Granted Patent B2

US 12,659,228 · App. 18/405,749 · Granted Jun 16, 2026

Inventors: Paul Sumedrea (Bucharest, RO); Damian Monea (Bucharest, RO)

Assignee: CrowdStrike, Inc.

H04L41/084G06F40/20

Abstract

Claims (72)

1 . A method comprising:

receiving, from a client device, a set of parameters associated with one or more network entities of a computing network;

providing the set of parameters to a configuration model trained to determine a misconfiguration of network entities are misconfigured and generate, based on semantic matching, recommended configurations for the network entities;

generating, by a processing device and using the configuration model and a particular historical configuration associated with the network entities, one or more recommended configurations for the one or more network entities based on the set of parameters by identifying a plurality of historical configurations previously generated by a plurality of client devices and determining that the particular historical configuration of the plurality of historical configurations was previously generated by the client device;

validating, by the processing device, each of the one or more recommended configurations using the configuration model of the computing network to determine whether application of the recommended configuration resolves the misconfiguration without introducing an additional policy violation;

selecting, as the one or more recommended configurations to be provided, only those recommended configurations that satisfy the validation; and

providing the one or more recommended configurations to the client device to be used by the client device to replace the misconfiguration of the network entities with the one or more recommended configurations.

2 . The method of claim 1 , wherein the set of parameters comprises at least one of a network rule, a network configuration, or a network policy.

3 . The method of claim 1 , wherein generating, by the processing device using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters comprises:

determining a desired outcome based on the set of parameters;

determining a plurality of actions to cause the desired outcome; and

identifying a subsequent action of the plurality of actions based on a chronological order,

wherein the one or more recommended configurations indicate the subsequent action.

4 . The method of claim 1 , wherein generating, by the processing device using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters comprises:

identifying a pool of configuration rules for one or more policies; and

selecting, from the pool of configuration rules, a best configuration rule for the one or more policies.

5 . The method of claim 1 , wherein generating, by the processing device using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters comprises:

condensing the set of parameters into fewer parameters indicative of the set of parameters, wherein the one or more recommended configurations indicate the fewer parameters.

6 . The method of claim 1 , wherein generating, by the processing device using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters comprises:

generating one or more natural language strings describing the set of parameters.

7 . The method of claim 6 , further comprising:

generating a file comprising the one or more natural language strings; and

providing the file to the client device.

8 . The method of claim 1 , further comprising:

providing a different set of parameters to the configuration model; and

generating, using the configuration model, a model output indicating whether the different set of parameters achieve a desired objective.

9 . The method of claim 8 , wherein generating, using the configuration model, the model output further comprises:

determining, using the configuration model, whether the different set of parameters achieve the desired objective; and either:

indicating, in the model output, that the different set of parameters is a valid configuration responsive to determining that the different set of parameters achieve the desired objective; or

indicating, in the model output, that the different set of parameters is an invalid configuration responsive to determining that the different set of parameters fail to achieve the desired objective.

10 . The method of claim 8 , further comprising:

generating a reason for why the configuration model generated the one or more recommended configurations.

11 . A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

receiving, from a client device, a set of parameters associated with one or more network entities of a computing network;

provide the set of parameters to a configuration model trained to determine a misconfiguration of network entities are misconfigured and generate, based on semantic matching, recommended configurations for network entities;

generate, using the configuration model and a particular historical configuration associated with the network entities, one or more recommended configurations for the one or more network entities based on the set of parameters by identifying a plurality of historical configurations previously generated by a plurality of client devices and determining that the particular historical configuration of the plurality of historical configurations was previously generated by the client device;

validate, by the processing device, each of the one or more recommended configurations using the configuration model of the computing network to determine whether application of the recommended configuration resolves the misconfiguration without introducing an additional policy violation;

select, as the one or more recommended configurations to be provided, only those recommended configurations that satisfy the validation; and

provide the one or more recommended configurations to the client device to be used by the client device to replace the misconfiguration of the network entities with the one or more recommended configurations.

12 . The system of claim 11 , wherein the set of parameters comprises at least one of a network rule, a network configuration, or a network policy.

13 . The system of claim 11 , wherein to generate, using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters, the processing device is further to:

determine a desired outcome based on the set of parameters;

determine a plurality of actions to cause the desired outcome; and

identify a subsequent action of the plurality of actions based on a chronological order,

wherein the one or more recommended configurations indicate the subsequent action.

14 . The system of claim 11 , wherein to generate, using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters, the processing device is further to:

identify a pool of configuration rules for one or more policies; and

select, from the pool of configuration rules, a best configuration rule for the one or more policies.

15 . The system of claim 11 , wherein to generate, by the processing device using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters, the processing device is further to:

condense the set of parameters into fewer parameters indicative of the set of parameters, wherein the one or more recommended configurations indicate the fewer parameters.

16 . The system of claim 11 , wherein to generate, using the configuration model, the one or more recommended configurations for the one or more network entities based on the set of parameters, the processing device is to:

generate one or more natural language strings describing the set of parameters.

17 . The system of claim 16 , wherein the processing device is further to:

generate a file comprising the one or more natural language strings; and

provide the file to the client device.

18 . The system of claim 11 , wherein the processing device is further to:

provide a different set of parameters to the configuration model;

generate, using the configuration model, a model output indicating whether the different set of parameters achieve a desired objective; and

generating a reason for why the configuration model generated the one or more recommended configurations.

19 . The system of claim 18 , wherein to generate, using the configuration model, the model output, the processing device is further to:

determine, using the configuration model, whether the different set of parameters achieve the desired objective; and either:

indicate, in the model output, that the different set of parameters is a valid configuration responsive to determining that the different set of parameters achieve the desired objective; or

indicate, in the model output, that the different set of parameters is an invalid configuration responsive to determining that the different set of parameters fail to achieve the desired objective.

20 . A non-transitory computer-readable medium storing instructions that, when execute by a processing device, cause the processing device to:

receive, from a client device, a set of parameters associated with one or more network entities of a computing network;

provide the set of parameters to a configuration model trained to determine a misconfiguration of network entities are misconfigured and generate, based on semantic matching, recommended configurations for network entities;

generate, by the processing device and using the configuration model and a particular historical configuration associated with the network entities, one or more recommended configurations for the one or more network entities based on the set of parameters by identifying a plurality of historical configurations previously generated by a plurality of client devices and determining that the particular historical configuration of the plurality of historical configurations was previously generated by the client device;

validate, by the processing device, each of the one or more recommended configurations using the configuration model of the computing network to determine whether application of the recommended configuration resolves the misconfiguration without introducing an additional policy violation;

select, as the one or more recommended configurations to be provided, only those recommended configurations that satisfy the validation; and

provide the one or more recommended configurations to the client device to be used by the client device to replace the misconfiguration of the network entities with the one or more recommended configurations.

Assignments (1)

Continuity (2)

References Cited (17)