International Business Machines Corporation

Masayoshi Mizutani

Yuji Watanabe

Yuta Tsuboi

Takahide Nogayama

Scott Ross Trent

Raymond H P Rudy

A method and system are provided for performing a security inspection of a set of virtual images. The method includes merging the virtual images into a tree structure having a root and a plurality of leaves such that child leaves and a parent leaf to the child leaves have common ones of the virtual images. The method further includes applying a bisection method against a path in the tree from the root to a given one of the plurality of leaves having a given one of the virtual images in which a security violation has been identified to find a particular one of the virtual images that is a root cause of the security violation. The method also includes performing a corrective action for any of the plurality of images having the security violation.

Security inspection of massive virtual hosts for immutable infrastructure and infrastructure as code

A method and system are provided for performing a security inspection of a set of virtual images in a cloud infrastructure. The method includes merging the virtual images into a tree structure having a root and a plurality of leaves such that child leaves and a parent leaf to the child leaves have common ones of the virtual images. The method further includes identifying a security violation in a given one of the virtual images at a given one of the plurality of leaves. The method also includes applying a bisection method against a path in the tree from the root to the given one of the plurality of leaves to find a particular one of the virtual images that is a root cause of the security violation. The method additionally includes performing a corrective action for any of the plurality of images having the security violation.

A technique for estimating a format of a log message (LM) according to the present invention includes creating a first directed graph structure by dividing a first LM by predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the first LM; creating a second directed graph structure by performing on a second LM the same processing as that performed on the first LM; comparing nodes in the first directed graph structure with nodes in the second directed graph structure to detect nodes other than nodes including a corresponding character string; adding to the first directed graph structure the node detected in the second directed graph structure among the detected nodes as a first branch node; and estimating the format, based on the first directed graph structure including the first branch node added thereto.

Growing community of inventors

Tokyo, Japan

Masayoshi Mizutani