Capital One Services, LLC

Mohamed Seck

Krystan R Franzen

Louis Buell

Shannon Reid

Grant Michael Iwan

Ebrima N Ceesay

Nikitha Kondapally

Anand Annamalai

Bret Sebastian

Hrishikesh Mukundan Menon

Pavlo Savchuk

Chris Gallucci

Prerna Kandhari

Sesha Sowmya Nadiminti

In some implementations, an exception system may receive an indication of a security vulnerability associated with a cloud environment. The exception system may provide a data structure that represents the security vulnerability to a machine learning model in order to receive a suggested exception justification. The exception system may output, to a user device associated with a user assigned to the security vulnerability, a draft exception request that includes the suggested exception justification. The exception system may receive, from the user device, a request to submit an exception request based on the draft exception request. The exception system may transmit a command to tag the security vulnerability as excepted.

Automated vulnerability exception process

In some implementations, a compliance system may receive, from a pipeline system, a set of properties associated with configuration of a cloud infrastructure. Additionally, the compliance system may receive, from a code repository, a set of computer code associated with the cloud infrastructure. The compliance system may provide the set of properties and the set of computer code to a machine learning model to receive a set of compliance indicators and a set of severity levels. Each compliance indicator in the set of compliance indicators being associated with a corresponding severity level in the set of severity levels. The compliance system may selectively deploy the cloud infrastructure in response to receiving the set of severity levels.

Automatic compliance assessment of cloud infrastructure code

In some implementations, a compliance server may receive a set of data structures associated with one or more compliance activities. The compliance server may apply a machine learning model to the set of data structures in order to generate one or more automation estimates corresponding to the one or more compliance activities. The compliance server may output the one or more automation estimates to a user device. The compliance server may receive, from the user device, an indication of a selected compliance activity from the one or more compliance activities. The compliance server may generate an automation script for the selected compliance activity in response to the indication.

Compliance for cloud-based applications and computer systems using machine learning

In some implementations, a remediation device may receive, from a database that stores information regarding security vulnerabilities, security vulnerability indicators associated with one or more cloud-based applications. The remediation device may cluster, using at least one machine learning model, the security vulnerability indicators into classes, and may determine, for each class, a corresponding remediation recommendation. The remediation device may transmit, based on a setting, a corresponding message for each class. The remediation device may receive input associated with at least one of the corresponding messages, and may trigger, for at least one of the classes of security vulnerability indicators and based on the input, an automated remediation script based on a corresponding one of the remediation recommendations. The automated remediation script causes a cloud environment to perform an action for a cloud-based application associated with the security vulnerability indicators in the class(es).

Security vulnerability communication and remediation with machine learning

A system for recordation and retrieval of incident resolution action information is provided. A recordation system processor is provided with a recordation application configured to receive a response action initiation instruction identifying an action taken to resolve an incident on a target system, The processor determines one or more responsible responders each having a responder data processor that displays a responder dashboard. The processor transmits a recordation instruction to the responder data processor of each responsible responder. The recordation instruction includes an instruction to begin recording responder dashboard information. The recordation application is also configured to receive a response action termination instruction and to transmit a recordation termination instruction to the responder data processor of each responsible responder. A data storage unit is configured for receiving, from the responder data processors, real-time responder dashboard information recordings.

Systems and methods for recording major incident response information

An automated system is provided for facilitating resolution of an incident. An incident information data processor is configured to receive incident information and an action estimation data processor is configured to receive critical action information that includes a description of an action and an action initiation time. The action information data processor obtains previous action information on actions taken to resolve previous incidents and determines an estimated action outcome and an estimated critical action time interval for resolution of the critical action using the critical action information and the previous action information. An incident estimation data processor is configured to determine an overall estimated time interval for incident resolution and an estimated incident resolution time. An incident display data processor is configured to transmit, to a user data processing system for display to a user, at least the estimated incident resolution time.

Systems and method for informing incident resolution decision making

In some implementations, a redundancy system may receive, from a log storage, a plurality of log files that were generated by a plurality of monitoring programs. The redundancy system may apply a machine learning model to the plurality of log files to detect one or more redundancies. The redundancy system may determine at least one monitoring program, in the plurality of monitoring programs, that is a candidate for removal based on the one or more redundancies. The redundancy system may transmit, to a ticket system, a command to open a ticket associated with the at least one monitoring program.

