Cloud identity abuse detection technology based on runtime context and static analysis

Abstract

The invention provides a cloud identity abuse recognition system and method based on runtime data and static analysis. The method comprises the following steps: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor configured to detect corresponding data of a runtime process executing on the workload; detecting an original disk associated with the workload; generating a checkable disk based on the original disk; checking the network security object in the checkable disk; detecting an event in a log of the cloud computing environment based on the identifier of the workload; checking an identity object in the code object, wherein the code object is used for deploying a workload in the cloud computing environment; associating the runtime process with the event based on the identity object, the network security object, and the identifier of the workload; and generating an enrichment log including the identifiers of the runtime processes.

Description

Technical Field

[0001] This disclosure generally relates to the detection of cybersecurity threats, particularly the detection of cloud identity abuse based on runtime context and static analysis. Background Technology

[0002] Cloud identity abuse refers to unauthorized or malicious activities that exploit vulnerabilities in cloud identity and access management systems to gain unauthorized access to resources or data stored in the cloud environment. Cloud identity abuse can take various forms, including credential theft, identity spoofing, privilege escalation, and insider threats.

[0003] Runtime data analytics involves real-time monitoring of cloud identity-related activities and behaviors. This includes tracking login attempts, access patterns, and usage anomalies to detect any unauthorized or suspicious activity. Static analysis involves examining cloud identity-related configuration settings, permissions, and access controls without executing code. By analyzing these factors, potential vulnerabilities and configuration errors can be identified, which may indicate identity abuse. Techniques such as anomaly detection, machine learning algorithms, and rule-based systems are commonly used to analyze runtime data and static configurations to effectively detect and prevent cloud identity abuse.

[0004] Despite progress in identifying cloud identity abuse, current technological levels present several challenges. One issue is the complexity of cloud environments, typically involving multiple services, providers, and interconnected systems, making comprehensive monitoring and analysis of identity-related activity difficult. Furthermore, the dynamic nature of cloud infrastructure challenges maintaining accurate baselines for normal behavior, leading to a higher risk of false positives or false negatives. Additionally, the lack of standardized protocols and tools for integrating identity data from different cloud platforms complicates the detection process and can result in incomplete visibility into identity-related data. Another significant challenge is the complexity of modern attack techniques, such as identity spoofing, credential stuffing, and insider threats, which require advanced detection mechanisms to identify subtle signs of abuse within legitimate activities. Moreover, privacy and compliance concerns, such as data sovereignty and regulatory requirements, impose restrictions on the collection and analysis of identity-related data, thus limiting the effectiveness of detection technologies.

[0005] Therefore, it would be beneficial to provide a solution that overcomes the above challenges. Summary of the Invention

[0006] The following is an overview of several example embodiments of this disclosure. This overview is provided only to facilitate the reader's understanding of the basic concepts of these embodiments and is not intended to fully limit the scope of this disclosure. This overview is not a broad summary of all contemplated embodiments, nor is it intended to identify key or essential elements of all embodiments, nor is it intended to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that follows. For convenience, the terms "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or more embodiments of this disclosure.

[0007] A system of one or more computers can be configured to perform specific operations or measures by installing software, firmware, hardware, or a combination thereof on the system, performing measures in operation, or causing the system to perform measures. A system of one or more computer programs can be configured to perform specific operations or measures by including instructions that, when executed by a data processing device, cause the device to perform those measures.

[0008] In general, the method may include detecting workloads in a cloud computing environment. The method may also include configuring the workload to deploy a sensor application thereon, the sensor being configured to detect corresponding data of runtime processes executing on the workload. The method may also include detecting a raw disk associated with the workload. The method may also include generating an inspectable disk based on the raw disk. The method may also include examining network security objects in the inspectable disk using static analysis. The method may also include detecting events in logs of the cloud computing environment based on identifiers of the workload, the logs including multiple events. The method may also include examining identity objects in code objects used to deploy workloads in the cloud computing environment. The method may also include associating runtime processes with events based on identifiers of identity objects, network security objects, and workloads. The method may also include generating an enriched log including identifiers of runtime processes associated with events. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform measures of the method.

[0009] Implementations may include one or more of the following features. The method may include: detecting an identifier of a network security object; and determining, based on the detected identifier, that a runtime process is executed based on software associated with the network security object. The method may include: cloning a raw disk to an inspectable disk; and releasing resources allocated to the inspectable disk in response to completion of inspection of the inspectable disk. The method may include: configuring sensors to detect cloud API calls, the cloud API calls including identifiers of identity objects. The method may include: storing representations of workloads, identities, and events in a secure database in response to the detection of a network security object on the inspectable disk. The method may include: accessing an Infrastructure as Code (IaC) platform to detect code objects. The method may include: further associating runtime processes with events based on detected runtime data. The method may include: applying network security policies to enriched logs. The method may include: initiating remediation measures in response to detecting that a condition of the applied network security policy causes a failure. Implementations of the described techniques may include hardware, methods or processes, or tangible computer media.

[0010] In general, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: detect a workload in a cloud computing environment; configure the workload to deploy a sensor application thereon, the sensors being configured to detect corresponding data of a runtime process executing on the workload; detect a raw disk associated with the workload; generate an inspectable disk based on the raw disk; examine network security objects in the inspectable disk using static analysis; detect events in a log of the cloud computing environment based on identifiers of the workload, the log including multiple events; examine identity objects in code objects used to deploy the workload in the cloud computing environment; associate runtime processes with events based on identifiers of identity objects, network security objects, and workloads; and generate an enriched log including runtime process identifiers associated with the events. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform measures of the method.

[0011] In general, the system may include processing circuitry. The system may also include memory containing instructions that, when executed by the processing circuitry, configure the system to: detect workloads in a cloud computing environment. The system may also configure the workloads to deploy sensor applications thereon, the sensors being configured to detect corresponding data of runtime processes executing on the workloads. Furthermore, the system may detect raw disks associated with the workloads. The system may also generate inspectable disks based on the raw disks. The system may also utilize static analysis to examine network security objects in the inspectable disks. The system may also detect events in logs of the cloud computing environment based on identifiers of the workloads, the logs including multiple events. The system may also examine identity objects in code objects used to deploy workloads in the cloud computing environment. The system may also associate runtime processes with events based on identifiers of identity objects, network security objects, and workloads. The system may also generate enriched logs including identifiers of runtime processes associated with events. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform measures of the methods.

