Patent Application
20230281539
Aspects are generally related to determining an amount of drift between the pre-deployment design intentions for technological architecture and the post-deployment functioning thereof.
As technology infrastructures become more distributed, a challenge facing organizations is understanding what technology systems have been deployed and the purpose of those systems. As systems are implemented and deployed, a high degree of focus is placed on testing the components deployed for functional and, in most cases, non-functional requirements. Over time, however, the difference between system design and system operation can widen and create operational risk, also known as architecture drift—the difference between design intent and operational functioning of a system. Calculating architecture drift is an important function of architecture governance because it helps organizations determine where risk exists within an enterprise technology infrastructure.
In some aspects, the techniques described herein relate to a method of determining an amount of architecture drift, including: determining a logical architecture node, wherein the logical architecture node is in operation on a technology infrastructure of an evaluating organization; including, as a representation of the logical architecture node, an architecture graph node in a knowledge graph; determining a functional attribute of the logical architecture node; including in the knowledge graph, as a representation of the functional attribute of the logical architecture node, a functional attribute graph node, wherein the functional attribute graph node is an identified type and has a first value; determining an intended attribute of the logical architecture node; including in the knowledge graph, as a representation of the intended attribute of the logical architecture node, an intended attribute graph node, wherein the intended attribute graph node is the identified type and has a second value; and determining the amount of architecture drift based on the first value and the second value.
In some aspects, the techniques described herein relate to a method, wherein the identified type includes a risk weight as a property of the identified type.
In some aspects, the techniques described herein relate to a method, wherein determining the amount of architecture drift is further based on the risk weight.
In some aspects, the techniques described herein relate to a method, wherein the risk weight is dynamically assigned based on a number of other functional attribute graph nodes included in the knowledge graph.
In some aspects, the techniques described herein relate to a method, wherein the risk weight is dynamically assigned based further on a type of each of the number of other functional attribute graph nodes included in the knowledge graph.
In some aspects, the techniques described herein relate to a method, wherein the logical architecture node is determined based on node identifying operations.
In some aspects, the techniques described herein relate to a method, wherein the node identifying operations include examining packets from packet captures performed on the technology infrastructure of the evaluating organization.
In some aspects, the techniques described herein relate to a method, wherein the intended attribute graph node is determined based on attribute identifying operations.
In some aspects, the techniques described herein relate to a method, wherein the attribute identifying operations include examining a standard architecture design document.
In some aspects, the techniques described herein relate to a method, wherein the standard architecture design document is formatted as a natural language document.
In some aspects, the techniques described herein relate to a system for determining an amount of architecture drift including at least one server including a processor and a memory, wherein the at least one server is configured for operative communication on a technology infrastructure of an evaluating organization, and wherein instructions stored on the memory instruct the processor to: determine a logical architecture node, wherein the logical architecture node is in operation on the technology infrastructure of the evaluating organization; include, as a representation of the logical architecture node, an architecture graph node in a knowledge graph; determine a functional attribute of the logical architecture node; include in the knowledge graph, as a representation of the functional attribute of the logical architecture node, a functional attribute graph node, wherein the functional attribute graph node is an identified type and has a first value; determine an intended attribute of the logical architecture node; include in the knowledge graph, as a representation of the intended attribute of the logical architecture node, an intended attribute graph node, wherein the intended attribute graph node is the identified type and has a second value; and determine the amount of architecture drift based on the first value and the second value.
In some aspects, the techniques described herein relate to a system, wherein the identified type includes a risk weight as a property of the identified type.
In some aspects, the techniques described herein relate to a system, wherein determining the amount of architecture drift is further based on the risk weight.
In some aspects, the techniques described herein relate to a system, wherein the risk weight is dynamically assigned based on a number of other functional attribute graph nodes included in the knowledge graph.
In some aspects, the techniques described herein relate to a system, wherein the risk weight is dynamically assigned based further on a type of each of the number of other functional attribute graph nodes included in the knowledge graph.
In some aspects, the techniques described herein relate to a system, wherein the logical architecture node is determined based on node identifying operations.
In some aspects, the techniques described herein relate to a system, wherein the node identifying operations include examining packets from packet captures performed on the technology infrastructure of the evaluating organization.
In some aspects, the techniques described herein relate to a system, wherein the intended attribute graph node is determined based on attribute identifying operations.
In some aspects, the techniques described herein relate to a system, wherein the attribute identifying operations include examining a standard architecture design document.
