System and method for proxy-free application manifest detection

Abstract

A system and method for proxy-free generation of a software bill of materials (SBOM) in a cloud computing environment is disclosed. The method comprises the following steps: accessing a plurality of workloads in a cloud computing environment; detecting a disk associated with a workload of the plurality of workloads; generating a checkable disk based on a disk associated with the workload; checking the checkable disk for the software component; detecting a software component in the checkable disk; generating, for each workload, an SBOM based on the detected software component; and storing each SBOM in a database.

Description

Cross-references to related applications

[0001] This application is an international application of U.S. Patent Application No. 18 / 459,329, filed on August 31, 2023, the contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure generally relates to cybersecurity, and in particular to mitigating cybersecurity threats by generating an application inventory for cloud computing environments. Background Technology

[0003] Cloud computing environments, and computing environments in general, are the backbone of almost all human activities today. Whether supporting financial institutions, aviation data and information, entertainment, communications, or data storage, computing environments are ubiquitous.

[0004] As they create value, they also attract malicious actors who want to acquire that value for themselves. Valuable information, data, and computing resources such as processors and memory are sophisticated targets for attackers, and the field of cybersecurity has emerged to thwart their attempts.

[0005] Typically, internal vulnerabilities discovered in software applications and cloud services are accidental and can be exploited by malicious actors. For example, databases of such vulnerabilities are implemented as Common Vulnerabilities and Exposure (CVE) databases. This allows for the standardized resolution of known security flaws in computing environments.

[0006] However, knowing that a specific software application has a vulnerability or is exposed is not enough, because an organization may have deployed hundreds, thousands, or even hundreds of thousands of computing devices, virtualization systems, workloads, etc. Therefore, an organization needs not only to know that a specific software has a vulnerability, but also to know whether that software exists (or does not exist) in the organization's environment.

[0007] Therefore, having a software bill of materials (SBOM) is advantageous. An SBOM can include software dependencies, libraries, software component identifiers, etc. Thus, at least for this purpose, having an up-to-date SBOM is desirable.

[0008] Therefore, it would be beneficial to provide a solution that can overcome the above challenges. Summary of the Invention

[0009] The following is an overview of several exemplary embodiments of this disclosure. This overview is provided to facilitate the reader's basic understanding of these embodiments and does not fully limit the scope of this disclosure. This overview is not a comprehensive summary of all contemplated embodiments and is neither intended to identify key or essential elements of all embodiments nor to depict the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that follows. For convenience, the terms "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of this disclosure.

[0010] A system of one or more computers can be configured to perform specific operations or actions by installing software, firmware, hardware, or combinations thereof on the system, which, in operation, cause the system to perform actions. A system of one or more computer programs can be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, cause that device to perform actions.

[0011] In one general aspect, the method may include accessing multiple workloads in a cloud computing environment. The method may also include detecting software components within each of the multiple workloads. The method may further include generating a SBOM (Software Bill of Materials) for each workload based on the detected software components. The method may additionally include storing each SBOM in a database. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0012] Implementations may include one or more of the following features. Methods may include: detecting cloud services in a cloud computing environment; and storing identifiers of the cloud services in a SBOM. Methods may include: detecting disks associated with workloads among multiple workloads; generating an inspectable disk based on the disks associated with the workloads; and inspecting the inspectable disk for software components. Methods may include: generating an inspectable disk by any of the following: cloning the disk associated with the workload, generating a snapshot of the disk associated with the workload, generating a copy of the disk associated with the workload, or a combination thereof. Software components in the method are any of the following: software applications, libraries, binaries, dependencies, version settings, registry files, licenses, vendor identifiers, or any combination thereof. Methods may include: generating a first SBOM for a first workload at a first time; and generating a second SBOM for the first workload at a second time. Methods may include: detecting differences between the second SBOM and the first SBOM; and storing the first SBOM and the detected differences in a database. Methods may include: generating mitigation actions in response to the detected differences. Methods may include: generating a report based on the detected differences. The method may include: deleting a first SBOM from a database; and storing a second SBOM in place of the first SBOM in the database. The method may also include: receiving an identifier of a software component; generating a query based on the received identifier; and executing the generated query on the database. Implementations of the described technology may include hardware, methods or processes, or tangible computer media.

[0013] In one general aspect, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: access multiple workloads in a cloud computing environment. The medium may also detect software components within each of the multiple workloads. The medium may also generate a Single Module Name (SBOM) for each workload based on the detected software components. The medium may also store each SBOM in a database. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of these methods.

