Amazon Technologies, Inc.

Nadia Labai

Daniel William Dacosta

John David Backes

Nikolaos Giannarakis

Nathan Launchbury

Vaibhav Katkade

Syed Mubashir Iqbal

Nick Matthews

Samuel Bayless

Patrick Trentin

Sagar Chintamani Joshi

Victor Heorhiadi

Divya Raghunathan

Techniques implemented by a network-access analysis system to analyze network access controls for networks, identify traffic flows that are unobserved and unrequired, and determine proposed changes to the network access controls that restrict access from unobserved traffic flows. The system may analyze the network access controls, and determine whether unrequired traffic flows are allowed to be communicated in the network. For instance, the system may analyze network flow logs and identify observed traffic flows that are required by applications in the network, and also identify unobserved traffic flows that are permitted access to, but are not observed in, the network. The system may propose changes to the network access controls to restrict network access by these unobserved traffic flows. A network administrator can receive recommendations from the system regarding the proposed changes, and determine whether they would like to implement the proposed changes to their network access controls.

Least privilege network access controls advisor

A network change verification (NCV) system is disclosed for checking whether a proposed configuration change on a network alters the way that the network controls recently observed network flows. In embodiments, the system builds an observed flow control model (OFCM) from logs of recent flows observed in the network. The OFCM, which may be periodically updated based on newly observed flows, provides a compact representation of how individual network flows were ostensibly controlled by the network. When a proposed configuration change is received, the system analyzes the change against the OFCM to check whether the change will alter how the network controls recently observed flows. If so, the proposed change is blocked, and an alert is generated identifying flows that are affected by the change. The NCV system thus prevents network operators from accidentally making changes on the network that will materially alter the behavior of the network.

Network change verification based on observed network flows

Growing community of inventors

Redmond, WA, United States of America

Nadia Labai