IP Library › Granted Patent US 12706940
Granted Patent B1
US 12706940 · App. 18/226,434 · Granted Aug 11, 2026

Using large language models to infer intents of applications

Inventors: Samuel Bayless (Seattle, WA); Aaron Robert Bradley (Boulder, CO); Lee Pike (Portland, OR); Nishant Kumar (Los Angeles, CA); Shachar Israel Hirshberg (New York, NY)
Assignee: AMAZON TECHNOLOGIES, INC.
H04L63/1433H04L41/16
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12706940
App. No.
18/226,434
Granted
Aug 11, 2026
Kind
B1
Abstract

Techniques for an intent-inference system to use large language models (LLMs) to infer intents of applications running in user accounts. The system is granted permissions to obtain metadata for application resources, and uses the LLMs to analyze the metadata and infer the intended functionality of the applications. The system uses prompt engineering to interact with the LLMs by embedding the metadata as input into the LLMs, and has LLMs infer the intended functionality of resources in an application. The system generates a formal specification of the application that defines the intended relationships between the resources, and the overall functionality of the application. The formal specification may be used to generate a human-readable summary for users to validate that the inferred formal specification matches their understanding of their application. Further, the intent-inference system may generate a machine-readable representation of the formal specification that is used for various use cases.

Claims (83)

1 . A service provider system comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the service provider system to perform operations comprising:

receiving metadata associated with resources of an application running in a computing infrastructure for a user account associated with the service provider system;

prompting a large language model (LLM) to use the metadata to infer an overall inferred intent of the application;

receiving, from the LLM, a formal specification that represents the overall inferred intent of the application, the formal specification including inferred configurations of the application;

receiving, from a security service, security findings that indicate security vulnerabilities for the application;

analyzing the security findings with respect to the inferred configurations of the application;

identifying a security finding of the application at least partly using the inferred configurations;

determining that the security finding has a violation with a particular inferred configuration of the inferred configurations;

modifying the security finding based at least in part on the violation that the security finding has with the particular inferred configuration; and

performing an operation based at least in part on the modified security finding.

2 . The service provider system of claim 1 , wherein the metadata includes first metadata associated with a first resource and second metadata associated with a second resource, the operations further comprising:

prompting the LLM to use the first metadata to infer a first inferred intent of the first resource;

receiving, from the LLM, a first indication of the first inferred intent of the first resource; prompting the LLM to use the second metadata to infer a second inferred intent of the second resource; and

receiving, from the LLM, a second indication of the second inferred intent of the second resource, wherein prompting the LLM to infer the overall inferred intent of the application includes providing the LLM with the first inferred intent and the second inferred intent.

3 . The service provider system of claim 2 , the operations further comprising:

identifying, from the resources, a group of resources that have relationships with the first resource; and

obtaining configuration data indicating configurations for the group of resources; wherein prompting the LLM to infer the first inferred intent of the first resource includes:

providing the LLM with the configuration data indicating the configurations for the group of resources that have relationships with the first resource; and

refraining from providing the LLM with additional configuration data that indicates configurations for the first resource such that the LLM infers the additional configuration data for the first resource.

4 . The service provider system of claim 2 , wherein the first metadata includes:

a name given to the first resource;

a tag assigned to the first resource; and

a portion of configuration data indicating configurations of the first resource, wherein the first metadata includes less than all of the configurations of the first resource.

5 . The service provider system of claim 1 , the operations further comprising:

obtaining actual configurations for the application of the user account;

identifying a difference between the inferred configurations and the actual configurations; and

determining, based at least in part on the difference, a modification for the actual configurations that improves the application.

6 . The service provider system of claim 1 , the operations further comprising obtaining actual configurations for the application of the user account, wherein:

identifying the security finding includes identifying a difference between the inferred configurations and the actual configurations; and

performing the operation includes providing the user account with an indication of the security finding.

