Granted Patent B1

US 12,659,325 · App. 17/989,370 · Granted Jun 16, 2026

Inventors: George B. Spofford (Redwood City, CA); Ulfar Erlingsson (Palo Alto, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (37)

1 . A method comprising:

accessing, by a data platform, workload data associated with a plurality of logical entities executing in a computing environment;

analyzing, by the data platform using a machine learning model, the workload data to determine behavioral relationships among the logical entities based on patterns in the workload data;

generating, by the data platform, a graph structure using the machine learning model that represents logical entities associated with the workload data as nodes and representing behavioral relationships as edges;

generating, by the data platform and based on the analysis of the workload data comprising at least the graph, a rule specific to one or more of the logical entities and associated with an operation of the one or more workloads based on the graph structure, the rule representing a learned behavior or correlation derived from the behavioral relationships; and

performing, by the data platform, an operation with respect to the one or more of the logical entities in accordance with the generated rule.

2 . The method of claim 1 , wherein the accessing the workload data comprises receiving the workload data from a privileged agent configuration deployed within the compute environment and configured to collect and transmit, to the data platform, the workload data.

3 . The method of claim 1 , wherein the accessing the workload data comprises receiving the workload data from an unprivileged agentless configuration configured to collect and transmit, to the data platform, the workload data.

4 . The method of claim 1 , wherein the analysis of the workload data includes an analysis of data generated by the data platform using the workload data.

5 . The method of claim 4 , wherein the data generated by the data platform using the workload data comprises data representative of a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from the workload data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge.

6 . The method of claim 1 , wherein the generating the rule is further based on an analysis of workload data associated with one or more workloads included in a compute environment separate from the compute environment.

7 . The method of claim 1 , wherein the analysis of the workload data is performed using a machine learning algorithm.

8 . The method of claim 1 , wherein the generating the rule is based on a detection of an anomaly associated with the workload data.

9 . The method of claim 1 , wherein the generating the rule is based on an event associated with the one or more workloads.

10 . The method of claim 1 , wherein the generating the rule includes generating a new rule not previously implemented within the compute environment and associated with the operation of the one or more workloads.

11 . The method of claim 1 , wherein the generating the rule includes modifying a parameter of a preexisting rule associated with the operation of the one or more workloads.

12 . The method of claim 1 , wherein the performing the operation includes implementing the rule such that the one or more workloads are configured to operate in compliance with the rule.

13 . The method of claim 12 , wherein the performing the operation further includes determining whether the one or more workloads are being operated in compliance with the rule.

14 . The method of claim 1 , wherein the performing the operation includes presenting the rule to a user as a recommended action.

15 . The method of claim 14 , wherein the performing the operation further includes implementing, in response to input from the user, the rule such that the one or more workloads are configured to operate in compliance with the rule.

16 . The method of claim 1 , wherein the performing the operation includes performing an operation associated with the one or more workloads.

17 . A system comprising:

a memory storing instructions; and

one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:

accessing, by a data platform, workload data associated with a plurality of logical entities executing in a computing environment;

analyzing, by the data platform using a machine learning model, the workload data to determine behavioral relationships among the logical entities based on patterns in the workload data;

generating, by the data platform, a graph structure using the machine learning model that represents logical entities associated with the workload data as nodes and representing behavioral relationships as edges;

generating, by the data platform and based on the analysis of the workload data comprising at least the graph, a rule specific to one or more of the logical entities and associated with an operation of the one or more workloads based on the graph structure, the rule representing a learned behavior or correlation derived from the behavioral relationships; and

performing, by the data platform, an operation with respect to the one or more of the logical entities in accordance with the generated rule.

18 . The system of claim 17 , wherein the analysis of the workload data includes an analysis of data generated by using the workload data.

19 . The system of claim 17 , wherein the analysis of the workload data is performed using a machine learning algorithm.

20 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

accessing, by a data platform, workload data associated with a plurality of logical entities executing in a computing environment;

analyzing, by the data platform using a machine learning model, the workload data to determine behavioral relationships among the logical entities based on patterns in the workload data;

generating, by the data platform, a graph structure using the machine learning model that represents logical entities associated with the workload data as nodes and representing behavioral relationships as edges;

generating, by the data platform and based on the analysis of the workload data comprising at least the graph, a rule specific to one or more of the logical entities and associated with an operation of the one or more workloads based on the graph structure, the rule representing a learned behavior or correlation derived from the behavioral relationships; and

performing, by the data platform, an operation with respect to the one or more of the logical entities in accordance with the generated rule.

Assignments (1)

Continuity (10)

References Cited (400)