In some aspects, the techniques described herein relate to a non-transitory computer readable storage medium, including instructions stored thereon for determining architecture drift, which when read and executed by one or more computers cause the one or more computers to perform steps including: determining a logical architecture node, wherein the logical architecture node is in operation on a technology infrastructure of an evaluating organization; including, as a representation of the logical architecture node, an architecture graph node in a knowledge graph; determining a functional attribute of the logical architecture node; including in the knowledge graph, as a representation of the functional attribute of the logical architecture node, a functional attribute graph node, wherein the functional attribute graph node is an identified type and has a first value; determining an intended attribute of the logical architecture node; including in the knowledge graph, as a representation of the intended attribute of the logical architecture node, an intended attribute graph node, wherein the intended attribute graph node is the identified type and has a second value; and determining the amount of architecture drift based on the first value and the second value.
Aspects are generally related to determining an amount of drift between the pre-deployment design intentions for technological architecture and the post-deployment functioning thereof.
Technology architecture drift, such as software architecture drift, involves determining an amount of difference, or a delta, between two states of a technological system. The first state can be called the intended state. The intended state represents a technological system functioning entirely as it was designed to function. The second state can be called the functional state. The functional state represents the technological system as it actually functions, e.g., in an operational or production environment.
Any technological system may be evaluated for architecture drift. That is, any software program, module, package, etc., may be evaluated for architecture drift. Moreover, firmware, embedded code, etc., may be evaluated for architecture drift. In some cases (particularly when evaluating/determining the functional state of a technological system), an evaluation will take place in conjunction with any hardware that the software is designed to, or actually does, execute on, drive, monitor, enhance, etc. As used herein, an “evaluated architecture” refers to a technological system including any necessary software and hardware of the system that is evaluated for architecture drift.
Once identified, an intended state and a functional state of an evaluated architecture can be structured in a format that allows for determination of a delta between the two states. In accordance with aspects, a knowledge graph can be used to determine the delta between the intended state and the functional state. A knowledge graph is an abstraction that organizes real-world knowledge and data. A knowledge graph can integrate determined information from many different data sources and can be used to visualize and explain the determined information, particularly with respect to other information in the knowledge graph.
A knowledge graph can show and explain relationships between entities. The entities are represented in the knowledge graph as nodes and the relationship between the entities are shown as edges (visualized as connections between the nodes). Labels are used to label the edges and explain the relationship between the nodes. Additionally, knowledge graphs can be used in conjunction with machine learning (ML) in order to infer, or “predict,” previously unknown or undetermined relationships between, and attributes of, the various nodes in the knowledge graph. For instance, given a knowledge graph including an evaluated architecture, the evaluated architecture's intended state as a dimension of the graph, and the evaluated architecture's functional state as another dimension of the graph, a ML algorithm may be able to identify gaps, or deltas, between the evaluated architecture's intended state and its functional state, thereby providing a quantifiable “drift” from the intended state of the evaluated architecture.
A knowledge graph generated from a determined intended state and a determined functional state of an evaluated architecture can include two dimensions: an intended state dimension that represents the determined intended state of an evaluated architecture, and a functional state dimension that represents the determined functional state of the evaluated architecture. Moreover, a knowledge graph may be generated that represents the intended state dimensions and the functional state dimensions of multiple evaluated architectures. For instance, a knowledge graph can be generated that represents the intended state dimensions and the functional state dimensions of each operational software/hardware solution in an evaluating organization's technology infrastructure. In such an example, each operational software/hardware solution would constitute an evaluated architecture, as further defined herein.
In accordance with aspects, a knowledge graph as described herein can take the form of a directed acyclic graph.
The functional state of an evaluated architecture can be determined from the evaluated architecture's observed configuration and functionality. For instance, a functional state of an observed architecture can be based on the evaluated architecture's interactions within its environment (e.g., a production network environment). An exemplary process (i.e., an exemplary node identifying operation) for observing environmental interactions of an evaluated architecture includes using packet capture tools (PCAPS) to understand network flows on a production network of an evaluating organization. The packet captures can be used to determine a functional state of an evaluated architecture based on the contents of the packets and their destination and origin.
Using packet captures, a network topology can be determined based on network traffic. A determined network topology based on data packets transmitted over a network infrastructure can define network nodes based on the packets transmitted between the nodes. The identified network nodes can represent logical nodes. For instance, hardware may be shared between several evaluated architectures. Each evaluated architecture may execute on a virtual operating system (OS). While the virtual operating systems may share allocated hardware, the virtualized OS may be identified as an independent (logical) network node for evaluation purposes.
