Granted Patent B2

US 12,443,397 · App. 19/169,671 · Granted Oct 14, 2025

Inventors: Eshel Yaron (Amsterdam, NL); Barak Bercovitz (Even-Yehuda, IL); Tomer Schwartz (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F8/36G06F8/35

Abstract

Claims (48)

1. A method for anomaly remediation, comprising:

scanning a code repository including a plurality of software components by executing fingerprinting code on the code repository in order to generate a plurality of statistics vectors for the plurality of software components, wherein each statistics vector includes a plurality of values representing statistics for respective aspects of a corresponding software component of the plurality of software components, wherein the fingerprinting code includes instructions that configure a processing circuitry to perform a text search in order to identify instances of patterns in the code repository and to generate the plurality of statistics vectors based on the identified instances of patterns when the fingerprinting code is executed;

clustering the plurality of statistics vectors into a plurality of clusters defined with respect to a plurality of software component groupings, wherein each cluster of the plurality of clusters includes a subset of the plurality of statistics vectors of corresponding to a subset of the plurality of software components which belongs to one of the plurality of software component groupings;

aggregating the plurality of statistics vectors into a plurality of aggregated statistics vectors by combining values of respective statistics in statistics vectors among the plurality of statistics vectors belonging to a same cluster of the plurality of clusters;

detecting at least one anomaly based on the plurality of aggregated statistics vectors; and

performing at least one remedial action with respect to the plurality of software components based on the detected at least one anomaly.

2. The method of claim 1 , wherein the fingerprinting code is generated based on a knowledge base including a plurality of nodes representing respective software components of the plurality of software components, wherein the patterns are defined with respect to the knowledge base.

3. The method of claim 2 , further comprising:

querying the knowledge base in order to obtain query results; and

generating the fingerprinting code is based on the query results.

4. The method of claim 2 , wherein the knowledge base is queried for at least one string of text of the plurality of nodes of the plurality of software components represented in the knowledge base, wherein the patterns are defined with respect to the at least one string of text.

5. The method of claim 2 , wherein the knowledge base is queried in a first query, wherein the query results are a first set of query results, wherein the plurality of statistics vectors is a first plurality of statistics vectors, wherein the at least one anomaly is at least one first anomaly, further comprising:

updating the fingerprinting code by querying the knowledge base in a second query in order to obtain a second set of query results and regenerating the fingerprinting code based on the second set of query results;

scanning the code repository using the updated fingerprinting code in order to generate a second plurality of statistics vectors; and

detecting at least one second anomaly based on the second plurality of statistics vectors.

6. The method of claim 2 , wherein the knowledge base includes data of code of the plurality of software components, wherein the patterns are defined further with respect to the data of the code of the plurality of software components.

7. The method of claim 1 , wherein the patterns are patterns in text, wherein the fingerprinting code includes instructions that, when executed by a processing circuitry, configure the processing circuitry to perform at least one text search.

8. The method of claim 1 , wherein the plurality of statistics vectors include a plurality of counts vectors, wherein each of the plurality of values of each counts vector is a count of instances for a respective aspect of the plurality of software components represented in a knowledge base.

9. The method of claim 1 , further comprising:

applying a machine learning model to the plurality of aggregated statistics vectors in order to obtain a set of machine learning model outputs, wherein the machine learning model is trained using training statistical data for a knowledge base including a plurality of nodes representing respective software components of the plurality of software components, wherein the machine learning model is trained to output anomalies when applied to the plurality of aggregated statistics vectors, wherein the at least one anomaly is detected based on the set of machine learning model outputs.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

scanning a code repository including a plurality of software components by executing fingerprinting code on the code repository in order to generate a plurality of statistics vectors for the plurality of software components, wherein each statistics vector includes a plurality of values representing statistics for respective aspects of a corresponding software component of the plurality of software components, wherein the fingerprinting code includes instructions that configure a processing circuitry to perform a text search in order to identify instances of patterns in the code repository and to generate the plurality of statistics vectors based on the identified instances of patterns when the fingerprinting code is executed;