[0012] The implementation may include one or more of the following features. The memory in the system contains further instructions, when executed by the processing circuitry, that further configure the system to: detect the identifier of a network security object; and determine, based on the detected identifier, that a runtime process is executed based on software associated with the network security object. The memory in the system contains further instructions, when executed by the processing circuitry, that further configure the system to: clone the original disk to an inspectable disk; and release resources allocated to the inspectable disk in response to completion of inspection of the inspectable disk. The memory in the system contains further instructions, when executed by the processing circuitry, that further configure the system to: configure a sensor to detect cloud API calls, the cloud API calls including the identifier of an identity object. The memory in the system contains further instructions, when executed by the processing circuitry, that further configure the system to: store a representation of the workload, a representation of the identity, and a representation of the event in a security database in response to detection of a network security object on the inspectable disk. The memory in the system contains further instructions, when executed by the processing circuitry, that further configure the system to: access an Infrastructure as Code (IaC) platform to detect code objects. The memory in the system contains further instructions, which, when executed by the processing circuitry, further configure the system to: further associate runtime processes with events based on detected runtime data. The memory in the system contains further instructions, which, when executed by the processing circuitry, further configure the system to: apply network security policies to enriched logs. The memory in the system contains further instructions, which, when executed by the processing circuitry, further configure the system to: initiate remedial measures in response to detecting a failure caused by a condition of the applied network security policy. Implementations of the described techniques may include hardware, methods or processes, or tangible computer media. Attached Figure Description

[0013] The subject matter disclosed herein is specifically pointed out and expressly claimed in the claims of the specification. The above and other objects, features, and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0014] Figure 1 This is an example schematic diagram of a cloud computing environment that monitors cybersecurity threats by an inspection environment, implemented according to an embodiment.

[0015] Figure 2 This is an example schematic diagram illustrating communication between a sensor backend server and multiple sensors deployed on various workloads, according to an embodiment.

[0016] Figure 3 This is an example flowchart of a method for performing network security threat detection on resources in a cloud computing environment, implemented according to an embodiment.

[0017] Figure 4 This is an example flowchart of a method for associating a cloud identity with a workload process, implemented according to an embodiment.

[0018] Figure 5 This is an example flowchart of a method for detecting measures associated with workload, implemented according to an embodiment.

[0019] Figure 6 This is an example flowchart of a method for determining the active baseline of workloads in a computing environment, implemented according to an embodiment.

[0020] Figure 7 This is an example flowchart of a method for initiating mitigation measures based on process-related events in a cloud computing environment, implemented according to an embodiment.

[0021] Figure 8 This is an example flowchart of a method for identifying cloud identity abuse based on runtime data and static analysis, implemented according to an embodiment.

[0022] Figure 9 This is an example schematic diagram of an inspection controller according to an embodiment. Detailed Implementation

[0023] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the inventive teachings herein. Generally, the statements in this specification do not necessarily limit any of the various claimed embodiments. Furthermore, some statements may apply to some inventive features but not to others. Generally, unless otherwise stated, singular elements may be plural, and vice versa, without loss of generality. In the accompanying drawings, the same numerals denote the same parts in several views.

[0024] Figure 1 This is an example schematic diagram of a cloud computing environment for monitoring cybersecurity threats by an inspection environment, implemented according to an embodiment. In the embodiment, the cloud computing environment 110 is implemented as a Virtual Private Cloud (VPC), Virtual Network (VNet), Virtual Private Network (VPN), etc., on a cloud computing platform. The cloud computing platform can be, for example... AWS Web Services Cloud platform (GCP) Provided by Azure and others.

[0025] In this embodiment, the cloud computing environment 110 includes cloud entities deployed therein. According to this embodiment, a cloud entity is, for example, a subject, a resource, a combination thereof. In this embodiment, a resource is a cloud entity that provides access to computing resources (e.g., processors, memory, storage devices, etc.).

[0026] In some embodiments, resources are virtual machines, software containers, serverless functions, etc. According to some embodiments, resources include software applications deployed thereon, such as web servers, gateways, load balancers, network application firewalls (WAFs), devices, and various combinations thereof.

[0027] In some embodiments, the subject is a cloud entity authorized to initiate actions in a cloud computing environment. According to some embodiments, a cloud entity is, for example, a user account, service account, role, etc. In some embodiments, a cloud entity is a subject relative to another cloud entity and also relative to the resources of that other cloud entity. For example, a load balancer is a resource for a user account to request web pages from a web server behind the load balancer, and the load balancer is the subject of the web server.

[0028] The cloud computing environment 110 includes multiple resources, such as virtual machines 112, a software container orchestrator 114, and serverless functions 116. For example, it can utilize... Deploy virtual machine 112. For example, you can utilize... engine, Engines, etc., are used to deploy software container orchestrator 114. In an embodiment, software container orchestrator 114 is configured to deploy software clusters, each cluster comprising multiple nodes. In an embodiment, nodes comprise multiple pods. For example, serverless function 116 can be used with... Lambda is used together. In the embodiment, serverless function 116 is a serverless function container image.

[0029] In this embodiment, the cloud computing environment 110 includes a data repository 118. According to this embodiment, the data repository 118 includes code objects, software images, software libraries, software binaries, etc. In this embodiment, workloads, resources, etc., are deployed in the cloud computing environment 110 based on the code objects, software images, etc., accessed from the data repository 118.

[0030] In some embodiments, cloud computing environment 110 includes a cloud application programming interface (API). In some embodiments, cloud API 119 is used to access resources of cloud computing environment 110. For example, in one embodiment, the resource is configured to generate API calls. In another embodiment, a process deployed on virtual machine 112 initiates an API call, for example, by making a call to cloud API 119.

[0031] In some embodiments, the cloud computing environment 110 is configured to utilize an Identity and Access Management (IAM) server 140. In some embodiments, the IAM server 140 is configured to manage the identities of the cloud computing environment 110. In embodiments, the IAM server 140 is configured to associate cloud identities (e.g., user accounts, service accounts, roles, user groups, combinations thereof) with permissions, authorizations, combinations thereof, etc.

[0032] According to an embodiment, the cloud computing environment 110 is connected to the Infrastructure as Code (IaC) platform 130. In this embodiment, the IaC platform 130 utilizes, for example... In some embodiments, workloads are deployed in cloud computing environment 110 based on code objects from IaC platform 130.

[0033] In some embodiments, the code object includes code instructions for setting roles, invoking roles, initiating measures, combinations thereof, etc., in a computing environment.

[0034] In some embodiments, workloads, processes deployed on the workloads, subjects, etc., generate measures, events, etc. in the cloud computing environment 110. In some embodiments, the cloud logging system 117 is configured to generate log events based on measures, events, combinations thereof, etc.

[0035] For example, in one embodiment, serverless function 116 is configured to initiate an action using cloud API 119. In some embodiments, cloud logging system 117 is configured to generate data records (e.g., log events) in cloud logs that include data describing the initiated action. In some embodiments, the data records include an identifier of the serverless function, an IP address, an identifier of the API call, a combination thereof, etc.

[0036] As discussed in more detail herein, according to an embodiment, cloud computing environment 110 includes multiple resources. Each such resource is vulnerable to various cybersecurity threats. For example, such threats may become apparent due to the software version of the application in software container 114, the operating system (OS) version of virtual machine 112, misconfigured code in serverless function 116, etc. In this embodiment, inspection environment 120 monitors for cybersecurity threats to cloud computing environment 110. In this embodiment, the inspection environment is implemented as a cloud computing environment including VPC, VNet, VPN, etc.

