US 12,438,880 B2
Cloud security group rule management via log processing
Dwaraka Venkataramana, Chantilly, VA (US); Amy Miao, Arlington, VA (US); Alex Schwartzberg, Manalapan, NJ (US); Anteneh Shiferaw, South Riding, VA (US); Naziul Talukder, Rosedale, NY (US); Jason Redisch, Fairfax, VA (US); and James George, III, Washington, DC (US)
Assigned to Capital One Services, LLC, McLean, VA (US)
Filed by Capital One Services, LLC, McLean, VA (US)
Filed on Jan. 2, 2024, as Appl. No. 18/402,446.
Prior Publication US 2025/0220022 A1, Jul. 3, 2025
Int. Cl. H04L 9/40 (2022.01); H04L 29/06 (2006.01)
CPC H04L 63/104 (2013.01) [H04L 63/205 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computing device configured to automatically manage security group rules in a cloud environment by analyzing utilization of each of the security group rules based on packet logs so as to reduce attack vector possibilities, the computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the computing device to:
receive, from a log database, a first log comprising a plurality of log entries that each indicate one or more packet flows associated with a security group in the cloud environment;
determine a plurality of security group rules for the security group of the cloud environment, wherein the plurality of security group rules limit one or both of:
inbound network traffic for the security group, or
outbound traffic for the security group;
sort the plurality of security group rules into an order based on a permissiveness of the plurality of security group rules;
identify, for each log entry of the plurality of log entries, a corresponding security group rule of the plurality of security group rules by iteratively processing, based on the order, the sorted plurality of security group rules to identify a least permissive security group rule that permitted a packet flow corresponding to the log entry;
modify each of the plurality of security group rules to add, for each security group rule of the plurality of security group rules, an identification of a corresponding log entry;
determine, based on the modified plurality of security group rules, a first security group rule of the plurality of security group rules that is not associated with any log entry of the plurality of log entries; and
delete the first security group rule.