[0014] In one general aspect, the system may include processing circuitry. The system may also include memory containing instructions that, when executed by the processing circuitry, configure the system to access multiple workloads in a cloud computing environment. The system may further detect software components within each of the multiple workloads. The system may also generate a Single Module Name (SBOM) for each workload based on the detected software components. The system may also store each SBOM in a database. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of these methods.

[0015] The implementation may include one or more of the following features. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: detect cloud services in a cloud computing environment; and store the identifier of the cloud service in the SBOM. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: detect disks associated with workloads among multiple workloads; generate an inspectable disk based on the disks associated with the workloads; and inspect the inspectable disk for software components. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: generate an inspectable disk by: cloning the disk associated with the workload, generating a snapshot of the disk associated with the workload, generating a copy of the disk associated with the workload, and combinations thereof. The software components in the system are any of the following: software applications, libraries, binaries, dependencies, version settings, registry files, licenses, vendor identifiers, and any combination thereof. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: generate a first SBOM for a first workload at a first time; and generate a second SBOM for the first workload at a second time. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: detect a difference between the second SBOM and the first SBOM; and store the first SBOM and the detected difference in a database. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: generate a mitigation action in response to the detected difference. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: generate a report based on the detected difference. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: delete the first SBOM from the database; and store the second SBOM in place of the first SBOM in the database. The system memory contains further instructions, which, when executed by the processing circuitry, further configure the system to: receive an identifier of a software component; generate a query based on the received identifier; and execute the generated query on the database. Implementations of the described technology may include hardware, methods or processes, or tangible computer media. Attached Figure Description

[0016] The subject matter disclosed herein is specifically pointed out and explicitly claimed in the claims at the end of the specification. The above and other objects, features, and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0017] Figure 1 This is an example schematic diagram used to describe the computing and inspection environments of the embodiments.

[0018] Figure 2 This is an example schematic diagram of a software component inspector implemented according to an embodiment.

[0019] Figure 3 This is an example flowchart of a method for inspecting the disks of workloads deployed in a cloud computing environment, implemented according to an embodiment.

[0020] Figure 4 This is an example timing diagram used to describe the generation of an inspectable disk using disk cloning in an embodiment.

[0021] Figure 5 This is an example flowchart of a method for generating a software application inventory, implemented according to an embodiment.

[0022] Figure 6 This is an example schematic diagram of an SBOM generator according to an embodiment. Detailed Implementation

[0023] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the inventive teachings herein. Generally, the statements made in the specification of this application do not necessarily limit any of the various claimed embodiments. Furthermore, some statements may apply to some inventive features but not others. Generally, unless otherwise stated, singular elements may be plural, and vice versa, without loss of generality. In the drawings, the same reference numerals denote the same parts in several views.

[0024] Various disclosed embodiments include a method and system for generating a software inventory of a computing environment. In some embodiments, the computing environment is a cloud computing environment, and the software inventory includes cloud entities, cloud services, applications, devices, microservices, identities, and combinations thereof.

[0025] In this embodiment, the inventory is a software bill of materials (SBOM) generated based on a predefined data schema (such as SPDX, CycloneDX, PCE, etc.). In some embodiments, the predefined data schema includes multiple data fields, for example, stored as a JSON file. This is advantageous because it allows for searching objects in the inventory using database management services.

[0026] In some embodiments, an agentless approach is used to generate the inventory. Agentless approaches are superior to agent-based approaches, for example, because it eliminates the need to execute persistent software on every workload deployed in the computing environment. Such an agent would require processor and memory resources at the expense of workload.

[0027] Furthermore, when deploying new workloads in the environment, the agentless method can generate an inventory without installing an agent on the new workloads.

[0028] In embodiments, the inventory is generated by an inspector, an SBOM generator, etc., configured to detect software components, metadata, identifiers, and combinations thereof. For example, in embodiments, the inspector is configured to detect network security objects on the workload and is also configured to detect software components on the workload. In some embodiments, the workload is a virtual machine, a software container, a serverless function, and combinations thereof.

[0029] According to embodiments, it is advantageous for the inspector to generate the inventory, for example, by performing the inspection by creating an inspectable disk from a clone of a disk in the computing environment. As explained in more detail below, cloning a disk to perform the inspection and generate the inventory is advantageous because the cloned disk is immediately available, whereas a disk snapshot must be completed before accessing the snapshot. Therefore, inventory generation is performed faster because there is no need to wait for all the contents of the disk to be copied.