[0037] In this embodiment, each of the virtual machine 112, software container 114, and serverless function 116 includes sensors configured for specific resources, resource types, combinations thereof, etc. Figure 2 An example deployment of the sensor is discussed in more detail.

[0038] In the embodiment, the sensor ( Figure 1 (Not shown) is configured to listen for events, packets, etc. at the data link layer. In some embodiments, the sensor is configured to detect runtime events, running processes, etc., on the resources on which the sensor is deployed.

[0039] For example, according to an embodiment, the sensor is configured to utilize an eBPF interface, which allows for non-intrusive monitoring of data link layer communications. In some embodiments, the sensor is also configured to send data to and receive data from a sensor backend server 128. The sensor backend server 128 is a workload deployed in the inspection environment 120, such as a virtual machine, software container, serverless function, or a combination thereof.

[0040] In this embodiment, the sensor backend server 128 is configured to receive data generated by the sensor. For example, in this embodiment, the sensor backend server 128 is configured to receive events from the sensor.

[0041] In some embodiments, the sensor is configured to request rules, definitions, etc., from a sensor backend server 128, and the sensor is configured to apply these rules and definitions to events, such as events detected on an eBPF interface. For example, predetermined events, such as those indicating access to an IP address, IP address range, etc., can be examined according to the definitions.

[0042] According to some embodiments, a definition is a logical expression that, when applied to an event, produces a "true" or "false" result. In embodiments, a rule is a logical expression that includes a measure. For example, a rule could be that if a certain definition is true when applied to an event, then data related to that event should be sent to the sensor backend server 128.

[0043] In some embodiments, sensor backend server 128 is configured to initiate an inspection of resources deployed in cloud computing environment 110. For example, sensor backend server 128 may be configured to initiate such an inspection in response to receiving events, data, combinations thereof, etc., from sensors deployed on the resources.

[0044] In one embodiment, the inspection of resources is initiated by generating an instruction for the inspection controller 122, which, when executed, configures the inspector 124 to inspect the resources.

[0045] For example, the sensor is configured to send event data to the sensor backend server 128 in response to a definition applied by the sensor to a detected event that produces a "true" value upon application. For example, the definition could be "IP addresses in the range 127.0.0.1 to 127.0.0.99," which in this example corresponds to the range of IP addresses used by malware. When the definition is applied to, for example, a detected network packet, and the result is "true," the sensor is configured to send event-related data to the sensor backend server 128. Event-related data could be, for example, IP addresses, event types, and combinations thereof.

[0046] In this embodiment, sensor backend server 128 is configured to receive data. In some embodiments, sensor backend server 128 is also configured to apply rules to the received data to determine whether an inspection of the workload deploying the sensors should be conducted to check for cybersecurity threats. For example, sensor backend server 128 is configured to generate instructions to inspect virtual machine 112 in response to receiving an indication from a sensor deployed as a service on a virtual machine, i.e., to detect communication between virtual machine 112 and a server with a blocked IP address (such as an IP address associated with malware).

[0047] For example, sensor backend server 128 can generate instructions for inspection controller 122, which, when executed by the inspection controller (e.g., using a snapshot, copy, clone, etc. of a disk (not shown) associated with virtual machine 112), generate an inspectable disk and provide access to the inspector 124. In embodiments, inspector 124 is configured to detect cybersecurity threats. For example, in embodiments, inspector 124 is configured to receive a hash of an application stored on the inspectable disk and determine whether the hash matches a hash of a known malicious software application. In some embodiments, a persistent volume claim (PVC) for the inspectable disk is provided to inspector 124.

[0048] In some embodiments, the sensor is configured to generate a hash of the application on its deployed resources (such as virtual machine 112) and send the hash to the sensor backend server 128. The received hash is then compared with a known hash value corresponding to a malicious application, for example, by providing the received hash to an inspector 124.

[0049] While the examples above discussed malware, it is clear that the sensor and inspector 124 can be used to detect other types of cybersecurity threats, such as exposures, vulnerabilities, weak passwords, exposed passwords, misconfigurations, etc.

[0050] In an embodiment, the inspection controller 122 is configured to assign an inspector (e.g., inspector 124) to initiate an inspection of network security objects, providing inspectable disks, combinations thereof, etc. In some embodiments, network security objects are secrets, certificates, software applications, software libraries, software binaries, operating systems, code objects, object hashes, signatures, combinations thereof, etc.

[0051] In some embodiments, the inspection controller 122 is configured to inspect workloads associated with identities. For example, in one embodiment, the inspection controller 122 is configured to detect identities from the IAM server 140 that are associated with permissions.

[0052] In some embodiments, the inspection controller 122 is also configured to detect secrets associated with an identity. In some embodiments, the inspection controller 122 is configured to detect code objects from the IaC platform 130, and detect API calls, role settings, identity identifiers, etc., and associate code objects with identities based on such detection.

[0053] In some embodiments, the inspection environment 120 also includes a security database 126. In some embodiments, the security database 126 is implemented as such A graph database. In an embodiment, the security database 126 is configured to generate a representation of a cloud computing environment 110, such as cloud computing environment 110. For example, in an embodiment, this representation is based on a predefined unified data schema, so each different cloud platform uses a unified data schema for representation, thereby allowing for a uniform representation.

[0054] For example, according to an embodiment, subjects are represented by a predefined data structure, and each subject is represented by a node in a security graph. Similarly, according to some embodiments, resources are represented by another predefined data structure, and each resource is represented by a node in a security graph.

[0055] In some embodiments, data received from sensors deployed on resources in a cloud computing environment may be stored as part of a graph database. In the example above, in response to receiving data from a sensor indicating a potential malware infection of virtual machine 112, sensor backend server 128 is configured in an embodiment to: generate a node representing malware in security database 126, generate a node representing virtual machine 112 in security database 126, and associate the node representing malware with the node representing virtual machine 112.

[0056] In some embodiments, the inspection environment includes a policy engine 125. In an embodiment, the policy engine 125 is configured to provide rules, conditions, policies, etc., to sensors, wherein the sensors are configured to execute these rules, conditions, and policies, etc., on a workload.

[0057] Figure 2 This is an example schematic diagram illustrating communication between a sensor backend server and multiple sensors deployed on various workloads, according to an embodiment. In some embodiments, the sensor backend server 128 is configured to communicate with a machine (not shown) on which sensors are mounted and communicatively coupled. In embodiments, the machine is a bare metal, computer device, networked computer device, laptop computer, tablet computer, or other computing device.

[0058] In embodiments, the sensor backend server 128 is implemented as a virtual machine, a software container, a serverless function, or a combination thereof. In some embodiments, multiple sensor backend servers 128 are implemented. In some embodiments utilizing multiple sensor backend servers 128, a first group of sensor backend servers is configured to communicate with sensors deployed on a first type of resource (e.g., a virtual machine), a second group of sensor backend servers is configured to communicate with a second type of resource, and so on.