clustering the plurality of statistics vectors into a plurality of clusters defined with respect to a plurality of software component groupings, wherein each cluster of the plurality of clusters includes a subset of the plurality of statistics vectors of corresponding to a subset of the plurality of software components which belongs to one of the plurality of software component groupings;

aggregating the plurality of statistics vectors into a plurality of aggregated statistics vectors by combining values of respective statistics in statistics vectors among the plurality of statistics vectors belonging to a same cluster of the plurality of clusters;

detecting at least one anomaly based on the plurality of aggregated statistics vectors; and

performing at least one remedial action with respect to the plurality of software components based on the detected at least one anomaly.

11. A system for anomaly remediation, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

scanning a code repository including a plurality of software components by executing fingerprinting code on the code repository in order to generate a plurality of statistics vectors for the plurality of software components, wherein each statistics vector includes a plurality of values representing statistics for respective aspects of a corresponding software component of the plurality of software components, wherein the fingerprinting code includes instructions that configure a processing circuitry to perform a text search in order to identify instances of patterns in the code repository and to generate the plurality of statistics vectors based on the identified instances of patterns when the fingerprinting code is executed;

clustering the plurality of statistics vectors into a plurality of clusters defined with respect to a plurality of software component groupings, wherein each cluster of the plurality of clusters includes a subset of the plurality of statistics vectors of corresponding to a subset of the plurality of software components which belongs to one of the plurality of software component groupings;

aggregate the plurality of statistics vectors into a plurality of aggregated statistics vectors by combining values of respective statistics in statistics vectors among the plurality of statistics vectors belonging to a same cluster of the plurality of clusters;

detect at least one anomaly based on the plurality of aggregated statistics vectors; and

perform at least one remedial action with respect to the plurality of software components based on the detected at least one anomaly.

12. The system of claim 11 , wherein the fingerprinting code is generated based on a knowledge base including a plurality of nodes representing respective software components of the plurality of software components, wherein the patterns are defined with respect to the knowledge base.

13. The system of claim 12 , wherein the system is further configured to:

query the knowledge base in order to obtain query results; and

generate the fingerprinting code is based on the query results.

14. The system of claim 12 , wherein the knowledge base is queried for at least one string of text of the plurality of nodes of the plurality of software components represented in the knowledge base, wherein the patterns are defined with respect to the at least one string of text.

15. The system of claim 12 , wherein the knowledge base is queried in a first query, wherein the query results are a first set of query results, wherein the plurality of statistics vectors is a first plurality of statistics vectors, wherein the at least one anomaly is at least one first anomaly, wherein the system is further configured to:

update the fingerprinting code by querying the knowledge base in a second query in order to obtain a second set of query results and regenerating the fingerprinting code based on the second set of query results;

scan the code repository using the updated fingerprinting code in order to generate a second plurality of statistics vectors; and

detect at least one second anomaly based on the second plurality of statistics vectors.

16. The system of claim 12 , wherein the knowledge base includes data of code of the plurality of software components, wherein the patterns are defined further with respect to the data of the code of the plurality of software components.

17. The system of claim 11 , wherein the patterns are patterns in text, wherein the fingerprinting code includes instructions that, when executed by a processing circuitry, configure the processing circuitry to perform at least one text search.

18. The system of claim 11 , wherein the plurality of statistics vectors include a plurality of counts vectors, wherein each of the plurality of values of each counts vector is a count of instances for a respective aspect of the plurality of software components represented in a knowledge base.

19. The system of claim 11 , wherein the system is further configured to:

apply a machine learning model to the plurality of aggregated statistics vectors in order to obtain a set of machine learning model outputs, wherein the machine learning model is trained using training statistical data for a knowledge base including a plurality of nodes representing respective software components of the plurality of software components, wherein the machine learning model is trained to output anomalies when applied to the plurality of aggregated statistics vectors, wherein the at least one anomaly is detected based on the set of machine learning model outputs.

Continuity (2)

References Cited (64)