[0030] Furthermore, according to some embodiments, creating a disk clone reduces the total number of IOPS (I / Ooperations per second) in a cloud computing environment. This is because the disk's contents are copied offline to the clone, while providing immediate access to the clone's contents by providing a pointer from the clone disk to the original disk's contents. Therefore, if a check is performed before the disk is copied, the cloned disk can be freed up without needing to allocate storage resources for it.

[0031] In some embodiments, the SBOM is generated periodically and includes a version number (e.g., a timestamp). In some embodiments, the entire SBOM is stored on a database. In some embodiments, the SBOM is generated and stored on the database at a first time, and a second SBOM is generated at a second time. In some embodiments, a difference is generated between the second SBOM and the first SBOM, such that the difference includes identifiers, metadata, etc., that are detected in the second SBOM but not in the first SBOM.

[0032] In such an embodiment, the first SBOM is stored, and the difference between the second SBOM and the first SBOM is stored, so that the second SBOM does not need to be fully stored.

[0033] Figure 1 This is an example schematic diagram 100 used to describe the computing and inspection environments of an embodiment. In an embodiment, the cloud computing environment 110 is implemented as, for example, a virtual private cloud (VPC), a virtual network (VNet), or a combination thereof. In some embodiments, the cloud computing environment is deployed on cloud computing infrastructure. Examples of cloud computing infrastructure include Amazon® Web Services (AWS), Google® Cloud Platform (GCP), Microsoft® Azure, etc. In some embodiments, the computing environment 110 is a hybrid environment, including a cloud computing environment and a local network computing environment.

[0034] In this embodiment, the cloud computing environment 110 includes multiple resources and entities. In some embodiments, resources are entities in the computing environment, such as virtual machines, bare metal, software containers, serverless functions, cloud services, configured computing resources (e.g., processors, memory, storage devices, and combinations thereof), workloads, and combinations thereof.

[0035] In some embodiments, a subject is an entity in a computing environment that is authorized to initiate actions, manipulate resources, assume the roles of another subject, or combinations thereof, within the computing environment. In embodiments, subjects may be, for example, user accounts, service accounts, roles, or combinations thereof.

[0036] For example, in one embodiment, the cloud computing environment 110 includes a virtual machine 112, a software container 114, and a serverless function 116. In some embodiments, the serverless function 116 is implemented as Amazon® Lambda. In another embodiment, the software container 114 is implemented using the Docker® engine, the Kubernetes® platform, or a combination thereof.

[0037] In this embodiment, virtual machine 112 is implemented using Oracle® VirtualBox®. In some embodiments, disk 113 is configured for virtual machine 112, for example, by configuring physical storage addresses and mapping each physical storage address to a virtual storage address, and then configuring the virtual storage address to virtual machine 112. In some embodiments, multiple disks are configured for virtual machine 112.

[0038] In some embodiments, the cloud computing environment 110 is monitored by an inspection environment 120, which is configured to detect network security objects, network security threats, vulnerabilities, exposures, misconfigurations, and combinations thereof. In embodiments, the inspection environment 120 is also configured to detect software components, such as software applications, libraries, binaries, binary versions, dependencies, version settings, registry files, licenses, vendor identifiers, operating system (OS) packages, open-source libraries, and combinations thereof.

[0039] In some embodiments, the inspection environment 120 is implemented as a cloud computing environment. In some embodiments, the inspection environment 120, a portion thereof, etc., is implemented in a cloud computing environment 110.

[0040] In some embodiments, the inspection environment 120 includes an inspector 122, a unified extractor 124, and workloads (such as virtual machines 126, etc.). In some embodiments, the inspector 122 is implemented as a workload, multiple workloads, etc., configured to detect network security objects, network security threats, vulnerabilities, exposures, misconfigurations, software components, software applications, libraries, binaries, binary versions, dependencies, version settings, registry files, licenses, vendor identifiers, operating system (OS) packages, open source libraries, and combinations thereof.

[0041] In some embodiments, the unified extractor 124 is configured to extract network security objects, etc., from each of a plurality of workloads for inspection by an inspector. In some embodiments, the plurality of workloads include virtual machines, software containers, serverless functions, and combinations thereof. In some embodiments, the unified extractor 124 is configured to extract data from the workloads and store the data (e.g., based on a predefined data pattern) in a database 125.

[0042] In some embodiments, database 125 is implemented as a graph database. In such embodiments, the data schema includes, for example, data schemas, data templates, etc., for various entities in the computing environment. For example, in one embodiment, the data schema includes a data template based on which representations of entities deployed in cloud computing environment 110 are generated in database 125.

