Application Collocation by Resource Footprint to Reduce Attack Surface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security solutions fail to effectively prevent unauthorized access and attacks by focusing on individual host computers or applications, and are prone to circumvention due to high performance overhead and incomplete vulnerability scanning, missing certain vulnerabilities and allowing for privilege escalation and lateral movement attacks.
Innovation Solution
A method to measure and collocate applications with similar system resource utilization footprints on host computers, removing unused resources to reduce the attack surface, thereby enhancing security across a data processing environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If applications are colocated on host computers without selective grouping, then resource utilization improves, but attack surface increases due to unused system resources remaining accessible
Solution Approach 1:
The patent segments applications into groups based on their system resource utilization footprints. By measuring and comparing which system resources each application uses, the system creates distinct groups of applications with similar resource patterns. This segmentation allows for precise collocation where only applications with matching resource profiles are placed together, ensuring that unused system resources are minimized and the attack surface is reduced while maintaining high resource utilization.
2Reliability
If existing security solutions focus on individual host computers or applications using isolation and restriction, then security control improves, but system complexity and performance overhead increase
Solution Approach 1:
The patent implements a universal application collocation system that measures system resource utilization footprints once and uses this information for multiple purposes: security hardening, resource optimization, and attack surface reduction. By creating a multi-functional approach where the same measurement mechanism serves both security and efficiency goals, the system avoids the complexity of separate isolation and restriction mechanisms while achieving comparable or superior security control.
3Measurement precision
If vulnerability scanning is performed comprehensively on all applications and libraries, then detection coverage improves, but scanning accuracy decreases due to false positives and missed vulnerabilities
Solution Approach 1:
The patent applies local quality by tailoring security measurements to each application's specific resource utilization pattern. Instead of uniform vulnerability scanning across all applications, the system measures which system resources each application actually uses and groups them accordingly. This localized approach to security hardening focuses resources on the specific attack surfaces that each application group presents, improving both detection coverage and accuracy by avoiding generic scanning that produces false positives or misses application-specific vulnerabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Reducing attack surface by selectively collocating applications on host computers is provided. System resources utilized by each application running in a plurality of host computers of a data processing environment are measured. Which applications running in the plurality of host computers that utilize similar system resources are determined. Those applications utilizing similar system resources are collocated on respective host computers.