Network nodes identified through packet captures (or through other node identifying operations/techniques, described in more detail, below) can be cast as architecture graph nodes on a knowledge graph, and each graph node can represent an evaluated architecture. That is, identified network nodes, architecture graph nodes and evaluated architectures can represent a 1-1-1 ratio with each other, where each identified network node represents an architecture node on the knowledge graph, which, in turn, represents an evaluated architecture. An architecture graph node, as used herein, represents a system, program or other logical node (i.e., an architecture) of an evaluating organization on a knowledge graph.
Network/system nodes may also be determined through various other node identifying operations/techniques. For example, internet protocol (IP) addresses and IP address maps and recorded routes may be used to identify network nodes. Other exemplary aspects include examining deployment mechanisms, records, logs, etc., in order to determine network nodes. For instance, deployment pipelines can be examined to determine what architectures have been deployed onto an evaluating organization's technology infrastructure.
Deployment mechanisms may contain data that verifies other sources of network nodes. For instance, a deployment mechanism may specify an IP address that an architecture was deployed to. The IP address, as determined via the pipeline deployment mechanism may verify a network node discovered via a packet capture operation, or vice versa. Once determined and/or verified through any suitable operation, the identified and/or verified network nodes can be cast onto the knowledge graph as corresponding architecture graph nodes.
In accordance with additional aspects, and as noted above, any suitable operation or process for identifying network nodes for inclusion as corresponding architecture graph nodes in a knowledge graph can be employed. Other exemplary node identifying operations for identifying network nodes include inspecting log files from network operating systems; inspecting/analyzing virtual machine (VM) configuration files; capturing and inspecting/analyzing log files from network routers and switches; examining architecture-as-code (AaC) documentation and/or scripts (described in more detail, below), etc.
Evaluated architectures 120, 122, and 124 are software components executing on the hardware that has been (either physically or virtually) allocated to nodes 110, 112, and 114, respectively. Evaluated architectures 120, 122, and 124 each may be any software system that an evaluating organization wishes to evaluate for architecture drift—e.g., an accounting software system, a funds settlement software system, an asset trading software system, an MRP/ERP software system, a CRM software system, a bank ledger software system, etc., etc.
Knowledge graph 150 is generated using data collected through node identifying operations performed on network infrastructure 105. Knowledge graph 150 is depicted as a directed acyclic graph in the figures and in accordance with aspects.
Node identifying operations include any suitable technique for identifying logical network nodes on network infrastructure 105 (as further described herein). Once a node is identified through suitable node identifying operations, the node is included in knowledge graph 150 as an architecture node.
With continued reference to
A knowledge graph generated from network nodes can also include attributes about the network nodes as additional nodes in the graph. Further, edges (i.e., connections representing relationships) can be identified between the architecture nodes and the attribute nodes. Each edge connecting an attribute node to an architecture node can have a label that explains the relationship represented by the edge. In this way, a robust graphical representation of a functional state of an evaluated architecture can be represented by a knowledge graph.
Node identifying operations can also be used as attribute identifying operations, in accordance with aspects. That is, results of the techniques discussed herein for identifying network nodes and evaluated architectures can be further examined to identify functional attributes of the identified nodes. For instance, while a packet captured in a packet capture operation may be examined for an origin address and a destination address in order to identify nodes at the origin and the destination, further examination may be carried out to inspect the type of data the packet carries. Based on the origin and destination of the packet, and the type of data therein, attributes about the sending and receiving nodes can be determined.
Attributes determined based on packet inspection can include dependencies. For example, if a receiving node/evaluated architecture consistently receives a certain type of data from a source node/evaluated architecture, it can be inferred that a dependency exists on the source node/evaluated architecture. Packet capture/inspection may also reveal a particular type of data that can imply a certain data classification. These examples with respect to packet capture/inspection are not meant to be limiting, and other attributes may be determinable through the use of packet capture/inspection used as an attribute identifying operation.
Likewise, many other attribute identifying operations may be employed to determine attributes and corresponding attribute nodes for inclusion in the knowledge graph. As discussed above with respect to node identification, deployment mechanisms (e.g., deployment pipelines) can provide many attributes of corresponding nodes and evaluated architectures. For instance, a deployment mechanism may indicate what operating system and/or platform a particular evaluated architecture was deployed on. Deployment mechanisms may also provide a version number of the evaluated architecture; an internal (i.e., internal to the evaluating organization) identification number of the evaluated architecture; a hosting platform of the evaluated architecture (i.e., a data center location, number, etc.); and the like.
An inspection of repositories and source code therein may also provide many attributes of an evaluated architecture. Some attributes that may be determined through repositories and source code include the coding language that an evaluated architecture was written in; dependencies of the evaluated architecture; whether the evaluated architecture is inward facing, outward facing, or both; etc., etc.