Detecting and reducing monitoring redundancies

In some implementations, a system may receive dependency indicators associated with a plurality of cloud-based applications and receive change indicators associated with changes to one or more first applications of the plurality of cloud-based applications. The system may receive an indicator associated with an incident ticket based on a problem with a second application of the plurality of cloud-based applications. The device may determine at least one of the change indicators associated with the incident ticket based on dependencies between the one or more first applications and the second application and based on a difference between a time associated with the incident ticket and a time associated with the at least one of the change indicators. The system may, based on determining the at least one of the change indicators, transmit a command to rollback at least one of the changes or to rollforward at least one change.

Software change analysis and automated remediation

A method for query optimization may include capturing a proposed database query input into a user interface. The method may further include providing the proposed database query to a machine-learning model. The machine-learning model may have been trained, using one or more gathered and/or simulated sets of query execution overhead data and one or more gathered and/or simulated sets of database queries, to determine a potential execution overhead of a database query and output a query execution score. The method may further include outputting, by the machine-learning model, the query execution score based on the proposed database query. The method may further include determining that the query execution score exceeds a query execution score threshold. The method may further include triggering a corrective action based on the query execution score exceeding the query execution score threshold.

Systems and methods for query optimization

An automated method is provided for mitigating data service system performance degradation due to excess user traffic. A traffic assessment and management server (TAMS) retrieves historical time-varying environment information and transaction data for a data service processing system (DSPS). The TAMS receives a set of expected environment conditions for a future time interval and determines, using the time-varying environment and transaction data, estimated traffic information for the DSPS for the future time interval. The estimated traffic information includes an estimated usage level for at least one system component. The TAMS establishes a simulated system configuration for the DSPS and simulates DSPS operation using the estimated traffic information. The TAMS then determines from the simulation, an estimated likelihood of failure for the at least one system component.

System and method for reducing system performance degradation due to excess traffic

In some implementations, a remediation engine may receive an indication of the cloud-based application. The remediation engine may generate the data structure for the cloud-based application. The remediation engine may receive an indication of a corresponding user. The remediation engine may update the data structure to associate the corresponding user with the cloud-based application. The remediation engine may receive an indication of a corresponding category. The remediation engine may update the data structure to associate the corresponding category with the cloud-based application. The remediation engine may receive an indication of a first label and an indication of a first module of the cloud-based application. The remediation engine may update the data structure to associate the first label with the first module of the cloud-based application. The remediation engine may provide the data structure for processing alerts associated with the cloud-based application.

Automated ticket creation and assignment for cloud-based applications

In some implementations, an instruction management system may receive, from a plurality of user devices, a set of feedback associated with the instruction document. The instruction management system may identify a compliance activity associated with the instruction document and identify at least one location in the instruction document based on the set of feedback. The instruction management system may trigger an instruction to a tracking system to open a ticket associated with the compliance activity and the at least one location.

Automatic updates to instruction documents using crowdsourcing

In some aspects, a system may receive security vulnerability indicators associated with one or more cloud-based applications and/or properties associated with one or more cloud-based images used to create cloud instances. The system may determine, for each indicator and/or property, a corresponding remediation recommendation. The system may generate a graphical user interface that provides the indicators and/or properties with the corresponding remediation recommendations. The system may transmit, based on a user setting, a corresponding message for each indicator and/or property. The system may trigger, based on at least one of the indicators and/or properties, an automated remediation script that instructs a cloud environment to perform an action for a cloud-based application and/or image associated with the at least one indicator and/or property. The system may transmit one or more status indicators associated with the automated remediation script. Numerous other aspects are described.

Vulnerability dashboard and automated remediation

An automated system is provided for facilitating improvements to an incident resolution system. The system includes a scenario construction processor configured for establishing a system incident scenario and a machine learning model constructed using incident response information for each of a plurality of incidents. A simulation processor is configured to use the machine learning model to run simulations of the system incident scenario. Each simulation includes at least one variation of a selected critical action characteristic critical actions included in the scenario and each simulation produces a simulated incident resolution parameter. An improvement evaluation processor determines from the simulations, one or more of the at least one variation that results in a simulated incident resolution parameter meeting predetermined improvement criteria.

Systems and methods for optimizing incident resolution

An automated system is provided for facilitating resolution of an incident on a digital processing system. The automated system has a data storage unit with information on previous incidents, a user interface and a resolution facilitation server. The server receives incident information from a monitoring system, including status information for at least one operating parameter of the digital processing system. The server is configured to apply a machine learning model to determine a first recommended action using the incident information and the previous incident information, present the first recommended action to the user, and receive a recommendation response. The server is also configured to establish a recommendation score based at least in part on the recommendation response and to update the machine learning model using the incident information, the first action recommendation, and/or the first recommendation score.

Growing community of inventors

Aubrey, TX, United States of America

Mohamed Seck