[0043] In some embodiments, database 125 is a graph database (such as Neo4j®), and entities such as resources and principals are represented as nodes in the graph database. This is advantageous because a more compact representation can be achieved by having a unified data template, data schema, etc., to represent various cloud computing environments. For example, instead of storing a first data template for virtual machines and a second data template for serverless functions, a single data template can be used to represent resources.

[0044] Furthermore, in some embodiments, it is also advantageous to use a single data schema to represent each different cloud computing environment (e.g., AWS, GCP, etc.) when deploying and representing multiple cloud computing environments. This reduces the number of data schemas, data templates, etc., required to represent computing environments, and further allows for the use of unified instructions to manipulate these representations, rather than requiring the generation of different instructions for different types of data structures.

[0045] In some embodiments, the data template, data pattern, etc., includes multiple data fields. Each data field is populated with data (i.e., data values), which, according to an embodiment, are extracted, for example, by a unified extractor 124.

[0046] In some embodiments, virtual machine 126 (or other workload) is started, configured, etc. In some embodiments, disk 127 is allocated to virtual machine 126. In some embodiments, disk 127 is an inspectable disk. In some embodiments, this disk is created by cloning disk 113 of virtual machine 112 in cloud computing environment 110.

[0047] For example, in one embodiment, a clone of disk 113 is generated in the inspection environment 120, the cloud computing environment 110, etc., as disk 127. In some embodiments, the inspectable disk 127 is generated using snapshots, disk copies, disk clones, and combinations thereof. In some embodiments, disk cloning is advantageous because cloning a disk uses fewer computing resources than, for example, generating a snapshot. For example, on some cloud infrastructure platforms (such as Microsoft® Azure), generating a snapshot requires storing the snapshot in the storage of the cloud computing environment. However, in this embodiment, generating a disk clone generates pointers to the same data, so the data is not copied, thus requiring less storage.

[0048] In this embodiment, inspector 122 is configured to inspect network security objects, network security threats, vulnerabilities, exposures, misconfigurations, software components, software applications, libraries, binary files, binary versions, dependencies, version settings, registry files, licenses, vendor identifiers, operating system (OS) packages, open source libraries and combinations thereof in inspectable disk 127.

[0049] Figure 2 This is an example schematic diagram of a software component inspector implemented according to an embodiment. In some embodiments, the inspector is a unified inspector configured to inspect multiple types of workloads.

[0050] In some embodiments, the unified extractor 240 is configured to access multiple resources. In some embodiments, the unified extractor 240 is configured to read data from virtual machines 250, software containers 260, serverless functions 270, and combinations thereof. In some embodiments, the unified extractor 240 is configured to extract data from various workloads and store the extracted data in the abstraction layer 230.

[0051] In some embodiments, the abstraction layer 230 is generated based on data patterns, data templates, and combinations thereof. For example, in one embodiment, the abstraction layer 230 includes data extracted from multiple different resources and stored based on a shared data pattern, such as data stored in a database (e.g., a graph database).

[0052] In some embodiments, multiple inspectors (such as inspector 210 and inspector 220) are configured to read data from abstraction layer 230 and detect predefined objects, predefined code, predefined software components and combinations thereof.

[0053] In some embodiments, an inspector (such as inspector 210) is configured to inspect abstraction layer 230, inspectable disks, and combinations thereof. In some embodiments, inspector 210 is configured to inspect inspectable disks, such as disks cloned from a source disk, wherein the source disk is deployed in a cloud computing environment.

[0054] In some embodiments, inspector 210 is configured to detect various software components (such as those detailed above) and store an identifier for each software component. In embodiments, the identifier for each software component is stored together with the identifier for the workload in a database, abstraction layer 230, or a combination thereof.

[0055] In some embodiments, multiple identifiers (each corresponding to a software component) are used to generate a software bill of materials (SBOM). In some embodiments, the multiple identifiers are stored in a standard format (such as SPDX, CycloneDX, CPE, etc.). In some embodiments, the standard format is represented in JSON data schema, XML data schema, protocol buffers, and combinations thereof.

[0056] In an embodiment, the SBOM also includes cloud services, microservices, devices, applications, code objects, infrastructure (i.e., code files), orchestration instructions, and combinations thereof detected in a cloud computing environment, for example by an inspector configured to detect them in this way.

[0057] Figure 3 This is an example flowchart of a method for inspecting the disks of workloads deployed in a cloud computing environment, implemented according to an embodiment.