In accordance with aspects, some node and attribute identifying operations may rely on documents that include natural language. Natural language documents can be processed with natural language processing (NLP) engines/algorithms in order to determine both architecture nodes and attribute nodes. Examples of documents/artifacts that can be processed with NLP algorithms include configuration files, property files, project object model (POM) files, VM configuration files, etc.
POM files are XML files that contain information about a project and configuration details used by software project management tools (e.g., Maven™) to build a software project. Some exemplary attributes that are recorded in POM files include source code location, build information, required software dependencies, dependency scope, packaging information, etc.
Natural language-formatted documents can offer a reliable source for node/attribute identification, because they are often organized to include a defined set of information. Further, they are often stored in known locations, and therefore can be easily accessed for processing by NLP engines/algorithms. NLP is discussed in further detail, below, with respect to determining an intended state dimension of a knowledge graph. It is contemplated, however, that NLP and the particular NLP techniques discussed herein are equally applicable to generating both a functional state dimension and an intended state dimension of a knowledge graph.
Identified attributes of architecture nodes can be added to the knowledge graph and edges can be drawn between the architecture node and its corresponding attributes. Labels can be added to the edges to define the relationship between the architecture node and the attribute node. Label values can be derived from a corresponding determined attribute. For instance, if an attribute of an evaluated architecture is “data classification,” the relationship may be a “has” relationship, and the value of the attribute may be “highly confidential.” In this example, then, the knowledge graph would represent that the evaluated architecture node has a data classification attribute, and the value of that attribute is “highly confidential”. With regards to a natural language, the relationship label can be representative of the verb, or predicate, of a sentence.
While some of the figures herein depict graph edges with labels that include an object, it is contemplated that, form a natural, and English, language perspective, objects represent attributes. For instance, in the exemplary relationship depicted in
As depicted in
In accordance with aspects, an intended state of an evaluated architecture can be a theoretical state in that it may be determined based on the architectural design of the evaluated technological system. For example, an intended state may be determined based on architectural diagrams, flow charts, sequence diagrams, stated/anticipated inputs, stated/anticipated outcomes and outputs (which may be based on the anticipated inputs), stated design intentions and goals, etc. That is, the intended state can be determined by evaluating architecture design documents, documentation, and/or artifacts that may have been generated prior to development and/or provisioning of a given evaluated architecture.
Other examples of information that may be determined from such documentation include related pseudo code, anticipated dependencies, anticipated coding languages and platforms, anticipated hardware environments, known application programming interfaces (APIs) that the evaluated architecture will interact with, other known systems that the evaluated architecture will interact with, etc. This information, and other information discovered in architecture design documents can be used to determine an intended state of an evaluated architecture.
Any architectural and/or design documentation or artifacts created and/or maintained by an evaluating organization may be evaluated to determine the intended state of an evaluated architecture. Any design documentation and artifacts used by an evaluating organization to determine an intended state of an evaluated architecture is collectively referred to herein as “architecture design documentation,” or “architecture design documents.”
In some aspects, an evaluating organization may collect and organize a repository of architecture design documentation in order to facilitate ease of access to the design intentions included therein. An architecture design documentation repository may include several different types of architecture design documentation.
In some aspects, an evaluating organization may define a standard architecture design document format, which may be included in a architecture design documentation repository. A standard architecture design document format may be defined to include components of, and/or information from, many different types of architecture design documentation. That is, a standard architecture design document format may include standardized data fields or entries that describe design aspects and intentions of an evaluated architecture. The standardized data fields/entries may be included in the standard architecture design document due to their importance or relevance in understanding the intended state of an evaluated architecture.
Exemplary data/information that may be collected in a standard architecture design document includes any information that may be found in any architecture design documentation. That is, a standard architecture design document may include anticipated data inputs, outputs, and other dependencies, a specified coding language, applied design patterns, a required technology platform, required hardware, memory requirements, processing requirements, anticipated network bandwidth, and so on.
A standard architecture design document may include other information such as an identifier that identifies the project/architecture; an information classification that classifies the type of information produced and or stored; indications of whether the architecture is anticipated to be internal or external facing (or both); a repository location for the code and other components of the architecture; and other organization-specific information.
A standard design document may include details about the data that the architecture is anticipated to process, such as an anticipated data classification (e.g., non-confidential, confidential, or highly confidential), an anticipated data risk profile (e.g., low, medium, high), and/or anticipated restrictions on hosting platforms or locations.
In accordance with aspects, a standard architecture design document may be formatted as a natural-language document. A standard architecture design document formatted as a natural-language document may take advantage of natural language processing algorithms in order to determine the contents therein, and in order to employ various machine learning algorithms on the included contents in order to infer relationships and similarities between evaluated systems described in various standard architecture design documentation.
