Cloud Code Reachability Mapping for Low-Impact Security Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Active scanning in cloud computing environments generates excessive network traffic and risks service disruptions, making it detrimental to production environments.
Innovation Solution
A system and method for active inspection of cloud environments that inspect only reachable code objects by generating network paths using static analysis, determining viability, and mapping resources to code objects for cybersecurity assessment and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active scanning is used to discover external attack surface, then vulnerability discovery capability is improved, but network traffic volume increases excessively
Solution Approach 1:
The system performs static analysis to pre-identify potential network paths and reachable code objects before conducting active inspection. This preliminary action filters out unreachable resources, so that subsequent active scanning only targets identified reachable objects, dramatically reducing overall network traffic while maintaining vulnerability discovery effectiveness
Solution Approach 2:
The system applies different inspection strategies to different code objects based on their reachability characteristics. Reachable code objects undergo active inspection with targeted network probes, while unreachable objects are excluded from active scanning. This localized approach concentrates network traffic only where necessary, reducing total traffic volume while preserving detection capability
2Measurement precision
If active scanning is used to test accessibility of network resources, then reachability detection accuracy is improved, but production environment stability deteriorates
Solution Approach 1:
The system performs static analysis beforehand to identify and filter unreachable code objects, creating a reduced set of targets for active inspection. This preliminary filtering ensures that active scanning probes are sent only to reachable resources, minimizing network traffic and preventing service disruptions to production environments while maintaining accurate reachability detection
Solution Approach 2:
The system performs active inspection only on the subset of code objects determined to be reachable through static analysis, rather than scanning all code objects. This partial action approach maintains high reachability detection accuracy for accessible resources while avoiding unnecessary network traffic that could disrupt production services
3Measurement precision
If comprehensive code inspection is performed on all code objects, then cybersecurity risk detection capability is improved, but inspection time increases
Solution Approach 1:
The system performs static analysis to pre-identify reachable code objects and map them to actual deployed resources before conducting security inspection. This preliminary action creates a filtered subset of reachable code objects that need inspection, eliminating unreachable objects from the inspection queue and significantly reducing total inspection time while maintaining comprehensive security coverage for accessible resources
Solution Approach 2:
The system applies security inspection selectively to reachable code objects identified through static analysis and mapping to deployed resources. Unreachable code objects are excluded from inspection since they cannot be accessed by external attackers. This localized inspection approach reduces total inspection time while maintaining high cybersecurity risk detection capability for accessible resources
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for performing inspection of a reachable code object of a cloud computing environment is presented. The method includes detecting a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment; determining reachability parameters of each resource of the plurality of resources for which a network path is detected; accessing a code repository including a plurality of code objects; actively inspecting the network path of a resource to determine if the network path is a viable network path; mapping each resource having a viable network path to a code object of the plurality of code objects; inspecting a mapped code object for a cybersecurity object; and initiating a remediation action based on the cybersecurity object.