[0058] At S310, the workload is accessed. In this embodiment, the workload is deployed in a computing environment. In some embodiments, multiple workloads are deployed in a computing environment. In this embodiment, the computing environment is a cloud computing environment deployed on cloud computing infrastructure, a local environment deployed as a physical network, a hybrid computing environment, or a combination thereof.

[0059] In some embodiments, workloads are resources deployed in a cloud computing environment. For example, according to an embodiment, workloads are virtual machines, software containers, serverless functions, and combinations thereof.

[0060] In some embodiments, the inspection controller is configured to initiate access to a workload. In some embodiments, the inspection controller is configured to assume roles, service accounts, etc., of the workload in the computing environment where the accessed workload is deployed.

[0061] At S320, the disk is detected. In an embodiment, the disk is detected by accessing the workload and determining that the workload has a disk configured. For example, in an embodiment, the disk is configured for the software container by generating a persistent volume claim (PVC). In an embodiment, in response to receiving a PVC, storage is configured for the software container, for example by generating a persistent volume (PV) and allocating the PV.

[0062] In some embodiments, a disk is associated with a virtual machine. In certain embodiments, the disk associated with the virtual machine includes multiple virtual addresses, each mapped to a physical address, such as a physical address for block storage. In some embodiments, multi-tiered virtualization is used, such that a first virtual address points to a second virtual address, and so on, until the penultimate virtual address points to a physical address.

[0063] At S330, an inspectable disk is generated. In some embodiments, the inspectable disk is generated based on the detected disk. In some embodiments, the inspectable disk is generated in the same computing environment as the detected disk. In some embodiments, the inspectable disk is generated in a different computing environment than the detected disk.

[0064] In one embodiment, an inspectable disk is generated by initiating a clone of the detected disk. For example, in another embodiment, disk cloning is initiated by executing instructions in a cloud computing environment that generate a pointer to the original disk.

[0065] In some embodiments, cloud computing environments, cloud computing infrastructure, etc., are configured to copy the contents of the detected disk to the cloned disk after a period of time following the initiation of disk cloning. According to an embodiment, to provide immediate access to the data, a pointer is generated that allows access to the cloned disk.

[0066] In some embodiments, once all data has been copied to the cloned disk, the pointer is reconfigured to point to the copied disk, which is now the cloned disk. However, according to an embodiment, a check on the cloned disk is performed before the copying is complete, thereby allowing the resources of the copied disk to be released.

[0067] At S340, an inspection is initiated. In this embodiment, the inspection is initiated for an inspectable disk. In some embodiments, the inspectable disk is inspected by an inspector configured to detect network security objects, network security threats, vulnerabilities, exposures, misconfigurations, software components, software applications, libraries, binaries, binary versions, dependencies, version settings, registry files, licenses, vendor identifiers, operating system (OS) packages, open source libraries, and combinations thereof.

[0068] In some embodiments, network security objects are, for example, hash values, code objects, passwords, certificates, encryption keys, signatures generated from software code, and combinations thereof.

[0069] In some embodiments, inspecting an inspectable disk includes detecting identifiers, metadata, etc., of software components. In some embodiments, identifiers, metadata, and combinations thereof are stored based on a predefined data schema (e.g., SPDX) to generate SBOMs, software manifests, and combinations thereof.

[0070] Figure 4 This is an example timing diagram used to describe the generation of an inspectable disk using disk cloning in an embodiment. According to the embodiment, disk 430 is cloned at a first time (time 1). In the embodiment, disk 430 is associated with, configured to, and so on, a virtual machine 410. In some embodiments, virtual machine 410 is deployed in a cloud computing environment.

[0071] In some embodiments, disk 430 includes a plurality of virtual addresses, such that each virtual address is assigned a physical address of storage 440, such as a point to a physical storage block.

[0072] In this embodiment, a cloned disk is generated by generating pointer 450, which points to the storage address of storage 440. By pointing pointer 450 to storage 440, the cloned disk becomes immediately accessible.

[0073] In one embodiment, virtual machine 410 is configured to continuously write to disk 430. In such an embodiment, disk 430 is configured to store certain disk operations (such as disk writes as differences, i.e., dissimilar ones) in difference storage 435.

[0074] This is advantageous because it allows virtual machine 410 to continuously write to and otherwise access the disk while maintaining data during the cloning of disk 430 (i.e., time 1). In other words, according to the embodiment, when inspector 420 is configured to inspect the cloned disk, inspector 420 is configured to access the cloned disk via clone pointer 450, which allows access to data present on the disk at the time of cloning.

[0075] However, when virtual machine 410 accesses disk 430, it also accesses differential storage 435, which allows virtual machine 410 to always see the latest data on disk 430.