A standard architecture design document may also take the form of an architecture-as-code (AaC) declaration. The AaC concept includes capturing an intended architectural state of a software system (e.g., an evaluated architecture) in a standardized format. The format may be a natural language format, and the entries can be optimized for processing by an NLP, in accordance with aspects.
An exemplary standard architecture design document format can have entries that define attributes of a system, and the relationship between the defined attributes and the subject system. Exemplary entries can be in sentence form, and may include a subject, a predicate (or verb) and an object. Exemplary entries in a standard architecture design document may include:
The exemplary standard architecture design document entries, above, can be readily processed by an NLP engine that has been trained on the natural language format (referred to herein as “behavior driven architecture language”) of the entries, in accordance with aspects. Behavior driven architecture language includes assertions or intents about an architecture's design written in a natural language (e.g., written in English). A training file may be provided to an NLP algorithm that associates predicates/verbs/verb phrases within the file's entries as relationships. Objects within the entries can be associated with attributes and attribute definitions. The subject system (e.g., System ABC in the example) can be associated with an evaluated architecture.
An NLP engine that has been trained on the behavior driven architecture language can then process standard architecture design documents to determine the intended state of the subject architecture based on the attributes and relationships declared therein. The NLP engine may then output the determined attributes and relationships in a predetermined and machine-readable file format. Exemplary file formats may include JSON, XML, CSV, etc.
In accordance with aspects, a knowledge graph can be generated based on a machine-readable file format. A machine-readable file format can include tags or indicators that organize the output of an NLP engine to maintain the subject-verb-object structure (which corresponds to the nodes and relationships of a directed cyclic knowledge graph). For instance, if an NLP engine produces a JSON formatted file for an evaluated architecture (e.g., System ABC), including any determined attributes, values and relationships, the JSON file can act as a JSON-formatted representation of a knowledge graph (or at least part of a knowledge graph that may include data from many similar JSON files). The contents of the JSON file can be readily formatted, and displayed as, a knowledge graph of the determined intended state of a subject system as declared in a corresponding standard architecture design document. The normalized format of design assertions extracted from architecture design documents and formatted in a machine-readable file format that is represented in a knowledge graph is referred to as behavior graph language.
In the same manner, architectures, attributes, attribute values, and relationship signifiers determined through attribute identifying operations and node identifying operations can be normalized and formatted in a machine-readable file format (i.e., can be formatted in behavior graph language). Subsequently, a functional state dimension of a knowledge graph can be generated from the machine-readable files.
In other aspects, standard architecture design documents may take any suitable or desirable format. Non-ML algorithmic approaches (for example, file “scraping”) may be used to extract data from structured architecture design documents where NLP is not applicable, or in addition to NLP processing. In accordance with aspects, data scraped from architecture design documents may be later processed by an NLP algorithm or other ML algorithm. In accordance with aspects, standard architecture design documents may also take the form of design data collected in a normalized relational database, or an OLAP database, including reports therefrom.
In accordance with aspects, architecture design documentation may be processed as described herein, and an intended state dimension of a knowledge graph may be generated based on the data and information obtained from the processed architecture design documentation. Architecture nodes may be discovered through the processing of the architecture design documentation, and these nodes may be added to a knowledge graph, or a verification process may be undertook to verify that the discovered architecture nodes have already been added to an existing knowledge graph. Thereafter, intended attributes of an evaluated architecture that have been determined through the processing of architecture design documentation can be added to the knowledge graph. Edges connecting the determined intended attributes to their corresponding architecture nodes can also be added to the knowledge graph, and corresponding labels may, in turn, be added to the edges.
Intent processing engine 412 is configured to access architecture documentation repository 410 and process the architecture design documents therein. Intent processing engine 412 may include NLP engine 414, which, in turn, may include NLP processing algorithms. Intent processing engine 412 may further include other ML algorithms, or non-ML processing algorithms configured to process the architecture design documents, as described in further detail herein.
With continued reference to
The intended state dimension that has been included in knowledge graph 150 is shown in broken lines, to help distinguish it from the functional state dimension (that is shown in solid lines) and from the architecture node (shown in solid lines, and shaded). Accordingly, as shown in knowledge graph 150 as depicted in
In
Because of space constraints of
In accordance with aspects, an amount of architecture drift of an evaluated architecture can be observed using a knowledge graph that includes both a functional state dimension and an intended state dimension of the evaluated architecture. A drift value between an intended state and a functional (operational) state of a system can be based on several criteria. For instance, drift can be measured using risk profiles and technical debt profiles. An overall architecture drift value can be an aggregate or weighted average of assessed criteria.