[0059] In one embodiment, a first set of sensor backend servers is configured to communicate with sensors deployed in resources of a first cloud computing environment on a first cloud platform (e.g., AWS), and a second set of sensor backend servers is configured to communicate with sensors deployed in resources of a second cloud computing environment on a second cloud platform (e.g., GCP).

[0060] Virtual machine 112 includes sensor 210. In an embodiment, sensor 210 is deployed as a service executed on virtual machine 112. In some embodiments, virtual machine 112 is configured to, for example, request binary code, software packages, etc., from sensor backend server 128, which, when executed by virtual machine 112, cause sensor 210 to run as a service on virtual machine 112. Sensor 210 is configured to, for example, listen for data link layer communication via an eBPF interface.

[0061] Container cluster 114 runs a daemon set and includes multiple nodes, such as node 220. The daemon set ensures that each node 220 runs a daemon set pod 222 configured as a sensor. For example, The cluster can execute a set of daemons configured to deploy a daemon set pod on each deployed node. These daemon set pods are configured to listen for data link layer communication, for example, via an eBPF interface, to listen for communication from multiple pods (e.g., pod-1224 to pod-N 226), where "N" is an integer with a value of "1" or greater. In this embodiment, daemon set pod 222 is configured to communicate with sensor backend server 128.

[0062] In this embodiment, the serverless function 116 includes function code 232 and multiple code layers 1-M (labeled 234 to 236 respectively), where "M" is an integer with a value of "1" or greater. For example, in this embodiment, in AWS Lambda, layers contain code, content, and combinations thereof. In some embodiments, layers such as layer 234 include runtime data, configuration data, software libraries, etc.

[0063] In some embodiments, serverless function 116 includes a sensor layer 238. In some embodiments, sensor layer 238 is configured to listen for data link layer communications of serverless function 116, for example, via an eBPF interface.

[0064] According to an embodiment, sensor service 210, daemon pod 222, and sensor layer 238 are each implementations of a sensor. In an embodiment, the sensor is configured to communicate with sensor backend server 128 via a transport layer protocol such as TCP. For example, in an embodiment, sensor backend server 128 is configured to listen on a predetermined port using the TCP protocol, and sensors (such as sensor 210, daemon pod 222, and sensor layer 238) are all configured to communicate with sensor backend server 128 (e.g., by initiating communication using TCP on a predetermined port).

[0065] Figure 3 This is an example flowchart 300 of a method for performing network security threat detection on resources in a cloud computing environment, implemented according to an embodiment.

[0066] In S310, sensor software is provided for resources. In embodiments, resources are any of virtual machines, software containers, serverless functions, etc. In some embodiments, sensor software is provided based on resource type. For example, a virtual machine is equipped with software packages, such as executable code, e.g., binary code. A software container engine is equipped with a set of daemons, such that in embodiments where a node is deployed in a software container engine cluster, the node includes a daemon set pod configured to provide sensor functionality, for example, as described above. In embodiments, a sensor layer is provided for serverless functions, for example, by providing code in a .ZIP file.

[0067] In one embodiment, providing a sensor includes configuring resources (e.g., a virtual machine, a software container, a serverless function, etc.) to receive software that, when executed, configures the resources to deploy the sensor thereon.

[0068] In S320, events are detected through data link layer communication. In embodiments, the data link layer is monitored for events via an eBPF interface. In some embodiments, a Software Bill of Materials (SBOM) is generated. The SBOM can be implemented as a text file based on events detected, for example, via the eBPF interface. In embodiments, the SBOM includes identifiers of libraries accessed at runtime, identifiers of binaries accessed at runtime, images of instances deployed at runtime, ports accessed by runtime programs, cryptographic hash function values ​​(such as SHA1, SHA2, etc.), etc. For example, the SBOM may include:

[0069]

[0070]

[0071]

[0072] This part of the SBOM represents the execution of a remote process call (RPC) configured to receive a client request to mount a file system.

[0073] At S330, the event is matched with a definition. In some embodiments, the definition includes a logical expression that, when applied to the event, produces a "true" or "false" value. For example, when applied to the event, the definition might state "accessed software library xyz," resulting in either true or false. In some embodiments, a rule is applied to the event. In embodiments, the rule is a logical expression that further includes a measure. For example, in an embodiment, the rule states "generate an alert if unknown software accesses software library xyz." In this example, when an event is detected where software with an unknown identifier (e.g., not matching a pre-approved list of identifiers) attempts to access software library xyz, an alert is generated to indicate that such access has been performed.

[0074] In S340, a check is performed to determine whether data should be transmitted to the check environment. In some embodiments, the check is performed by applying rules to the event and determining the transmission based on the output of the applied rules. If 'yes', execution continues in S350; if 'no', execution continues in S360.

[0075] In S350, the corresponding data for the event is transmitted to the inspection environment. In this embodiment, the data is based on an SBOM file. In some embodiments, the data includes event data such as identifiers of resources (e.g., virtual machines, software containers, serverless functions, etc.), application identifiers, hash values, Uniform Resource Locator (URL) requests, software library identifiers, software binary identifiers, timestamps, etc.

[0076] In S360, checks are performed to determine whether monitoring of resources should continue. For example, a container daemon set can be configured to periodically deploy a daemon set pod to monitor pods on a node. As another example, a virtual machine can be configured to periodically deploy a sensor service running as a process on the virtual machine, terminate the process after a predetermined time period, terminate the process after detecting a predetermined number of events, and so on.

[0077] In some embodiments, the check is performed based on a predetermined amount of time elapsed (e.g., every four hours, daily, twice daily, etc.). If 'yes', execution continues at S320. If 'no', in an embodiment, execution terminates. In some embodiments, if 'no', another check is performed at S360, for example, after a predetermined time period has elapsed.

[0078] Figure 4 This is an example flowchart of a method for associating cloud identity with a workload process. In an embodiment, a process is an instance of a computing program, such as one executed by at least one thread. According to an embodiment, this is the opposite of a computer program, which is a passive collection of computer instructions.

[0079] In some embodiments, the workload comprises multiple computing programs, only a portion of which actually run as processes on the workload. In some embodiments, the processes are configured to launch in an environment such as a computing environment, a cloud computing environment, etc.

[0080] In S410, a sensor is deployed on the workload. In some embodiments, the sensor is a runtime sensor. In some embodiments, the sensor is deployed as a process on the workload. In certain embodiments, the sensor is a runtime process, a task, a combination thereof, etc.

[0081] In this embodiment, sensors deployed on the workload are configured to detect API calls. For example, in some embodiments, the sensors are configured to detect cloud API calls. In this embodiment, the sensors are configured to detect the entity, such as a role, used with the API call.

