Abstract: An implementation comparison-based security system is disclosed. In various embodiments, respective network messages received from a plurality of implementations are received. The network messages are compared to determine whether any network message in the received set of network messages deviates from any one or more other network messages in the set. A responsive action is determined based at least in part on the results of said comparison.

Abstract: A network message is received for a first implementation. The network message is replicated for a second implementation. A first behavior from the first implementation is compared with a second behavior from the second implementation. A defect action is determined based at least in part on results of said comparison.

Abstract: Techniques to compare behavioral populations for security and compliance monitoring are disclosed. In various embodiments, for each of a plurality of implementations of a computing resource a corresponding behavioral profile data is store, which includes for each of a plurality of observed behavioral patterns observed to have been exhibited by the implementation a corresponding summary representation of one or more characteristic traits of the behavioral pattern. At least portions of said behavioral profile data associated with one or more implementations included in a cohort comprising a sub-population of said plurality of implementations identified by configuration data as being associated with said cohort is used to determine that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort.

Abstract: An implementation comparison-based security system is disclosed. In various embodiments, respective network messages received from a plurality of implementations are received. The network messages are compared to determine whether any network message in the received set of network messages deviates from any one or more other network messages in the set. A responsive action is determined based at least in part on the results of said comparison.

Abstract: Techniques to compare behavioral populations for security and compliance monitoring are disclosed. In various embodiments, for each of a plurality of implementations of a computing resource a corresponding behavioral profile data is store, which includes for each of a plurality of observed behavioral patterns observed to have been exhibited by the implementation a corresponding summary representation of one or more characteristic traits of the behavioral pattern. At least portions of said behavioral profile data associated with one or more implementations included in a cohort comprising a sub-population of said plurality of implementations identified by configuration data as being associated with said cohort is used to determine that an observed behavior of a member implementation of the cohort deviates from an expected behavior of members of the cohort.

Abstract: An implementation comparison-based security system is disclosed. In various embodiments, respective network messages received from a plurality of implementations are received. The network messages are compared to determine whether any network message in the received set of network messages deviates from any one or more other network messages in the set. A responsive action is determined based at least in part on the results of said comparison.