A risk profile can be calculated by assigning risk weights to attributes of evaluated architectures. Attributes that introduce significant risk to evaluating organizations can be given more weight than attributes that introduce relatively small amounts of risk. Risk weights can be driven by regulatory obligations, contractual obligations, etc. Examples of attributes that might receive relatively more weight could be “data classification,” “risk rating,” “PII” (Personally Identifiable Information), etc. Attributes that may receive lower risk ratings might include “internal ID,” “code language,” “version,” etc.
The examples that receive weightier risk values can be linked to data and privacy regulations and other obligations of evaluating organizations, while the attributes receiving relatively less weighty values are generally chosen by the evaluating organization for functional purposes, arbitrarily assigned, etc.
Context may also be considered when determining/calculating an amount of architecture drift. For example, control mechanism attributes may be weighted, or dynamically weighted based on the observed context of the evaluated system. An exemplary control mechanism attribute is an attribute that indicates an encryption level for data. Such an attribute may be weighted more heavily if the evaluated architecture incudes a “deployed to” attribute with a value of “public cloud,” than if the “deployed to” attribute has a value of “private cloud,” since encryption level may be more important for data stored on a public cloud.
Another factor that may drive up the weight of an attribute in a dynamic-weighting scenario is the absence of a functional state attribute where the intended state indicates the presence of such attribute. For instance, an intended state dimension may indicate a dependency on another system and the attribution of the dependency is that a certain level of encryption is used. The observed functional state may be that there is no attribution on that dependency. Accordingly, in such a scenario, observed lack of an encryption attribute, particularly given other observed attributes (e.g., a data classification attribute with a value of “highly confidential”), could indicate significant risk, and therefore drift, for the evaluating organization.
A measure of technical debt may also be used to determine an overall amount of drift. Technical debt refers to non-adherence of best practices in design and development of systems (e.g., evaluated architectures). This can be observed in a knowledge graph as the difference in the shape of an intended state dimension as compared to the shape of its corresponding functional state dimension, particularly regarding graph properties that can be identified as representing design and development best practices. That is, as an intended state dimension of a knowledge graph takes shape, the shape is a result of nodes, relationships and properties of the declared intended state. Some of these nodes, relationships and properties will be based on design and development best practices. A corresponding functional state dimension of the evaluated architecture, in order to indicate a low amount of technical debt, should have a similar shape, with regard to attributes defined as describing design and development best practices.
With continued reference to
Knowledge graph 150 of
Drift value scores can be calculated based on static or dynamic attribute weighting, and/or an observation of deviation in the shape of an intended state dimension when compared to a corresponding functional state dimension, as discussed above. It is to be understood that the overall shape of knowledge graph 150 and the shapes of the dimensions depicted therein are exemplary, and not meant to be limited. It is contemplated that knowledge graphs generated using the techniques described herein will have varying shapes, and will indicate varying amounts of drift based on the evaluated systems, the defined attributes the weighting of the attributes, etc.
With continued reference to
In accordance with aspects, the difference between the value of the intended attribute graph node and the value of the functional attribute graph node can represent architecture drift. That is, the difference in the values can indicate that the evaluated architecture was designed to process/store only confidential data, but in practice is processing/storing highly confidential data. At step 714, an amount of architecture drift can be determined based on the difference in the node values. Techniques for determining the amount of architecture drift are discussed in more detail, above.
The various processing steps and/or data flows depicted in the figures and described in greater detail herein may be accomplished using some or all of the system components also described herein. In some implementations, the described logical steps may be performed in different sequences and various steps may be omitted. Additional steps may be performed along with some or all of the steps shown in the depicted logical flow diagrams. Some steps may be performed simultaneously. Accordingly, the logical flows illustrated in the figures and described in greater detail herein are meant be exemplary and, as such, should not be viewed as limiting. These logical flows may be implemented in the form of executable instructions stored on a machine-readable storage medium and/or in the form of electronic circuitry.
Hereinafter, general aspects of implementation of the systems and methods of the invention will be described.
The system of the invention or portions of the system of the invention may be in the form of a “processing machine,” such as a general-purpose computer, for example. As used herein, the term “processing machine” is to be understood to include at least one processor that uses at least one memory. The at least one memory stores a set of instructions. The instructions may be either permanently or temporarily stored in the memory or memories of the processing machine. The processor executes the instructions that are stored in the memory or memories in order to process data. The set of instructions may include various instructions that perform a particular task or tasks, such as those tasks described above. Such a set of instructions for performing a particular task may be characterized as a program, software program, or simply software.
