of the one or more computing devices. Decrypting credentials corresponding to the encrypting credentials are stored in a Trusted Platform Module (TPM) within the one or more computing devices. The encrypted network security policy may be pushed to the one or more computing devices, for decryption and implementation at the one or more computing devices.

Growing community of inventors

Cheltenham, United Kingdom

Alexander Robin Gordon Lucas