Granted Patent B1

US 12,659,326 · App. 18/128,941 · Granted Jun 16, 2026

Inventors: Jacob A. Kilby (San Francisco, CA); Theodore M. Reed (Berkeley Heights, NJ); Ammar G. Ekbote (Renton, WA); Whitney L. Smith (San Jose, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (35)

1 . A method comprising:

generating a replication dataset of workload data deployed on a first compute node within a cloud environment, wherein the replication dataset comprises a clone of the workload data;

mounting the replication dataset on a second compute node within the cloud environment;

analyzing the replication dataset at the second compute node, including comparing the replication dataset to a previous replication dataset;

determining whether an anomaly is associated with the workload based on the analysis; and

generating a graph upon determining that an anomaly is associated with the workload.

2 . The method of claim 1 , wherein the replication dataset includes a compressed image of the workload.

3 . The method of claim 2 , wherein the generating the replication dataset includes storing the compressed image in a bucket within the cloud environment.

4 . The method of claim 3 , wherein analyzing the replication dataset includes accessing the compressed image in the bucket using a fuse file system.

5 . The method of claim 1 , wherein the workload is associated with an entity and the replication of the workload dataset is performed at a serverless function that does not have access to underlying entity data in the cloud environment.

6 . The method of claim 1 , wherein the generating the replication dataset includes generating a replication dataset of a portion of the workload that is less than an entirety of the workload.

7 . The method of claim 1 , wherein the replication dataset comprises data representative of one or more of: a configuration of the workload, a type of the workload, a customer identification of the workload, an identity of a user accessing the workload, a service associated with the workload, an action performed by the workload, a response from the workload, a size of the workload, a time associated with the workload, one or more events associated with the workload, a process execution history associated with the workload, security-related data associated with the workload, or a keyword associated with the workload.

8 . The method of claim 1 , wherein the second compute node is out of band with the workload.

9 . The method of claim 1 , wherein the analysis graph comprises a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from the workload and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge.

10 . The method of claim 1 , further comprising performing an operation with respect to an agent deployed within the cloud environment to collect runtime workload data associated with the workload.

11 . A cloud computing environment comprising one or compute resources to execute one or more instruction, which cause the computing resources to perform:

generating a replication dataset of workload data deployed on a first compute node within the cloud environment, wherein the replication dataset comprises a clone of the workload data;

mounting the replication dataset on a second compute node within the cloud environment;

analyzing the replication dataset at the second compute node, including comparing the replication dataset to a previous replication dataset;

determining whether an anomaly is associated with the workload based on the analysis; and

generating a graph upon determining that an anomaly is associated with the workload.

12 . The cloud computing environment of claim 11 , wherein the workload is associated with an entity and the replication of the workload dataset is performed at a serverless function that does not have access to underlying entity data in the cloud environment.

13 . The cloud computing environment of claim 11 , wherein the second compute node is out of band with the workload.

14 . The cloud computing environment of claim 11 , wherein the replication dataset includes a compressed image of the workload.

15 . The cloud computing environment of claim 14 , wherein the generating the replication dataset includes storing the compressed image in a bucket within the cloud environment.

16 . The cloud computing environment of claim 15 , wherein analyzing replication dataset includes accessing the compressed image in the bucket using a fuse file system.

17 . The cloud computing environment of claim 11 , wherein the workload is associated with an entity and the replication of the workload dataset is performed at a serverless function that does not have access to underlying entity data in the cloud environment.

18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions capable of being executed to perform a process comprising:

generating a replication dataset of workload data deployed on a first compute node within a cloud environment, wherein the replication dataset comprises a clone of the workload data;

mounting the replication dataset on a second compute node within the cloud environment;

analyzing the replication dataset at the second compute node, including comparing the replication dataset to a previous replication dataset;

determining whether an anomaly is associated with the workload based on the analysis; and

generating a graph upon determining that an anomaly is associated with the workload.

19 . The computer program product of claim 18 , wherein the replication dataset includes a compressed image of the workload.

20 . The computer program product of claim 18 , wherein the generating the replication dataset includes storing a compressed image in a bucket within the cloud environment.

Assignments (1)

Continuity (10)

References Cited (400)