[0076] In some embodiments, data stored on disk 430 at cloning time (time 1) is copied to clone storage 455. In some embodiments, data copying occurs over a period of time. This is advantageous because it allows IOPS (operations per second) to be distributed over time in environments such as cloud computing, which is particularly advantageous in some cloud computing infrastructures that include IOPS limitations.

[0077] Therefore, according to an embodiment, at the second time point (time 2), the clone pointer 450 points to the clone storage 455. In some embodiments, once all data from the disk 430 from the first time point (time 1) has been cloned into the clone storage 455, the clone pointer 450 is configured to point to the clone storage 455.

[0078] In some embodiments, once cloning is complete, storage 440 and differential storage 435 are merged into merged storage 460. At this point, cloned storage 455 and merged storage 460 are completely separated from each other.

[0079] Disk cloning is advantageous because it allows the inspector to examine the cloned disk via clone pointer 450, while data from the original disk 430 is still being copied to the actual cloned disk. In this embodiment, the cloned disk is released if the inspection is completed before a second time (time 2). This allows for a reduction in IOPS by not having to copy the entire contents of the original disk 430.

[0080] Figure 5 This is an example flowchart of a method for generating a software application inventory, implemented according to an embodiment.

[0081] At S510, multiple workloads are accessed. In this embodiment, the multiple workloads are deployed in a cloud computing environment, a local environment, a hybrid environment, or a combination thereof.

[0082] In some embodiments, the workload is a resource, such as a virtual machine, a software container, a serverless function, or a combination thereof.

[0083] In an embodiment, accessing a workload includes initiating an inspection of the workload. For example, according to an embodiment, initiating an inspection of a workload includes generating an inspectable disk based on disks, storage, and combinations thereof.

[0084] In an embodiment, the disk includes storage configured for workloads, such as storage addresses allocated to virtual machines, persistent volumes allocated through persistent volume declarations using software containers, and combinations thereof.

[0085] In some embodiments, each of a plurality of workloads may be accessed periodically. In some embodiments, workloads may be accessed based on predefined time intervals (e.g., every hour, every 12 hours, once a day, etc.).

[0086] At S520, software components are detected. In this embodiment, a software component is any of the following: a software application, a library, a binary file, a binary version, a dependency, a version setting, a registry file, a license, a vendor identifier, an operating system (OS) package, an open-source library, or a combination thereof.

[0087] In some embodiments, metadata of the software component is also detected. According to embodiments, metadata includes version identifiers, source identifiers, author identifiers, and combinations thereof.

[0088] According to an embodiment, software components are detected by an inspector configured to detect specific software components, multiple software components, cybersecurity objects, cybersecurity threats, and combinations thereof.

[0089] In some embodiments, the inspector is configured to detect software components of a predetermined type (e.g., an operating system). In other embodiments, the inspector is configured to detect software components of a predetermined type (e.g., an operating system) from a predetermined type of workload (e.g., a virtual machine).

[0090] At S530, a manifest is generated. In an embodiment, the manifest is an SBOM (i.e., a software bill of materials). In some embodiments, the SBOM is stored based on a predetermined data schema (e.g., based on a JSON data schema, an XML data schema, etc.). In some embodiments, the data schema is specified by standards such as SPDX, CycloneDX, PDE, etc.

[0091] In some embodiments, the inventory, SBOM, etc., are stored on a database. In some embodiments, the database is a columnar database, a relational database, etc. In embodiments, the inspector is also configured to inspect cloud entities, identities, cloud services, combinations thereof, their metadata, etc. In such embodiments, the SBOM also includes discovery results generated based on the inspector's detection.

[0092] In some embodiments, the manifest includes a version number. For example, in some embodiments, the version number is a timestamp. In some embodiments, the SBOM, manifest, etc., are generated at a first time and a second time after the first time. In some embodiments, SBOM differences are stored, including findings (e.g., software components) that were detected at the second time but not at the first time.

[0093] According to an embodiment, this is advantageous because it allows for a reduction in the amount of storage required to store information generated from multiple SBOM checks. Therefore, according to an embodiment, duplicate data is stored, for example, only once.

[0094] In some embodiments, the SBOM difference includes a version number, such as a timestamp. In some embodiments, the SBOM is generated at a first time, the SBOM difference is generated at a second time (after the first time), and another SBOM is generated at a third time (after the second time). In some embodiments, the storage of the SBOM is alternated, storing the entire SBOM in one time interval and the difference in a later time interval.