In one embodiment, the processing machine may be a specialized processor.
As noted above, the processing machine executes the instructions that are stored in the memory or memories to process data. This processing of data may be in response to commands by a user or users of the processing machine, in response to previous processing, in response to a request by another processing machine and/or any other input, for example.
As noted above, the processing machine used to implement the invention may be a general-purpose computer. However, the processing machine described above may also utilize any of a wide variety of other technologies including a special purpose computer, a computer system including, for example, a microcomputer, mini-computer or mainframe, a programmed microprocessor, a micro-controller, a peripheral integrated circuit element, a CSIC (Customer Specific Integrated Circuit) or ASIC (Application Specific Integrated Circuit) or other integrated circuit, a logic circuit, a digital signal processor, a programmable logic device such as a FPGA, PLD, PLA or PAL, or any other device or arrangement of devices that is capable of implementing the steps of the processes of the invention.
The processing machine used to implement the invention may utilize a suitable operating system. Thus, embodiments of the invention may include a processing machine running the iOS operating system, the OS X operating system, the Android operating system, the Microsoft Windows™ operating systems, the Unix operating system, the Linux operating system, the Xenix operating system, the IBM AIX™ operating system, the Hewlett-Packard UX™ operating system, the Novell Netware™ operating system, the Sun Microsystems Solaris™ operating system, the OS/2™ operating system, the BeOS™ operating system, the Macintosh operating system, the Apache operating system, an OpenStep™ operating system or another operating system or platform.
It is appreciated that in order to practice the method of the invention as described above, it is not necessary that the processors and/or the memories of the processing machine be physically located in the same geographical place. That is, each of the processors and the memories used by the processing machine may be located in geographically distinct locations and connected so as to communicate in any suitable manner. Additionally, it is appreciated that each of the processor and/or the memory may be composed of different physical pieces of equipment. Accordingly, it is not necessary that the processor be one single piece of equipment in one location and that the memory be another single piece of equipment in another location. That is, it is contemplated that the processor may be two pieces of equipment in two different physical locations. The two distinct pieces of equipment may be connected in any suitable manner. Additionally, the memory may include two or more portions of memory in two or more physical locations.
To explain further, processing, as described above, is performed by various components and various memories. However, it is appreciated that the processing performed by two distinct components as described above may, in accordance with a further embodiment of the invention, be performed by a single component. Further, the processing performed by one distinct component as described above may be performed by two distinct components. In a similar manner, the memory storage performed by two distinct memory portions as described above may, in accordance with a further embodiment of the invention, be performed by a single memory portion. Further, the memory storage performed by one distinct memory portion as described above may be performed by two memory portions.
Further, various technologies may be used to provide communication between the various processors and/or memories, as well as to allow the processors and/or the memories of the invention to communicate with any other entity; i.e., so as to obtain further instructions or to access and use remote memory stores, for example. Such technologies used to provide such communication might include a network, the Internet, Intranet, Extranet, LAN, an Ethernet, wireless communication via cell tower or satellite, or any client server system that provides communication, for example. Such communications technologies may use any suitable protocol such as TCP/IP, UDP, or OSI, for example.
As described above, a set of instructions may be used in the processing of the invention. The set of instructions may be in the form of a program or software. The software may be in the form of system software or application software, for example. The software might also be in the form of a collection of separate programs, a program module within a larger program, or a portion of a program module, for example. The software used might also include modular programming in the form of object-oriented programming. The software tells the processing machine what to do with the data being processed.
Further, it is appreciated that the instructions or set of instructions used in the implementation and operation of the invention may be in a suitable form such that the processing machine may read the instructions. For example, the instructions that form a program may be in the form of a suitable programming language, which is converted to machine language or object code to allow the processor or processors to read the instructions. That is, written lines of programming code or source code, in a particular programming language, are converted to machine language using a compiler, assembler or interpreter. The machine language is binary coded machine instructions that are specific to a particular type of processing machine, i.e., to a particular type of computer, for example. The computer understands the machine language.
Any suitable programming language may be used in accordance with the various embodiments of the invention. Illustratively, the programming language used may include assembly language, Ada, APL, Basic, C, C++, COBOL, dBase, Forth, Fortran, Java, Modula-2, Pascal, Prolog, REXX, Visual Basic, and/or JavaScript, for example. Further, it is not necessary that a single type of instruction or single programming language be utilized in conjunction with the operation of the system and method of the invention. Rather, any number of different programming languages may be utilized as is necessary and/or desirable.
