Abstract: There is provided an automated system for generating mappings and enumerated tree objects. Documents containing compliance rules may be converted to tree-structured documents. Mappings may be generated which link nodes within the tree-structured documents to one another. Compliance controls may be created which continuously monitor a computing environment for compliance by applications with the controls. Compliance evidence objects may be received which indicate an application's compliance or non-compliance with one or more controls.

Abstract: There is provided a method for monitoring and assessing compliance of a computing system. The method may include receiving documents containing rules. Each document may be converted to a tree structure having nodes. A mapping object may be generated to map a tree structure to another tree structure. A second mapping object may be generated to relate a tree structure to compliance controls. A third mapping object may be generated to relate compliance controls to a set of compliance control evidence. A compliance score may be determined based on the controls, the evidence, and the mappings.

Abstract: There is provided a layered anomaly detection system. The system may perform real-time compliance anomaly detection using a plurality of anomaly-detecting machine learning (ML) models. The system includes a pre-processing subsystem which classifies population sets within a system and defines a plurality of context spaces, clusters objects and labels for each population member. The system trains a plurality of ML anomaly detection models based on received compliance events. The ML anomaly detection models may output an anomaly detection score and a confidence score. One or more ensemble ML models may be used to enhance accuracy.

Abstract: There is provided a system for compliance monitoring of applications executing in cloud operating environments. The system may convert rule-containing documents to tree structures comprising nodes representing compliance rules. The system may monitor controls which provide evidence of applications' compliance when triggered by events, such as configuration changes and user interactions. The compliance evidence may be evaluated for an effect on an application's compliance score. The system may further provide a unique mapping identifier system for mappings between tree structures, controls, and compliance evidence. The system may further include a layered anomaly detection module which include a real-time processing component and a second processing component for generating and refining anomaly detection machine learning models which is de-coupled from the real-time processing component.

Abstract: There is provided a system for performing compliance and risk assessment of a software application, such as a Software-as-a-Service (SaaS) application. The system may store historical compliance evidence data and receive updated compliance evidence data. The system may include a plurality of machine learning models which are trained using different subsets of historical compliance evidence data. When received updated compliance evidence data is incomplete, the machine learning models may be used to generate predicted compliance evidence so as to provide a full compliance evidence data set. One or more of risk and/or compliance scores may be determined based on combinations of received compliance data, predicted compliance data, and historical compliance data.