[0095] According to an embodiment, the SBOM is stored in a searchable database. In some embodiments, the database includes controls. In an embodiment, the controls are predefined strategies, queries, and combinations thereof. For example, in an embodiment, the controls include queries for detecting predetermined software component types. In an embodiment, a strategy is applied to a query such that when a query is executed on the database storing the SBOM and the result returns true (or a value other than false, null, etc.), an action is initiated.

[0096] In this embodiment, the action is a mitigation action. For example, according to an embodiment, the mitigation action includes: generating a notification, isolating a workload corresponding to an identifier received as a result of executing a query, sandboxing the workload, revoking access to the workload, revoking access from the workload, and combinations thereof. In some embodiments, the mitigation action includes generating an alert, generating a severity score for the alert, and updating the severity score of an existing alert.

[0097] In some embodiments, the SBOM database is queried periodically based on queries generated from vulnerability databases such as Common Vulnerabilities and Exposure (CVE) databases. For example, in one embodiment, a CVE entry includes a software identifier. In another embodiment, the software identifier of the CVE entry is used in queries against a database (that stores the SBOM of a cloud computing environment).

[0098] In some embodiments, the query is configured to return the identifier of the workload (the software component deployed with the software identifier corresponding to the CVE entry) as the result. This is advantageous because it allows for the efficient detection of cybersecurity threats.

[0099] Furthermore, having an up-to-date SBOM helps meet certain requirements. For example, it is beneficial for governments to require vendors to demonstrate their SBOM to enhance the security of the software supply chain, as this allows for a rapid response to incidents such as the 2019 SolarWinds® hack.

[0100] Figure 6 This is an example schematic diagram of an SBOM generator according to an embodiment. In this embodiment, the SBOM generator 600 is implemented as an inspector workload, as detailed above. In this embodiment, the SBOM generator 600 is configured to generate manifests, SBOMs, etc.

[0101] The SBOM generator 600 includes processing circuitry 610 coupled to a memory 620, a storage device 630, and a network interface 640. In an embodiment, components of the SBOM generator 600 may be communicatively connected via a bus 650.

[0102] The processing circuit 610 can be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that can be used include: field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and any other hardware logic component capable of performing computations or other information operations.

[0103] Memory 620 may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read-only memory, flash memory, etc.), or a combination thereof. In embodiments, memory 620 is on-chip memory, off-chip memory, or a combination thereof. In some embodiments, memory 620 is a note-taking memory of processing circuitry 610.

[0104] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 630, memory 620, and combinations thereof. Software should be interpreted broadly to mean any type of instruction, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuitry 610, the instructions cause processing circuitry 610 to perform the various processes described herein.

[0105] Storage device 630 is a magnetic storage device, an optical storage device, a solid-state storage device, or a combination thereof, and according to embodiments, it is implemented as: flash memory, hard disk drive or other memory technology, or any other medium that can be used to store desired information.

[0106] Network interface 640 is configured to provide communication to SBOM generator 600 with, for example, inspector 122, virtual machine 126, database 125, etc.

[0107] It should be understood that the embodiments described herein are not limited to those described herein. Figure 6 The specific architecture shown is applicable, and other architectures may be used equivalently without departing from the scope of the disclosed embodiments.

[0108] The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Furthermore, the software is preferably implemented as an application program tangibly embodied in a program storage unit or computer-readable medium, which comprises components or combinations of devices and / or devices. The application program can be uploaded to and executed by a machine including any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more processing units (“CPUs”), memory, and input / output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be part of the microinstruction code or part of an application program, or any combination thereof, which can be executed by the CPU, whether or not such a computer or processor is explicitly shown. Furthermore, various other peripheral units can be connected to the computer platform, such as additional data storage units and printing units. Additionally, a non-transitory computer-readable medium is any computer-readable medium other than a transient propagation signal.

[0109] All examples and conditional language listed herein are intended for pedagogical purposes to aid the reader in understanding the principles of the disclosed embodiments and the concepts contributed by the inventors to the field, and are to be construed as not being limited to such specifically enumerated examples and conditions. Furthermore, all statements regarding the principles, aspects, and embodiments of the disclosed embodiments listed herein, together with their specific examples, are intended to cover both their structural and functional equivalents. Moreover, it is intended that such equivalents include both currently known equivalents and those developed in the future, i.e., any developed element that performs the same function regardless of its structure.

[0110] It should be understood that any reference to elements in this document using names such as "first," "second," etc., does not generally limit the number or order of these elements. Rather, these names are generally used herein as a convenient way to distinguish between two or more elements or instances of elements. Thus, references to first and second elements do not imply that only two elements can be used there, or that the first element must somehow precede the second element. Furthermore, unless otherwise stated, a group of elements includes one or more elements.

