Predictive scan engine runtime durations
Various embodiments include systems and methods to implement predictive scan engine runtime durations by a security platform to predict runtime durations associated with computing resources. Predictive scan engine runtime durations may be determined by training a prediction model using a multiple linear regression analysis. For example, the security platform may determine a prediction model using training data that associates runtime durations with configuration inputs associated with a security service that operates with respect to a computing resource. Based on the prediction model, the security platform may determine a runtime estimate for a security service run that is configured similarly to a previous security service run used to train the prediction model.
1. A method comprising:
executing program instructions on one or more processors of a computer system, wherein the program instructions are stored in a memory of the computer system and the execution includes:
receiving a request for an estimation of a runtime of a security scan with respect to a computing resource;
determining a dataset that includes one or more configuration inputs associated with the computing resource, wherein the security scan is configured in accordance with the one or more configuration inputs;
determining, based on a prediction model using the dataset as input, an estimated runtime of the security scan with respect to the computing resource; and
providing, in response to the request, the estimated runtime of the security scan with respect to the computing resource.
2. The method of claim 1 , the execution further comprising:
receiving, prior to the receiving the request, a first training dataset that includes a plurality of configuration inputs associated with a plurality of security scan runs associated with a plurality of computing resources;
receiving, prior to the receiving the request, a second training dataset that includes a plurality of runtimes associated with the plurality of security scan runs;
training, based on the first training dataset and on the second training dataset, the prediction model that estimates runtimes.
3. The method of claim 2 , the execution further comprising:
initiating a security scan run with respect to the computing resource;
determining, based on the security scan run, first data that includes the one or more configuration inputs associated with the computing resource;
determining, based on the security scan run, second data that includes a runtime associated with the security scan run; and
training, based on the first training dataset, on the first data, on the second training dataset, and on the second data, an updated prediction model that estimates runtimes;
wherein the prediction model comprises the updated prediction model.
4. The method of claim 1 , the execution further comprising:
determining a training event that includes one or more conditions associated with retraining the prediction model; and
training, in response to the training event, an updated computation model that estimates runtimes;
wherein the prediction model comprises the updated computation model.
5. The method of claim 4 , wherein the training event comprises at least one of: lapse of a specified period of time, completion of a threshold number of operational runs of the security scan, or a change in a configuration input associated with the computing resource.
6. The method of claim 1 , wherein the security scan is performed by a security service to scan for vulnerabilities to cyberattacks on the computing resource.
7. The method of claim 1 , wherein the one or more configuration inputs associated with the computing resource include one or more of: a number of endpoints to scan, a number of attack modules, a number of compute instances configured to run the security scan, or a hardware configuration of the compute instances.
8. A system comprising:
a memory storing executable instructions; and
one or more processors that execute the executable instructions to:
receive a request for an estimation of a runtime of a security scan with respect to a computing resource;
determine a dataset that includes one or more configuration inputs associated with the computing resource, wherein the security scan is configured in accordance with the one or more configuration inputs;
determine, based on a prediction model using the dataset as input, an estimated runtime of the security scan with respect to the computing resource; and
provide, in response to the request, the estimated runtime of the security scan with respect to the computing resource.
9. The system of claim 8 , wherein the one or more processors further execute the executable instructions to:
receive, prior to the receiving the request, a first training dataset that includes a plurality of configuration inputs associated with a plurality of security scan runs associated with a plurality of computing resources;
receive, prior to the receiving the request, a second training dataset that includes a plurality of runtimes associated with the plurality of security scan runs;
train, based on the first training dataset and on the second training dataset, the prediction model that estimates runtimes.
10. The system of claim 8 , wherein the one or more processors further execute the executable instructions to:
initiate a security scan run with respect to the computing resource;
determine, based on the security scan run, first data that includes the one or more configuration inputs associated with the computing resource;
determine, based on the security scan run, second data that includes a runtime associated with the security scan run; and
train, based on the first training dataset, on the first data, on the second training dataset, and on the second data, an updated prediction model that estimates runtimes;
wherein the prediction model comprises the updated prediction model.
11. The system of claim 8 , wherein the one or more processors further execute the executable instructions to:
determine a training event that includes one or more conditions associated with retraining the prediction model; and
train, in response to the training event, an updated computation model that estimates runtimes;
wherein the prediction model comprises the updated computation model.
12. The system of claim 8 , wherein the training event comprises at least one of: lapse of a specified period of time, completion of a threshold number of operational runs of the security scan, or a change in a configuration input associated with the computing resource.
13. The system of claim 8 , wherein the security scan is performed by a security service to scan for vulnerabilities to cyberattacks on the computing resource.
14. The system of claim 8 , wherein the one or more configuration inputs associated with the computing resource include one or more of: a number of endpoints to scan, a number of attack modules, a number of compute instances configured to run the security scan, or a hardware configuration of the compute instances.
15. One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause a computer system to:
receive a request for an estimation of a runtime of a security scan with respect to a computing resource;
determine a dataset that includes one or more configuration inputs associated with the computing resource, wherein the security scan is configured in accordance with the one or more configuration inputs;
determine, based on a prediction model using the dataset as input, an estimated runtime of the security scan with respect to the computing resource; and
provide, in response to the request, the estimated runtime of the security scan with respect to the computing resource.
16. The non-transitory computer-accessible storage media of claim 15 , wherein the one or more processors further execute the executable instructions to:
receive, prior to the receiving the request, a first training dataset that includes a plurality of configuration inputs associated with a plurality of security scan runs associated with a plurality of computing resources;
receive, prior to the receiving the request, a second training dataset that includes a plurality of runtimes associated with the plurality of security scan runs;
train, based on the first training dataset and on the second training dataset, the prediction model that estimates runtimes.
17. The non-transitory computer-accessible storage media of claim 15 , wherein the one or more processors further execute the executable instructions to:
initiate a security scan run with respect to the computing resource;
determine, based on the security scan run, first data that includes the one or more configuration inputs associated with the computing resource;
determine, based on the security scan run, second data that includes a runtime associated with the security scan run; and
train, based on the first training dataset, on the first data, on the second training dataset, and on the second data, an updated prediction model that estimates runtimes;
wherein the prediction model comprises the updated prediction model.
18. The non-transitory computer-accessible storage media of claim 15 , wherein the one or more processors further execute the executable instructions to:
determine a training event that includes one or more conditions associated with retraining the prediction model; and
train, in response to the training event, an updated computation model that estimates runtimes;
wherein the prediction model comprises the updated computation model.
19. The non-transitory computer-accessible storage media of claim 15 , wherein the training event comprises at least one of: lapse of a specified period of time, completion of a threshold number of operational runs of the security scan, or a change in a configuration input associated with the computing resource.
20. The non-transitory computer-accessible storage media of claim 15 , wherein the security scan is performed by a security service to scan for vulnerabilities to cyberattacks on the computing resource.