7 . The service provider system of claim 1 , the operations further comprising:

receiving, from the user account, a request to troubleshoot an issue with the application;

obtaining actual configurations for the application of the user account;

identifying a difference between the inferred configurations and the actual configurations;

determining a modification for the actual configurations of the application that reconciles the difference with the inferred configurations remedies the issue; and

providing the user account with an indication of the modification for the actual configurations to remedy the issue.

8 . The service provider system of claim 1 , the operations further comprising:

obtaining actual configurations for the application of the user account;

determining, using the actual configurations, that a particular resource is running on a first virtual resource type;

determining, using the inferred configurations, that a second virtual resource type is more suitable for running the particular resource than the first virtual resource type; and

providing the user account with an indication that the second virtual resource type is more suitable for running the particular resource than the first virtual resource type.

9 . A method comprising:

receiving metadata associated with resources of an application running in a computing infrastructure for a user account associated with a service provider system;

prompting a large language model (LLM) to use the metadata to infer an overall inferred intent of the application;

receiving, from the LLM, a formal specification that defines the overall inferred intent of the application, the formal specification including inferred configurations of the application;

receiving, from a security service, security findings that indicate security vulnerabilities for the application;

analyzing the security findings with respect to the inferred configurations of the application;

identifying a security finding of the application at least partly using the inferred configurations;

determining that the security finding has a violation with a particular inferred configuration of the inferred configurations;

modifying the security finding based at least in part on the violation that the security finding has with the particular inferred configuration; and

performing an operation based at least in part on the modified security finding.

10 . The method of claim 9 , further comprising:

obtaining actual configurations of the application;

comparing the inferred configurations with the actual configurations to identify a difference between the inferred configurations and the actual configurations;

determining, based at least in part on the difference, a configuration modification to the actual configurations that improves the application;

receiving, from a user associated with the user account, a request to troubleshoot an issue with the application;

determining that the configuration modification to the actual configurations of the application reconciles the difference and remedies the issue; and

providing the user with an indication of the configuration modification for the actual configurations to remedy the issue.

11 . The method of claim 10 , wherein comparing the inferred configurations with the actual configurations includes

determining, using the actual configurations, that a particular resource is running on a virtual machine (VM) of a first VM type; and

determining, using the inferred configurations, that a second VM type is more suitable for running the particular resource than the first VM type; and

further comprising providing the user with an indication that the second VM type is more suitable for running the particular resource than the first VM type.

12 . The method of claim 11 , further comprising

determining, based at least in part on the difference, a security vulnerability in the actual configurations of the application, wherein the configuration modification remedies the security vulnerability; and

providing the user with an indication of the security vulnerability and the configuration modification that remedies the security vulnerability.

13 . The method of claim 9 , wherein the metadata includes first metadata associated with a first resource and second metadata associated with a second resource, further comprising:

prompting the LLM to use the first metadata to infer a first inferred intent of the first resource;

receiving, from the LLM, a first indication of the first inferred intent of the first resource;

prompting the LLM to use the second metadata to infer a second inferred intent of the second resource; and

receiving, from the LLM, a second indication of the second inferred intent of the second resource, wherein prompting the LLM to infer the overall inferred intent of the application includes providing the LLM with the first inferred intent and the second inferred intent.

14 . The method of claim 13 , further comprising:

generating a first human-readable description of the first inferred intent of the first resource;

generating a second human-readable description of the second inferred intent of the second resource;

generating a third human-readable description of the overall inferred intent of the application; and

providing a user associated with the user account with access to the first, second, and third human-readable descriptions.

15 . The method of claim 13 , further comprising:

identifying, from the resources, a group of resources that have relationships with the first resource;

obtaining configuration data indicating configurations for the group of resources;

wherein prompting the LLM to infer the first inferred intent of the first resource includes:

providing the LLM with the configuration data indicating the configurations for the group of resources that have relationships with the first resource; and

refraining from providing the LLM with additional configuration data that indicates configurations for the first resource such that the LLM infers the additional configuration data for the first resource.