Amazon Technologies, Inc.

Peakio, Inc.

Anthony Joseph Suarez

Daniel Robert Gerdesmeier

Anirudh Balachandra Aithal

Kiran Kumar Meduri

Scott Kerns Windsor

Nare Alan Hayrapetyan

Pooja Kalpana Prakash

Deepak Singh

Muhammad Umer Azad

William Andrew Thurston

Euan Skyler Kemp

Khaja Ehteshamuddin Ahmed

Christopher Brian Barclay

Jia Bi Zhang

Dmitry Petrovich Andreychuk

Eden Grail Adogla

Jason Roy Rupard

Archana Srikanta

Cornelle Christiaan Pretorius Janse Van Rensburg

Carlos Eduardo Lopez Biagi

Fernando Paiva Zandona

Michael Francis Quigley

Mengye Gong

Marcel Jon Van Rensberg

A service provider may deploy a security threat detection and mitigation platform in a multi-tenant virtualization environment that includes pluggable data collection, data analysis, and response components. The data analysis components may apply machine learning techniques to generate (based on training data sets) and refine (based on subsequently received data sets and feedback about the resulting classifications) predictors configured to detect particular types of security threats, such as denial of service attacks, botnets, scans, or remote desktop attacks. A data collection layer may collect, filter, organize, and curate network packet traffic data, network packet header data, or other information emitted by computing instances or applications executing on them, and provide the curated data as streams to the analysis layer. A response layer may automatically take action in response to threat detections (which may be overridden by an administrator) and may store classification data for subsequent analysis, feedback, and predictor refinement.

Threat detection and mitigation in a virtualized computing environment

A request to store a container image is received from a device associated with a customer of a computing resource service provider. Validity of a security token associated with the request is authenticated using a cryptographic key maintained as a secret by the computing resource service provider. One or more layers of the container image is built based at least in part on at least one build artifact to form a set of built layers. The software image including the set of built layers is stored in a repository associated with the customer. A manifest of metadata for the set of built layers is stored in a database of a structured data store. The container image is obtained in the form of an obtained container image. The obtained container image is deployed as the software container in at least one virtual machine instance associated with the customer.

Software container registry service

A task definition is received. The task definition indicates at least a location from which one or more software image can be obtained and information usable to determine an amount of resources to allocate to one or more software containers for the one or more software image. A set of virtual machine instances in which to launch the one or more software containers is determined, the one or more software image is obtained from the location included in the task definition and is launched as the one or more of software containers within the set of virtual machine instances.

System for managing and scheduling containers

A request to update a software container image within a container registry hosted by a computing resource service provider is received from an entity associated with a customer account with the computing resource service provider, where the container registry is a scalable distributed data storage service. The software container image is stored in the container registry in association with the customer account. A layer of the software container image stored in the container registry is scanned for a reference identifier associated with a security vulnerability as a result of said scan finding the reference identifier within the software container image, notice is provided to the entity indicating that the security vulnerability was found. Software within the software container image is updated based at least in part on the vulnerability scan; and the update software is deployed.

A method of providing a distributed messaging system to aggregate particular types of messages regarding a client from customers of said client and for generating response and informational messages to the customers is provided. The method is performed in a distributed system comprising one or more processors executing computer instructions and one or more non-transitory computer readable media with computer executable instructions stored thereon executed by the one or more processors to provide the method. The method comprises the steps of: receiving and securely storing client account credentials of the client for a group of client determined user accounts comprising predetermined ones of social media and email accounts of the client; utilizing the client account credentials to access the user accounts; capturing all customer messages received at the user accounts; filtering all the captured messages for predetermined keywords; aggregating the filtered customer messages in a database; and determining severity, trust and validity of the filtered customer messages.

Distributed messaging aggregation and response

An event applier service obtains state change information for a plurality of software containers from a transaction journal. Based at least in part on operations specified in the state change information for the plurality of software containers, the event applier service generates event data for the plurality of containers. The event applier service updates a database to indicate that the state change information has been processed to generate the event data. The event applier service provides the event data.

Software container event monitoring systems

Techniques for instantiating container instances from a pool of available container instances are described herein. An instance type is determined from a container description such that the instance type satisfies the resource parameters in the container description. An instance of the instance type is selected from a pool of running container instances, the instance is provisioned, and a container is instantiated on the instance.

Managed container instances

At least one instance of an application is launched in a set of software containers that are distributed among a set of virtual machine instances. A set of measurements corresponding to resource utilization by a software container of the set of software containers is obtained and a timestamp is generated for the set of measurements. The set of measurements is aggregated, with other sets of measurements corresponding to the set of software containers for the application, into a set of aggregated measurements grouped in a time window group, based at least in part on the timestamp, and, as a result of fulfillment of a condition, the time window group is outputted.

Container telemetry

A request to store, in first data store associated with a customer of a computing resource service provider, a software image is received, the request including a set of layers of the software image to be stored. As a result of successful authentication of the request, based at least in part on a security token included with the request, a subset of layers of the software image that have not previously been stored in the first data store are determined, based at least in part on first metadata obtained from a second data store, the subset of layers in the first data store are stored, second metadata about the subset of layers are stored in the second data store, and the software image is caused to be launched in a software container of an instance based at least in part on the subset of layers.

A request to a scan a software image for specified criteria is received, the software image comprising layers stored in a first data store. Metadata in a second data store, different from the first data store, is searched through to obtain information corresponding to the software image. A first set of the layers that matches the specified criteria is determined, based at least in part on the information. The first set of layers is marked as un-referenceable. Asynchronous to fulfillment of the request, a second set of layers of the layers to be deleted is determined, based at least in part on the metadata, the second set of layers including layers marked as un-referenceable, and the second set of layers is deleted.

Software container registry inspection

A software image associated with a first customer of a computing resource service provider and criteria for identifying an event is received, the software image comprising a set of layers. The set of layers is stored in a first data store to form a stored set of layers, the first data store being physically located in a first region. The set of layers is copied to a second data store to form a copied set of layers, the second data store being physically located in a second region different from the first region. The copied set of layers is launched as a container executing in an instance that is physically located in the second region, and, as a result of identifying an occurrence of the event, the container is caused to be unavailable to an entity associated with the instance.

Growing community of inventors

Seattle, WA, United States of America

Anthony Joseph Suarez