Amazon Technologies, Inc.

Other

Nasdaq, Inc.

Thomas Charles Stickle

Ryan Holland

Carl Jay Moses

Eric Jason Brandwine

Robert Eric Fitzgerald

Shane Anil Pereira

Terrence Wise

Steven Reynolds Jones

Michael Charles Pfeiffer

Dorothy Copeland

Peter Klewinghaus

Matthew Shawn Wilson

Malcolm Gary LaFever

Matthew Thomas Tavis

David Samuel Zipkin

Miles Julian Ward

Karthikeyan Krishnan

Kyle Adam Lichtenberg

Vikram Garlapati

Thomas Price Jones, Ii

Blake Whaley

Justin Thomas Smith

Brian M Matsubara

Mathew Wolfgang Walter Lehwess

John Kenneth Beer

Adam Schodde

Joshua Swaney

Kevin James Wittkopf

Thomas Eugene Laszewski

Bruce Cameron Burns

Vadim Astakhov

Edward Scott Mullins

Mamoon Yunis

Rizwan Mallal

Terrence Patrick Wise

The present disclosure provides systems, methods, and products for providing a tokenization service and a complementary API. The tokenization service may provide format-preserving tokens. The tokenization service may associate different tokens generated by different users from the same data, so that users can retrieve and use associated tokens for collaboration and access to each other's data, information, etc. The tokenization service may restrict the creation of an association between, and access to, users' tokens based on a requirement for a relationships between users according to a social graph model.

Tokenization web services

A user-promotion process allows a service provider to grant the security roles associated with a target user account to a requester by obtaining approvals from a quorum of approving users. The quorum requirements and the identity of the approving users may be established by the target user or an account manager. Upon receiving, from a promotion candidate, a request to assume security roles of a target user, the service provider identifies the approving users from the target user's account record. Approvals are requested from the approving users, and if a quorum of approvals is received by the service provider, the promotion candidate is allowed to assume the roles of the target user. If a quorum of approvals is not received, then substitute approving users may be identified based at least in part on those approving users that did not respond to the approval request.

Account recovery

Methods and apparatus for a secure time service are disclosed. A time server including a time source, a cryptographic key and a cryptographic engine is instantiated within a provider network. A time service endpoint receives a timestamp request from a client. The endpoint transmits a representation of the request to the time server, and receives, from the time server, an encryption of at least a timestamp generated using the time source. A response comprising the encryption of at least the timestamp is transmitted to the requesting client.

Secure time service

Technology is described for preventing cryptovirus attacks in a computing service environment. Data patterns of both read and write operations are monitored for files during a predetermined time period. The data patterns related to the files are recorded during the monitoring. A machine learning model is constructed according to the recorded data to establish a data change probability for the plurality of files. An unexpected change is detected using the machine learning model according to the data change probability of the files having changed data. A warning notification is sent indicating the unexpected change is detected for the files.

Identifying attacks on file systems

A computing anomaly detection technique includes identifying a plurality of compute resources that are susceptible to compute resource anomalies. A group of similar compute resources from the plurality of compute resources may be determined. A difference in one or more of a plurality of attributes of the compute resources of the group may be determined. An anomaly detection notification, containing a compute resource anomaly, may be output.

Detecting compute resource anomalies in a group of computing resources

A decoy network-based service uses a decoy credential to lure an attacker to access the decoy network-based service, and monitors the attacker's activity with respect to the decoy network-based service to determine the attacker's motivation. In various examples, a decoy credential is published on an Internet-accessible site, and a system that provides a network-based service (e.g., a service provider network) subsequently receives an access request from a computing device that includes the decoy credential. Based on the decoy credential, the computing device may be provided access to a decoy network-based service, and application programming interface (API) calls made by the computing device may be routed through a decoy control plane. The data relating to the API calls may be stored and analyzed to determine a motivation of the attacker, which may be used in various downstream applications to improve security for customers of the network-based service.

Decoy network-based service for deceiving attackers

A plurality of computing resources are provisioned for a plurality of computing system elements based at least in part on input specification information, whereby the input specification specifies the plurality of computing resources. The plurality of computing resources include one or more computing resources of a first computing system element of the plurality of computing system elements that are provided for a second computing system element of the plurality of computing system elements. The plurality of computing system elements are evaluated to identify whether the plurality of computing system elements are successfully executed and a report is generated based at least in part on the evaluation.

Computing system testing service

Systems for providing a subscription-based multi-tenant threat intelligence service are provided. The systems receive first threat information associated with a first source of a first threat intelligence feed. Receive an indication that a first user associated with a first computing resource within a compute environment has subscribed to the first threat intelligence feed. Determine, based on the first threat information and the first user's subscription to the first threat intelligence feed, that a portion of activity associated with the first computing resource includes activity by an endpoint identified in the first threat information. In response to determining that the portion of the activity includes activity by an endpoint identified in the first threat information, perform an action.

Subscription-based multi-tenant threat intelligence service

Technology for provision and use of computing resource management is provided. In one example, a method may include initiating a computing resource for use by an application distributed across a plurality of computing resources and obtaining an identifier for the application at the computing resource. The computing resource may be registered with a deployment state service configured to monitor deployment of the plurality of computing resources for the application. Metrics for the computing resource over time may be associated with the application using the identifier.

Deployment monitoring for an application

A computing resource service receives a request to perform a change to a configuration of a service provider account. In response to the request, the computing resource service determines if the service provider account has been designated as being immutable. If the service provider account is designated as being immutable, the computing resource service causes an account security service to transmit a notification to administrators of the service provider account to determine whether the administrators authorize the change to the service provider account. If the administrators approve of the requested change, the computing resource service fulfills the request.

Immutable accounts

Disclosed are various embodiments for reporting as well as tracking usage and/or installation of an application in a machine instance in a computing environment. A machine instance can execute an application and can be associated with a storage volume on which the application is installed. The application, or an installer utility associated with the application, can report installation and/or usage of the application to an application usage service.

Tracking application usage in a computing environment

Systems are provided for collecting threat intelligence to use in monitoring network activity in computing environments for malicious activity. The systems load sensors into compute resources associated with particular users of a compute resource virtualization platform. The systems receive network activity information sent by first and second sensors, identify an IP address as being a suspected source of malicious computing activity using aggregated the first and second network activity, and generate threat information that includes the IP address as a suspected source of malicious computing activity.

Threat intelligence system

Embodiments of the present disclosure are directed to, among other things, performing automated configuration of infrastructure components associated with a software system. In some examples, configuration information associated with an infrastructure component of a software system may be received. Additionally, a set of instructions configured to enable configuration of the software system may be generated. Based at least in part on execution of the set of instructions, remote feedback associated with the software system may be received. Additionally, in some examples, the infrastructure component may be configured based at least in part on the received remote feedback.

Automated infrastructure configuration

A technology is described for detecting a failure of a primary virtualized device and failing over to a secondary virtualized network device. An example method may include generating a statistical model using historical data for network traffic that has been handled by a primary virtualized device. The statistical model may contain a functional state baseline representing a functional state of the primary virtualized device handling network traffic during a time frame. Having generated the statistical model, the functional state of the primary virtualized device may be monitored by calculating a network traffic metric for current network traffic handled by the primary virtualized device and comparing the network traffic metric for current network traffic handled by the primary virtualized device with a data point in the statistical model corresponding to the network traffic metric and the time frame for the network traffic metric.

Growing community of inventors

Saint James, NY, United States of America

Thomas Charles Stickle