[0082] In S420, identity is detected. In embodiments, identity detection includes detecting the subject associated with the workload. According to some embodiments, the workload's disk is examined to detect secrets. In embodiments, secrets are cryptographic keys, certificates, tokens, etc. In some embodiments, secrets are used to access resources.

[0083] In some embodiments, disk inspection includes generating an inspectable disk based on workload and detecting secrets on the inspectable disk. In some embodiments, an IAM server is queried to detect identities associated with secrets. In some embodiments, secrets include resources, principal identifiers, etc., which are configured to utilize secrets.

[0084] In some embodiments, identity is detected by sensors configured to detect identity in API calls. In some embodiments, identity is a managed identity, service principal, user account, service account, user role, user group, a combination thereof, etc.

[0085] In S430, an event is detected. In this embodiment, the event is detected in the logs of the computing environment. For example, in some embodiments, entity startup actions, events, etc., of the computing environment are recorded in a log (e.g., a cloud log). In some embodiments, the cloud log is, for example, CloudTrail.

[0086] In some embodiments, the inspection controller is configured to detect events in the computing environment logs. In some embodiments, the inspection controller is configured to detect only predetermined event types. In embodiments, events are detected based on identifiers (e.g., entity identifiers, process identifiers, IP addresses, computing environment identifiers, combinations thereof, etc.).

[0087] In S440, a code object is detected. In an embodiment, the code object corresponds to code used to deploy workloads in a computing environment. According to some embodiments, the code object is part of a code file (e.g., a Terraform file). In an embodiment, multiple workloads are deployed in the computing environment using the code object.

[0088] For example, in one embodiment, a code object is a portion of declarative code used in the infrastructure as a code platform. In some embodiments, a code object comprises multiple lines of code.

[0089] In some embodiments, code objects are detected based on workload identifiers, identity identifiers, subjects, etc. In some embodiments, the code object is associated with a workload, for example, as a representation in a security database. In some embodiments, the representation of the code object is linked in the security database to the representation of the workload.

[0090] In S450, the code object is inspected. In an embodiment, inspecting the code object includes detecting network security objects within the code object. In some embodiments, network security objects are secrets, certificates, cryptographic keys, software applications, software libraries, software binaries, operating systems, code objects, hashes of objects, signatures, software products, combinations thereof, etc.

[0091] In some embodiments, a representation of the code object is generated and stored in a secure database. In other embodiments, representations of the subject, API calls, etc., are stored in the secure database and linked to the representation of the code object.

[0092] In S460, identity is matched with process. In an embodiment, the process is a process running on a workload and detected as a running process by a sensor. In some embodiments, the inspection controller is configured to match data received from the sensor (e.g., runtime data) with data received through static analysis of code objects, disks, etc., in the computing environment, and further match the runtime data and static analysis with events detected in the computing environment logs.

[0093] For example, in one embodiment, a sensor detects a process on a workload that uses a machine role to execute a cloud API call to terminate an instance. In another embodiment, the instruction to terminate the instance generates an event in the cloud logs. According to an embodiment, for example, the event is matched with a process based on the detection of an identifier for the workload in the event log.

[0094] According to some embodiments, the identity matching the process is stored in a secure database. In some embodiments, enriched logs are generated based on predetermined event types and sensor data, such that events from cloud logs are enriched using the workload's process identifier based on sensor data. In embodiments, the enriched logs are further enriched by examining static analytics data detected by the workload's disk.

[0095] Figure 5 This is an example flowchart of a method for detecting measures associated with a workload, implemented according to an embodiment. In the embodiment, the workload is deployed as a resource comprising multiple nested resources.

[0096] For example, according to an embodiment, a software cluster includes multiple nodes, each node includes multiple pods, and each pod has multiple software containers. Each container is a resource, and pods can share IP addresses, node identifiers, etc. Therefore, log data alone is often insufficient to correlate actions in a computing environment with specific containers.

[0097] In S510, a workload is selected. In this embodiment, the workload is a nested workload, such as a container nested within a pod, which in turn is nested within a node. In some embodiments, multiple workloads share a common identifier, such as an IP address, subnet mask, VPN identifier, or a combination thereof.

[0098] In some embodiments, the workload is selected by the inspection controller. In some embodiments, the workload includes sensors deployed thereon in the sensor's runtime environment. According to some embodiments, the workload includes multiple sensors. In some embodiments, the container is a resource comprising multiple nodes, each with a sensor deployed on it.

[0099] In S520, an identity is associated with a process from the workload. In an embodiment, an identity is a managed identity, a user account, a service account, a role, permissions, a user group, a combination thereof, etc.

[0100] According to embodiments, an identity is associated with a workload, for example, by examining the workload and detecting credentials, secrets, tokens, certificates, cryptographic keys, cloud keys, combinations thereof, etc. In some embodiments, credentials, etc., are associated with an identity. In certain embodiments, an identity and access management server is used to associate an identity with credentials, etc.

[0101] In some embodiments, a workload is associated with multiple identities. For example, in one embodiment, a first identity is associated with a first process running on the workload, and a second identity is associated with a second process running on the workload.

[0102] In S530, a measure is detected. In this embodiment, the measure is detected in the event log of the computing environment. For example, according to this embodiment, the event log of the cloud computing environment is implemented as follows: CloudTrail.

[0103] In embodiments, a measure corresponds to one event, multiple events, multiple events arranged in a predetermined event order, or combinations thereof. In some embodiments, measures are detected based on predetermined event types.

[0104] In some events, actions are detected in real-time, near real-time, or other modes. For example, in some embodiments, only certain actions corresponding to pre-determined types of events are monitored in the event log, thereby reducing the number of records that need to be parsed.

[0105] In this embodiment, secondary cloud logs are generated only based on events of a predetermined type that correspond to the measures to be monitored.

[0106] In S540, output is generated. In an embodiment, the output is a report including measures initiated by the process. In some embodiments, the output is enriched cloud logs. For example, according to an embodiment, the output includes events of a predetermined type. In an embodiment, each event record of the predetermined type is further enriched with associated identity, workload identifier, data from static analysis, etc.

[0107] According to embodiments, enriched logs are beneficial for maintenance because they allow searching within the enriched logs for events of particular interest for cybersecurity purposes. For example, certain activities in a cloud computing environment are more likely to indicate cybersecurity threats; therefore, having data records that include only such events, without other data considered "noise," is advantageous.

[0108] In some embodiments, having enriched logs is further advantageous, which indicate which measures are performed by which workloads using which identities to perform those measures.

[0109] Figure 6 This is an example flowchart of a method for determining the active baseline of workloads in a computing environment, implemented according to an embodiment.

[0110] In S610, a workload is selected. In this embodiment, the workload is a nested workload, such as a container nested within a pod, which in turn is nested within a node. In some embodiments, multiple workloads share a common identifier, such as an IP address, subnet mask, VPN identifier, or a combination thereof.

