Microsoft Technology Licensing, LLC

Dragos Daniel Boia

Viresh Ramdatmisier

Donald J Ankney

Barry Markey

Robert Fish

Jacek Andrzej Czerwonka

Alisson A S Sol

Jiong Qiu

Eugene V Bobukh

Alisson Augusto Souza Sol

Hardik Goel

Arno Mihm

Maksim Shmelev

Robert C Fruth

Erik Tayler

Integrating super-app extension discovery and configuration within source code management platform comments. Based on a triggering event associated with a context within a code repository, a super-app identifies a set of extensions available for execution against the context, and triggers execution of at least a subset of the set of extensions against the context. The super-app generates a super-app output that includes an output of having triggered the subset of extensions against the context, a listing of one or more of the set of extensions as being a library of available extensions to the super-app, and an indication of a comment-based syntax for configuring an extension to the super-app. The super-app posts that output as a comment on a comment feed. Based on user input received via a comment using the comment-based syntax, the super-app generates a modified super-app configuration associated with the code repository.

Super-app extension discovery and configuration via source code management platform comments

The estimation and visualization of a degree of change between a further edited state of code and a selected version of the code. For each of some counted added or deleted portions (e.g., code lines) of code, the system estimates that the added (or deleted) portion complies with a non-review characteristic. The added (or deleted) code lines that comply with a non-review characteristic are excluded from the estimation of the degree of change. Thus, the estimation excludes consideration of added or deleted portions that need no substantial review, while considering more substantial added or deleted portions in the estimations. The estimation is then visualize giving the developer or the reviewer a better idea of the scale of changes that has really been made since the selected version of the code.

Change estimation in version control system

Systems and methods for automated selection of payloads for use in a security scan of a web application by a security scanner are described herein. More specifically, the systems and methods test potential payloads for a security scan of a given web application on a test application with known security vulnerabilities, evaluate valid response returned by this test application, determine functionally equivalent responses, group payloads based the equivalence of their valid responses, and select one or more payloads from each created group for use in the security scan of the given web application.

Security scanner

Various implementations provide an approach to control testing frequency based on behavior change detection. Behavior change detection is utilized, instead of a pre-defined patterns approach, to look at a system's behavior and detect any variances from what would otherwise be normal operating behavior. In at least some implementations, a behavior change detection system collects behavior from a service, such as an online service, and detects behavior changes, either permanent or transient, in the service. In this way, the changes may be used to compute a volatility score, which the system uses to control testing frequency of one or more services, such as URLs that are part of a particular service.

Testing frequency control using a volatility score

To protect network-based services, offering computer implemented functionality, from attacks, a passive web application firewall reactively identifies vulnerabilities, enabling such vulnerabilities to be quickly ameliorated, without intercepting communications or introducing other suboptimal aspects of traditional web application firewalls. Communications directed to the network-based services are logged and such logs are scanned for entries evidencing attacks, such as based on predetermined attack syntax. Further evaluation of the entries identified as evidencing attacks identifies a subset of those entries that correspond to likely successful attacks. Such further evaluation includes attacking the network-based service in an equivalent manner. Attacks that are found to be successful identify vulnerabilities, and a notification of such vulnerabilities is provided to facilitate amelioration of such vulnerabilities. Vulnerability amelioration can be automatic, such as by automatically adjusting the settings corresponding to the implementation of the network-based services to ameliorate identified vulnerabilities in a predetermined manner.

Passive web application firewall

Template identification techniques for control of testing are described. In one or more implementations, a method is described to control testing of one or more services by one or more computing devices using inferred template identification. Templates are inferred, by the one or more computing devices, that are likely used for documents for respective services of a service provider that are available via corresponding universal resource locators (URLs) to form an inferred dataset. Overlaps are identified by the one or computing devices in the inferred dataset to cluster services together that have likely used corresponding templates. Testing is controlled by the one or more computing devices of the one or more services based at least in part on the clusters.

Template identification for control of testing

A behavior change detection system collects behavior from a service, such as an online service, and detects behavior changes, either permanent or transient, in the service. Machine learning hierarchical (agglomerative) clustering techniques are utilized to compute deviations between clustered data sets representing an 'answer' that the service presents to a series of requests.

Behavior change detection system for services

Various embodiments provide an approach to classifying security events based on the concept of behavior change detection or 'volatility.' Behavior change detection is utilized, in place of a pre-defined patterns approach, to look at a system's behavior and detect any variances from what would otherwise be normal operating behavior. In operation, machine learning techniques are utilized as an event classification mechanism which facilitates implementation scalability. The machine learning techniques are iterative and continue to learn over time. Operational scalability issues are addressed by using the computed volatility of the events in a time series as input for a classifier. During a learning process (i.e., the machine learning process), the system identifies relevant features that are affected by security incidents. When in operation, the system evaluates those features in real-time and provides a probability that an incident is about to occur.

Growing community of inventors

Seattle, WA, United States of America

Dragos Daniel Boia