Cloud data schema detection system

1. A computer-implemented method for detecting data posture of a cloud environment, the computer-implemented method comprising:

executing a cloud scanner in the cloud environment to:

discover one or more structured databases in the cloud environment, and return metadata representing a structure database schema of data objects in the one or more structured databases;

for each respective data object of the data objects in the structure of schema objects one or more structured databases,

traversing the respective data object based on the metadata to identify a plurality of data items stored in the data object and arranged in a structural relationship defined by the database schema, and

executing a content-based data classifier to:

classify a first data item, in the plurality of data items as matching a first based on a plurality of pre-defined data profile,

classify a second data item, in the plurality of data items, as matching a second pre-defined data profile, and

detect an instance of a composite data profile based on a determination that a relational distance between the first data item and the second data item is within a threshold proximity;

for a given data object in the database schema of data objects, generating a classifier result that identifies the instance of the composite data profile; and

outputting a representation of the classifier result.

2. The computer-implemented method of claim 1 , wherein the computer-implemented method further comprises:

generating a user interface display that includes:

a composite data profile identifier that identifies the instance of the composite data profile, and

a counter display element that identifies a number of detected instances of the composite data profile in the one or more structured databases.

3. The computer-implemented method of claim 2 , wherein the user interface display includes:

a first profile display element that identifies instances of data items that match the first pre-defined data profile, and

a second profile display element that identifies instances of data items that match the second pre-defined data profile.

4. The computer-implemented method of claim 3 , wherein the counter display element comprises a first counter display element, and the user interface display includes:

a second counter display element that identifies a number of detected instances of the first pre-defined data profile, and

a third counter display element that identifies a number of detected instances of the first pre-defined data profile.

5. The computer-implemented method of claim 1 , wherein each of the first pre-defined data profile and the second pre-defined data profile represents different sensitive data types.

6. The computer-implemented method of claim 1 , wherein

the data objects comprise rows in a table, the plurality of data items comprises a plurality of cells, and

the threshold proximity includes occurrence of data items within a same row in the table.

7. The computer-implemented method of claim 1 , and further comprising:

generating a confidence score based on the metadata, the confidence score representing a confidence of the classification of the first data item and the second data item; and

generating a user interface display that identifies the first data item and the second data item based on the confidence score.

8. The computer-implemented method of claim 1 , and further comprising:

generating a query representing a subject path signature;

executing the query to qualify a set of network paths in the cloud environment as conforming to the subject path signature; and

outputting query results identifying the qualified set of network paths.

9. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

execute a cloud scanner in a cloud environment to discover one or more structured databases in the cloud environment and return metadata representing a structure database schema of data objects in the one or more structured databases;

for each respective data object of the data objects in the structure of schema objects one or more structured databases,

traverse the respective data object based on the metadata to identify a plurality of data items stored in the data object and arranged in a structural relationship defined by the database schema, and

execute a content-based data classifier to:

classify a first data item, in the plurality of data items as matching a first based on a plurality of pre-defined data profile,

classify a second data item, in the plurality of data items, as matching a second pre-defined data profile, and

detect an instance of a composite data profile based on a determination that a relational distance between the first data item and the second data item is within a threshold proximity;

for a given data object in the database schema of data objects,

generate a classifier result that identifies the instance of the composite data profile; and

output a representation of the classifier result.

10. The computing system of claim 9 , wherein the instructions, when executed, cause the computing system to:

generate a user interface display that includes:

a composite data profile identifier that identifies the instance of the composite data profile, and

a counter display element that identifies a number of detected instances of the composite data profile in the one or more structured databases.

11. The computing system of claim 9 , wherein each of the first pre-defined data profile and the second pre-defined data profile represents different sensitive data profiles.

12. The computing system of claim 10 , wherein the counter display element comprises a first counter display element, and the user interface display includes:

a first profile display element that identifies instances of data items that match the first pre-defined data profile,

a second profile display element that identifies instances of data items that match the second pre-defined data profile,

a second counter display element that identifies a number of detected instances of the first pre-defined data profile, and

a third counter display element that identifies a number of detected instances of the first pre-defined data profile.

13. The computing system of claim 9 , wherein

the data objects comprise rows in a table,

the plurality of data items comprises a plurality of cells, and

the threshold proximity includes occurrence of data items within a same row in the table.

14. The computing system of claim 9 , wherein the instructions, when executed, cause the computing system to:

generate a confidence score based on the metadata, the confidence score representing a confidence of the classification of the first data item and the second data item; and

generate a user interface display that identifies the first data item and the second data item based on the confidence score.

15. The computing system of claim 9 , wherein the instructions, when executed, cause the computing system to:

generate a query representing a subject path signature;

execute the query to qualify a set of network paths in the cloud environment as conforming to the subject path signature; and

output query results identifying the qualified set of network paths.

16. The computing system of claim 15 , wherein

the subject path signature comprises a subject vulnerability signature in the cloud environment, and

the instructions, when executed, cause the computing system to:

execute the query comprises qualifying one or more compute resources or storage resources as vulnerable to breach attack based on the classification conforming to the subject path signature.

17. A computer-implemented method for detecting data posture of a cloud environment, the computer-implemented method comprising:

executing a cloud scanner in the cloud environment to discover one or more structured databases in the cloud environment and return metadata representing a structure of schema objects in the one or more structured databases;

for each schema object in the structure of schema objects, traversing the schema object based on the metadata to identify a plurality of data items stored in the schema object, and executing a content-based data classifier to classify data items in the plurality of data items based on a plurality of pre-defined data profiles;

generating a confidence score based on the metadata, the confidence score representing a confidence of the classification of the data items;

for a given schema object in the structure of schema objects, generating a classifier result that identifies a first data item in the given schema object as matching a first pre-defined data profile of the plurality of pre-defined data profiles, and a second data item in the given schema object as matching a second pre-defined data profile of the plurality of pre-defined data profiles;

detecting an instance of a composite data profile based on a determination that a relational distance between the first data item and the second data item is within a threshold proximity; and

generating a user interface display that includes:

a first profile display element that identifies instances of data items that match the first pre-defined data profile, a second profile display element that identifies instances of data items that match the second pre-defined data profile, and a confidence score display element that displays the confidence score.

18. The computer-implemented method of claim 17 , wherein the given schema object comprises a row in a table, and the threshold proximity includes occurrence of data items within the row in the table.

19. The computer-implemented method of claim 18 , wherein the user interface display includes: a counter display element that identifies a number of detected instances of the composite data profile in the one or more structured databases.