[0111] In some embodiments, the workload is selected by the inspection controller. In some embodiments, the workload includes sensors deployed thereon in the sensor's runtime environment. According to some embodiments, the workload includes multiple sensors. In some embodiments, the container is a resource comprising multiple nodes, each with a sensor deployed on it.

[0112] In S620, an activity baseline is generated. In an embodiment, an activity baseline is generated for the selected workload. In some embodiments, generating an activity baseline includes generating logs, tables, etc., which include action type identifiers, operation types, communication destination identifiers, multiple such events, etc.

[0113] For example, in an embodiment, the workload activity baseline includes a counter for the number of times a process accesses a specific other workload, a counter for the number of times a process accesses an IP range, a counter for the number of times a process initiates a measure with a specific workload, a counter for API calls, a counter for a specific type of API call, and combinations thereof.

[0114] In this embodiment, the active baseline includes an eviction policy to refresh the counter periodically, continuously, etc., by removing data points that exceed a threshold. For example, in this embodiment, data points older than 24 hours are deleted.

[0115] In some embodiments, an activity baseline is generated for each workload. In some embodiments, an activity baseline is generated for each process running on the workload. In some embodiments, an activity baseline is generated for all workloads of a specific type (e.g., a common activity baseline for all virtual machines in a cloud computing environment).

[0116] In S630, new activity is detected. In this embodiment, the new activity is detected in the cloud computing environment logs. In this embodiment, the new activity is associated with a process and identity on the workload. For example, according to this embodiment, the new activity is associated with a process on the workload using runtime data received from sensors deployed on the workload, static analysis data from workload checks, static analysis data of code objects used in the deployed workload, and combinations thereof.

[0117] In this embodiment, the method described in more detail herein is used to perform the detection of new activity and associate the new activity with a process (a process deployed while running on the workload).

[0118] In S640, the new activity is identified as anomalous. In an embodiment, anomalous activity is detected by matching the data field of the anomalous activity against a generated baseline. For example, in an embodiment, a check is performed to determine the frequency with which the new activity (e.g., an event indicating the new activity) occurred prior to it. In an embodiment, the new activity is classified as anomalous activity when the check indication value is below a threshold.

[0119] In some embodiments, anomalous activity includes: processes that call APIs using target accounts that have not been previously invoked, processes that generate API calls from locations in code that have not previously executed API calls, workloads that have never executed API calls before, combinations thereof, and so on.

[0120] According to some embodiments, anomalous activity is detected based on rules, conditional rules, policies, combinations thereof, etc. For example, in one embodiment, rules are applied to events in enriched logs to determine whether the event conforms to the rules. In some embodiments, if an event in the enriched logs does not conform to the rules, mitigation measures are initiated.

[0121] Figure 7 This is an example flowchart of a method for initiating mitigation measures based on process-related events in a cloud computing environment, implemented according to an embodiment.

[0122] In S710, activities are associated with processes. In some embodiments, an activity includes events, multiple events, predetermined event types, combinations thereof, etc. In some embodiments, events are detected in the logs of a computing environment (e.g., cloud logs, network logs, access logs, and various combinations thereof in a cloud computing environment).

[0123] In one embodiment, associating activities with processes includes deploying sensors on a workload, which in turn deploys multiple processes within a runtime environment. According to another embodiment, the runtime processes include multiple computer instructions that are actively processed by the workload, such as by the workload's processing circuitry or assigned to the workload.

[0124] In some embodiments, the sensor is a runtime process, kernel process, etc. According to some embodiments, the sensor is configured to detect runtime processes, including process identifiers, API calls, instruction execution requests, etc. In some embodiments, the sensor is deployed in a software container cluster, which also includes an admission controller.

[0125] According to an embodiment, the workload of a network security object is examined. In this embodiment, the network security object is used to associate the workload with a code object (e.g., in an IaC platform). In this embodiment, the examination controller is configured to analyze the code object to detect API calls, workload identifiers, cloud service identifiers, certificates, confidentiality, network security objects, combinations thereof, etc.

[0126] In some embodiments, a runtime process is associated with a code object, an identifier of the workload that executes the runtime process, a combination thereof, etc. In some embodiments, a runtime process is also associated with events in a log.

[0127] For example, in some embodiments, the computing environment includes activity logs, cloud logs, network logs, event logs, and various combinations thereof. In some embodiments, enriched logs are generated based on events detected in the logs, and the events are associated with runtime processes. For example, in one embodiment, the event includes an identifier of the workload. Based on the workload identifier, sensor data is used to determine the processes running on the workload that are associated with the events.

[0128] In S720, a policy is applied to the relevant activity. In embodiments, the policy is applied only to activities associated with the runtime process. According to some embodiments, the policy is applied by a policy engine. In some embodiments, the policy engine is configured to send policies, rules, conditional rules, etc., to the admission controller, wherein the admission controller is configured to apply these policies, rules, conditional rules, etc.

[0129] In some embodiments, the policy engine is configured to apply policies to events in the enriched logs. For example, according to one embodiment, policies are applied by determining whether an event record conforms to a policy based on application criteria.

[0130] In some embodiments, a strategy is applied based on multiple conditions. For example, according to some embodiments, strategies, rules, etc., are applied to events of a first type, and an anomaly relative to the event value is detected.

[0131] In S730, mitigation measures are initiated. In some embodiments, mitigation measures are initiated in response to an applied policy. In some embodiments, when a policy is applied to an activity, event log, etc., mitigation measures are initiated in response to determining that a condition of the policy is not met. In some embodiments, when a policy is applied to an activity, event log, etc., mitigation measures are initiated in response to determining that a condition of the policy is met.

[0132] In some embodiments, mitigation measures include blocking network traffic, configuring a firewall to block network traffic from flowing to the workload, blocking network traffic from the workload, sandboxing the workload, revoking permissions, configuring an admission controller to initiate commands, and combinations thereof.

[0133] For example, in one embodiment, mitigation measures include configuring the admission controller of the software container platform to initiate instructions. In another embodiment, the admission controller is configured to perform measures on communication to nodes, communication from nodes, initiate measures in the container cluster, and combinations thereof.

[0134] Figure 8 This is an example flowchart 800 of a method for identifying cloud identity abuse based on runtime data and static analysis according to an embodiment.

[0135] In S810, the workload is detected. In this embodiment, the workload is detected in a cloud computing environment. In some embodiments, the cloud computing environment ( Figure 1 110) is implemented as a Virtual Private Cloud (VPC), Virtual Network (VNet), Virtual Private Network (VPN), etc., on a cloud computing platform. A cloud computing platform can be, for example... AWS Web Services Cloud platform (GCP) Provided by Azure and others.

[0136] In S820, a sensor application is deployed. In an embodiment, the workload is configured to deploy a sensor application. In some embodiments, the sensor is configured to detect corresponding data from a runtime process executing on the workload. In an embodiment, the sensor application is deployed on the workload, such as a virtual machine, software container, serverless function, or a combination thereof.