Also, the instructions and/or data used in the practice of the invention may utilize any compression or encryption technique or algorithm, as may be desired. An encryption module might be used to encrypt data. Further, files or other data may be decrypted using a suitable decryption module, for example.
As described above, the invention may illustratively be embodied in the form of a processing machine, including a computer or computer system, for example, that includes at least one memory. It is to be appreciated that the set of instructions, i.e., the software for example, that enables the computer operating system to perform the operations described above may be contained on any of a wide variety of media or medium, as desired. Further, the data that is processed by the set of instructions might also be contained on any of a wide variety of media or medium. That is, the particular medium, i.e., the memory in the processing machine, utilized to hold the set of instructions and/or the data used in the invention may take on any of a variety of physical forms or transmissions, for example. Illustratively, the medium may be in the form of paper, paper transparencies, a compact disk, a DVD, an integrated circuit, a hard disk, a floppy disk, an optical disk, a magnetic tape, a RAM, a ROM, a PROM, an EPROM, a wire, a cable, a fiber, a communications channel, a satellite transmission, a memory card, a SIM card, or other remote transmission, as well as any other medium or source of data that may be read by the processors of the invention.
Further, the memory or memories used in the processing machine that implements the invention may be in any of a wide variety of forms to allow the memory to hold instructions, data, or other information, as is desired. Thus, the memory might be in the form of a database to hold data. The database might use any desired arrangement of files such as a flat file arrangement or a relational database arrangement, for example.
In the system and method of the invention, a variety of “user interfaces” may be utilized to allow a user to interface with the processing machine or machines that are used to implement the invention. As used herein, a user interface includes any hardware, software, or combination of hardware and software used by the processing machine that allows a user to interact with the processing machine. A user interface may be in the form of a dialogue screen for example. A user interface may also include any of a mouse, touch screen, keyboard, keypad, voice reader, voice recognizer, dialogue screen, menu box, list, checkbox, toggle switch, a pushbutton or any other device that allows a user to receive information regarding the operation of the processing machine as it processes a set of instructions and/or provides the processing machine with information. Accordingly, the user interface is any device that provides communication between a user and a processing machine. The information provided by the user to the processing machine through the user interface may be in the form of a command, a selection of data, or some other input, for example.
As discussed above, a user interface is utilized by the processing machine that performs a set of instructions such that the processing machine processes data for a user. The user interface is typically used by the processing machine for interacting with a user either to convey information or receive information from the user. However, it should be appreciated that in accordance with some embodiments of the system and method of the invention, it is not necessary that a human user actually interact with a user interface used by the processing machine of the invention. Rather, it is also contemplated that the user interface of the invention might interact, i.e., convey and receive information, with another processing machine, rather than a human user. Accordingly, the other processing machine might be characterized as a user. Further, it is contemplated that a user interface utilized in the system and method of the invention may interact partially with another processing machine or processing machines, while also interacting partially with a human user.
It will be readily understood by those persons skilled in the art that the present invention is susceptible to broad utility and application. Many embodiments and adaptations of the present invention other than those herein described, as well as many variations, modifications and equivalent arrangements, will be apparent from or reasonably suggested by the present invention and foregoing description thereof, without departing from the substance or scope of the invention.
Accordingly, while the present invention has been described here in detail in relation to its exemplary embodiments, it is to be understood that this disclosure is only illustrative and exemplary of the present invention and is made to provide an enabling disclosure of the invention. Accordingly, the foregoing disclosure is not intended to be construed or to limit the present invention or otherwise to exclude any other such embodiments, adaptations, variations, modifications or equivalent arrangements.
This application is related to the following U.S. Patent Applications: Patent application Ser. No. ______, filed Mar. 7, 2022, entitled SYSTEMS AND METHODS FOR BUILDING AN ARCHITECTURE KNOWLEDGE GRAPH, and having attorney docket number 052227.500731; Patent application Ser. No. ______, filed Mar. 7, 2022, entitled SYSTEMS AND METHODS FOR IDENTIFYING AND REMEDIATING ARCHITECTURE RISK, and having attorney docket number 052227.500732; Patent application Ser. No. ______, filed Mar. 7, 2022, entitled SYSTEMS AND METHODS FOR BUILDING A UNIFIED ASSET GRAPH, and having attorney docket number 052227.500733; and Patent application Ser. No. ______, filed Mar. 7, 2022, entitled SYSTEMS AND METHODS FOR IDENTIFYING AND REMEDIATING ARCHITECTURE DESIGN DEFECTS, and having attorney docket number 052227.500741. The disclosure of each of the applications noted, above, is hereby incorporated, by reference, in its entirety.
