Amazon Technologies, Inc.

Maarten Van Horenbeeck

Jon Arron McClintock

Tushaar Sethi

Matthew Ryan Jezorek

Katharine Nicole Harrison

Christopher Michael Anderson

Richie Lai

Dominique Imjya Brezinski

John Clark Coonley Duksta

Brian Young Lee

Danial Muhammad Ranjha

Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to compare, for a given input, expected and observed outputs for a subset of transiting data, so as to determine risk profiles associated with at least the subset.

Techniques for data routing and management using risk classification and data sampling

A method and apparatus for risk scoring in a graph are disclosed. In the method and apparatus, a graph includes a first node that is connected with a node of a plurality of nodes using a communication link of a plurality of communication links. A plurality of link risk measures are then determined, whereby a link risk measure of the plurality of link risk measures pertains to the communication link of the plurality of communication links. Furthermore, a risk measure associated with the first node is determined based at least in part on the plurality of link risk measures. The risk measure is monitored to determine if one or more conditions placed on the risk measure are met and one or more actions are taken as a result of the one or more conditions being met.

Risk scoring in a connected graph

A method and apparatus for path detection are disclosed. In the method and apparatus, a data path may link two path-end nodes in a network. Event data for the network may be received and may be used to determine, for each node resident on the path, proximity measures to each path-end node. The proximity measure of network nodes may be evaluated to determine whether a path exists between the two path-end nodes.

Event-based data path detection

Method and apparatus for identifying a flow of data from a first data store to a second data store are disclosed. In the method and apparatus, a service may send the data from the first data store to the second data store, whereby the service may be associated with an access control policy that specifies whether the service is permitted to send or receive the data. The access control policy may be used as a basis for the evaluation of executable instructions of the service, and evaluation of the executable instructions may be used to identify the first data store or the second data store.

Static analysis-based tracking of data in access-controlled systems

A method and system are provided that create a limited use secure environment (LSE) image such as a limited use operating system installation that can be booted from a removable medium (e.g. CD or flash drive). The limited use secure environment is a limited purpose OS, web browser, etc. that prevents undesired activities. When the limited use secure environment boots, it initiates a pairing operation in which a pairing code and user credentials are conveyed to an authorization server. Once the pairing code and credentials are confirmed, a provisioning service provides configuration credentials to the limited use secure environment to enable the limited use secure environment to establish a secure connection through a gateway to resources of interest.

Secure streamlined provisioning of remote access terminals

Techniques for detecting access to computer system data by applications running on a computer system are described herein. Data access event log entries are recorded, the log entries including one or more metadata items associated with how the computer system application accessed the computer system data. The log entries are analyzed using correlations with other computer system events and, if improper access is detected, one or more operations relating to the type of data accessed and the type of violation are performed to mitigate the improper data access.

Identifying sensitive data writes to data stores

Techniques for analyzing a dataset may be provided. For example, a configuration file may be accessed. The dataset may be analyzed based on a condition identified in the configuration file. A report may be generated and transmitted based on the analysis. Another report generated based on an analysis of another dataset according to another configuration file may be accessed. The dataset may be further analyzed based on this report to determine if a reported observation may also be associated with the dataset. If so, a confirmation may be generated and transmitted.

Analyzing distributed datasets

Techniques for analyzing access to a network-based document may be provided. For example, the network-based document may be configured for direct access from client device. Based on an access of a client device to the network-based document, information associated with this access may be recorded. The information may be analyzed to determine whether a condition associated with the direct access may be violated. An issue may be detected with the client device access based on a determination that the condition may be violated.

Detecting network attacks based on network requests

Techniques for analyzing access to a network-based document may be provided. For example, a portion of the network-based document for hashing may be identified. A client hash of the portion may be accessed. The client hash may be based on an access of a client to the network-based document over a network. A provider hash of the portion may be also accessed. The provider hash may be based on a trusted version of the portion. The client hash and the provider hash may be compared. Based on the comparison, an issue associated with the access to the network-based document over the network may be detected.

Detecting network attacks based on a hash

Techniques for analyzing access to a network-based resource may be provided. For example, a client record associated with the access to the network-based resource over a network may be compared to a provider record. The client record may indicate an address of the network based resource and can be received from a computing resource. The provider record can also indicate the address and can be received from a trusted computing resource. Based on the comparison, an issue associated with the access to the network-based resource over the network may be detected.

Growing community of inventors

Seattle, WA, United States of America

Maarten Van Horenbeeck