[0137] In S830, the raw disk is detected. In some embodiments, the raw disk associated with the workload is detected. For example, according to some embodiments, disks, volumes, etc., are configured for the workload, such as virtual machines. In some embodiments, the raw disk is an operating system disk, a data disk, a virtual disk, a physical disk, a combination thereof, etc.

[0138] In S840, an inspectable disk is generated. In one embodiment, an inspectable disk based on the original disk is generated. In some embodiments, the inspectable disk is generated using snapshots, clones, copies, combinations thereof, etc.

[0139] In some embodiments, creating a clone of the disk (i.e., a cloned disk) is more advantageous than creating a snapshot or copy. In some embodiments, creating a snapshot involves generating a file containing an image of the disk at a specific point in time. Such a snapshot can only be examined after the entire file has been created. The time required to create such a file (e.g., writing each bit to memory) is proportional to the amount of data on the disk. Therefore, in some embodiments where the disk contains a large amount of data, this process can be lengthy.

[0140] In contrast, according to some embodiments, cloning is achieved by dereferencing the storage address used by the original disk and generating a pointer to that storage address for the cloned disk. Therefore, cloned disks are available much faster than snapshots, and are thus preferable for some embodiments.

[0141] At point 850, the inspectable disk is inspected. In some embodiments, static analysis is used to perform a network security object inspection on the inspectable disk. According to embodiments, network security objects indicate network security threats. For example, in embodiments, network security threats are risks, vulnerabilities, misconfigurations, exposures, combinations thereof, etc.

[0142] In some embodiments, a combination of detected cybersecurity objects is referred to as a toxic combination, and thus a combination of detecting a first type of cybersecurity object on a single disk, a single workload, etc., and detecting a second type of cybersecurity object constitutes a cybersecurity threat.

[0143] In this embodiment, inspecting the inspectable disk includes detecting network security objects such as files, folders, file systems, applications, operating systems, encryption keys, certificates, hashes, code objects, malware objects, file signatures, signatures generated based on code objects, subject identifiers (e.g., usernames), passwords, combinations thereof, etc.

[0144] At 860, relevant events are detected. In some embodiments, events are detected based on workload identifiers, such as in the logs of the computing environment. In some embodiments, the logs include multiple events. For example, in embodiments, the logs are cloud logs, network logs, event logs, combinations thereof, etc.

[0145] In some embodiments, components of the computing environment (e.g., serverless functions) are configured to monitor events in the computing environment, its parts, etc., and generate event logs, for example, based on predefined data patterns.

[0146] In some embodiments, the serverless function is configured to write the generated event logs to storage, such as a cloud storage system. In an embodiment, the cloud storage system is a bucket. In some embodiments, the serverless function is configured to use, for example, Amazon.

[0147] At 870, the code object is examined. In some embodiments, the identity object of the code object is examined. In embodiments, the identity object indicates an identity, such as a cloud identity. For example, in embodiments, the identity object is an identifier of a subject (e.g., username, email address, etc.), password, certificate, a combination thereof, etc.

[0148] In some embodiments, the code object is used to deploy workloads in a cloud computing environment. In other embodiments, the code object is used to deploy multiple workloads in a computing environment, multiple computing environments, etc. In some embodiments, inspecting the code object includes parsing computer code to detect data fields and extracting data field values ​​from the computer code.

[0149] In this embodiment, the inspection results (such as the extracted data) are as described above. Figure 1 The storage is discussed in more detail in the following examples. For instance, in one embodiment, identity objects are stored as nodes in a security graph that is connected to nodes representing code objects. In some embodiments, nodes representing code objects are connected to nodes representing workloads deployed in a computing environment based on the code objects. In one embodiment, connections are generated by generating edges in the graph. In some embodiments, edges indicate the type of relationship between nodes (e.g., "accessible", "deployed from", etc.).

[0150] At 880, runtime processes are associated with events. In some embodiments, runtime processes are associated with events based on workload identifiers, identity objects, network security objects, combinations thereof, etc.

[0151] For example, in one embodiment, runtime data is received from sensors deployed on the workload. In another embodiment, the runtime data is generated by an application detected based on disk checks, or by the applications themselves, etc.

[0152] In some embodiments, runtime data includes a principal identifier detected in the code object where the workload is deployed. In embodiments, associating runtime processes with events includes detecting runtime processes, identity objects, workload identifiers, combinations thereof, etc., and storing this data as interconnected records in a secure database.

[0153] At position 890, an enriched log is generated. In one embodiment, an enriched log is generated that includes the identifier of the runtime process associated with the event. According to some embodiments, the identity matching the process is stored in a secure database. In some embodiments, the enriched log is generated based on a predetermined event type and sensor data, such that events from cloud logs are enriched based on sensor data using the process identifier of the workload. In one embodiment, the enriched log is further enriched by examining static analytics data detected by the workload's disk.

[0154] For example, in one embodiment, the sensor detects that a process named "Analyzer" is using the EC2 service and calls "EC2 Terminate Instance," which uses a machine role to perform an AWS API call.

[0155] In one embodiment, events are detected in cloud logs (e.g., using machine role identifiers) based on machine identifiers. In another embodiment, the machine identifier is used to search for code objects of the deployed machine in a security database.

[0156] In some embodiments, the code object is examined to detect whether the code includes the permission to terminate the instance. In some embodiments, if the code includes such a permission, no remedial action is initiated. In other embodiments, if the code does not include such a permission, a remedial action is initiated.

[0157] According to embodiments, remedial measures include generating alerts, generating support tickets, updating the severity of alerts, initializing workload checks, revoking access from subjects, revoking access from resources, revoking access to resources, and combinations thereof.

[0158] Figure 9 This is an example schematic diagram 900 of a check controller 122 according to an embodiment. According to the embodiment, the check controller 122 includes processing circuitry 910 coupled to a memory 920, a storage device 930, and a network interface 940. In this embodiment, components of the check controller 122 are communicatively connected via a bus 950.

[0159] In some embodiments, the processing circuitry 910 is implemented as one or more hardware logic components and circuits. For example, according to embodiments, exemplary types of hardware logic components include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), graphics processing units (GPUs), tensor processing units (TPUs), artificial intelligence (AI) accelerators, general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic component configured to perform computation or other information operations.

[0160] In some embodiments, memory 920 is volatile memory (e.g., random access memory, etc.), non-volatile memory (e.g., read-only memory, flash memory, etc.), or a combination thereof. In some embodiments, memory 920 is on-chip memory, off-chip memory, or a combination thereof. In some embodiments, memory 920 is temporary storage memory for processing circuitry 910.

[0161] In one configuration, software for implementing one or more embodiments disclosed herein is stored in storage device 930, memory 920, or combinations thereof. Software should be interpreted broadly as any type of instruction, whether referred to as software, firmware, middleware, microcode, hardware description language, or others. According to embodiments, instructions include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). According to embodiments, when executed by processing circuitry 910, the instructions cause processing circuitry 910 to perform the various processes described herein.