[0111] As used herein, the phrase “at least one of…” followed by a series of items means that any one of the listed items may be used alone, or any combination of two or more of the listed items may be used. For example, if a system is described as including “at least one of A, B, and C”, then the system may include: only A; only B; only C; 2 A; 2 B; 2 C; 3 A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2 A and C; a combination of A, 3 B, and 2 C; and so on.

Claims

1. A method for agentless generation of a Software Bill of Materials (SBOM) in a cloud computing environment, comprising: Access multiple workloads in a cloud computing environment; Detect the disks associated with the workloads among the plurality of workloads; An inspectable disk is generated based on the disk associated with the workload; The checkable disk is inspected for software components; Detect the software components in the inspectable disk; For each workload, an SBOM is generated based on the detected software components; as well as Each SBOM is stored in the database.

2. The method according to claim 1, further comprising: Detect cloud services in the cloud computing environment; as well as The identifier of the cloud service is stored in the SBOM.

3. The method according to claim 1, further comprising: The inspectable disk is generated by any of the following: cloning the disk associated with the workload, generating a snapshot of the disk associated with the workload, generating a copy of the disk associated with the workload, or a combination thereof.

4. The method according to claim 1, wherein, The software component is any of the following: software application, library, binary file, dependency, version settings, registry file, license, vendor identifier, and any combination thereof.

5. The method of claim 1, further comprising: Generate the first SBOM for the first workload as soon as possible; as well as A second SBOM is generated for the first workload at a second time.

6. The method of claim 5, further comprising: Detect the difference between the second SBOM and the first SBOM; as well as The first SBOM and the detected differences are stored in the database.

7. The method of claim 6, further comprising: In response to the detection of the difference, a mitigation action is generated.

8. The method of claim 6, further comprising: A report is generated based on the detected differences.

9. The method of claim 5, further comprising: Delete the first SBOM from the database; as well as The second SBOM is stored in the database, replacing the first SBOM.

10. The method of claim 1, further comprising: Receives the identifier of the software component; Generate a query based on the received identifier; as well as Execute the generated query on the database.

11. A non-transitory computer-readable medium storing a set of instructions for agentless generation of a Software Bill of Materials (SBOM) in a cloud computing environment, the set of instructions comprising: One or more instructions, which, when executed by one or more processors of the device, cause the device to: Access multiple workloads in a cloud computing environment; Detect the disks associated with the workloads among the plurality of workloads; An inspectable disk is generated based on the disk associated with the workload; The checkable disk is inspected for software components; Detect the software components in the inspectable disk; For each workload, an SBOM is generated based on the detected software components; as well as Each SBOM is stored in the database.

12. A system for agentless generation of Software Bill of Materials (SBOM) in a cloud computing environment, comprising: Processing circuitry; as well as A memory containing instructions that, when executed by the processing circuitry, configure the system to: Access multiple workloads in a cloud computing environment; Detect the disks associated with the workloads among the plurality of workloads; An inspectable disk is generated based on the disk associated with the workload; The checkable disk is inspected for software components; Detect the software components in the inspectable disk; For each workload, an SBOM is generated based on the detected software components; as well as Each SBOM is stored in the database.

13. The system according to claim 12, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Detect cloud services in the cloud computing environment; and The identifier of the cloud service is stored in the SBOM.

14. The system according to claim 12, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: The inspectable disk is generated by any of the following: Cloning the disk associated with the workload, creating a snapshot of the disk associated with the workload, creating a copy of the disk associated with the workload, and combinations thereof.

15. The system according to claim 12, wherein, The software component is any one of the following: Software applications, libraries, binaries, dependencies, version settings, registry files, licenses, vendor identifiers, and any combination thereof.

16. The system according to claim 12, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Generate the first SBOM for the first workload at the first time; and A second SBOM is generated for the first workload at a second time.

17. The system according to claim 16, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Detect the difference between the second SBOM and the first SBOM; and The first SBOM and the detected differences are stored in the database.

18. The system according to claim 17, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: In response to the detection of the difference, a mitigation action is generated.

19. The system according to claim 18, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: A report is generated based on the detected differences.

20. The system according to claim 18, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Delete the first SBOM from the database; and The second SBOM is stored in the database, replacing the first SBOM.

21. The system according to claim 12, wherein, The memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Receives the identifier of the software component; Generate a query based on the received identifier; and Execute the generated query on the database.

Images