[0162] In some embodiments, storage device 930 is a magnetic storage device, an optical storage device, a solid-state storage device, a combination thereof, etc., and according to embodiments, storage device 930 is implemented as flash memory, a hard disk drive, another storage technology, various combinations thereof, or any other medium that can be used to store desired information.

[0163] According to an embodiment, network interface 940 is configured to provide inspection controller 122 with communication with, for example, IAM server 140.

[0164] It should be understood that the embodiments described herein are not limited to those described herein. Figure 9 The specific architecture shown can be used in other ways without departing from the scope of the disclosed embodiments.

[0165] Furthermore, in some embodiments, the inspector 124, policy engine 125, sensor backend 128, security database 126, and combinations thereof can be used. Figure 9 The architecture shown is used for implementation. In other embodiments, other architectures may be used equivalently without departing from the scope of the disclosed embodiments.

[0166] The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Furthermore, the software is preferably implemented as an application tangibly embodied in a program storage unit or computer-readable medium consisting of components or combinations of devices and / or devices. The application can be uploaded to and executed by a machine including any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware (e.g., one or more processing units (“PUs”), memory, and input / output interfaces). The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be part of the microinstruction code or part of the application, or any combination thereof, which can be executed by the PU, whether or not such a computer or processor is explicitly shown. Furthermore, various other peripheral units may be connected to the computer platform, such as additional data storage units and printing units. Additionally, a non-transitory computer-readable medium is any computer-readable medium other than transient propagating signals.

[0167] All examples and conditional language described herein are intended for educational purposes to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventors to further develop the art, and should be construed as not being limited to these specifically referenced examples and conditions. Furthermore, all statements regarding the principles, aspects, and embodiments of the disclosed embodiments, as well as specific examples thereof, are intended to cover their structural and functional equivalents. Moreover, such equivalents include both currently known equivalents and those developed in the future, i.e., any element developed that performs the same function, regardless of its structure.

[0168] It should be understood that any reference to elements using names such as "first," "second," etc., in this document does not generally limit the number or order of these elements. Rather, these names are generally used herein as a convenient way to distinguish two or more elements or instances of elements. Therefore, mentioning first and second elements does not mean that only two elements can be used there, nor does it mean that the first element must precede the second element in some way. Furthermore, unless otherwise stated, a group of elements includes one or more elements.

[0169] As used in this article, the phrase “at least one” is followed by a list of items, meaning that any one of the listed items can be used alone, or any combination of two or more of the listed items can be used. For example, if a system is described as including “at least one of A, B, and C”, then the system can include only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C, and so on.

Claims

1. A method for identifying cloud identity misuse based on runtime data and static analysis, comprising: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor application thereon, the sensor configured to detect respective data of runtime processes executing on the workload; detecting an original disk associated with the workload; generating an inspectable disk based on the original disk; inspecting a network security object in the inspectable disk with static analysis; detecting an event in a log of the cloud computing environment based on an identifier of the workload, the log comprising a plurality of events; inspecting an identity object in a code object used to deploy the workload in the cloud computing environment; associating the runtime process with the event based on the identity object, the network security object, and the identifier of the workload; and generating an enriched log comprising an identifier of the runtime process associated with the event.

2. The method of claim 1, further comprising: detecting an identifier of the network security object; and determining, based on the detected identifier, that the runtime process is executed based on software associated with the network security object.

3. The method of claim 1, further comprising: cloning the original disk into the inspectable disk; and releasing resources allocated to the inspectable disk in response to completing inspection of the inspectable disk.

4. The method of claim 1, further comprising: configuring the sensor to detect a cloud API call, the cloud API call comprising an identifier of the identity object.

5. The method of claim 1, further comprising: storing, in response to detecting the network security object on the inspectable disk, a representation of the workload, a representation of the identity, and a representation of the event in a security database.

6. The method of claim 1, further comprising: accessing an infrastructure as code (IaC) platform to detect the code object.

7. The method of claim 1, further comprising: further associating the runtime process with the event based on the detected runtime data.

8. The method of claim 1, further comprising: applying a network security policy to the enriched log.

9. The method of claim 8, further comprising: initiating a remediation measure in response to detecting that a condition of the applied network security policy caused a failure.

10. A non-transitory computer-readable medium storing a set of instructions for identifying cloud identity misuse based on runtime data and static analysis, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: detect a workload in a cloud computing environment; configure the workload to deploy a sensor application thereon, the sensor configured to detect respective data of runtime processes executing on the workload; detect an original disk associated with the workload; generate an inspectable disk based on the original disk; inspect a network security object in the inspectable disk with static analysis; ​ ​ ​ detecting, based on the identifier of the workload, an event in a log of the cloud computing environment, the log comprising a plurality of events; inspecting an identity object in a code object, the code object used to deploy the workload in the cloud computing environment; associating, based on the identity object, the network security object, and the identifier of the workload, the runtime process with the event; and generating an enriched log comprising the identifier of the runtime process associated with the event.

11. A system for identifying cloud identity misuse based on runtime data and static analysis, comprising: processing circuitry; memory, the memory comprising instructions that, when executed by the processing circuitry, configure the system to: detect a workload in a cloud computing environment; configure the workload to deploy a sensor application thereon, the sensor configured to detect respective data of runtime processes executing on the workload; detect an original disk associated with the workload; generate an inspectable disk based on the original disk; inspect, with static analysis, a network security object in the inspectable disk; detect, based on an identifier of the workload, an event in a log of the cloud computing environment, the log comprising a plurality of events; inspect an identity object in a code object, the code object used to deploy the workload in the cloud computing environment; associate, based on the identity object, the network security object, and the identifier of the workload, the runtime process with the event; and generate an enriched log comprising the identifier of the runtime process associated with the event.

12. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: detect an identifier of the network security object; and determine, based on the detected identifier, that the runtime process is executed based on software associated with the network security object.

13. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: clone the original disk into the inspectable disk; and release resources allocated to the inspectable disk in response to completing inspection of the inspectable disk.

14. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: configure the sensor to detect a cloud API call, the cloud API call comprising an identifier of the identity object.

15. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: store, in a security database, a representation of the workload, a representation of the identity, and a representation of the event in response to detecting the network security object on the inspectable disk.

16. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: access an infrastructure as code (IaC) platform to detect the code object.

17. The system of claim 11, wherein, the memory comprising further instructions that, when executed by the processing circuitry, further configure the system to: Based on the detected runtime data, the runtime process is further associated with the event.

18. The system of claim 11, wherein, The memory includes further instructions that, when executed by the processing circuitry, further configure the system to: apply a cybersecurity policy to the enriched log.

19. The system of claim 18, wherein, The memory includes further instructions that, when executed by the processing circuitry, further configure the system to: in response to detecting that a condition of the applied cybersecurity policy caused a failure, initiate a remediation measure.

Images