Cloud Application Path Inspection Using Security Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing active scanning methods for detecting vulnerabilities in cloud environments generate excessive network traffic and risk service disruptions, providing incomplete information about accessible paths and vulnerabilities.
Innovation Solution
A method and system for actively inspecting network paths in cloud environments using static analysis to determine reachable resources and applications, generating access instructions, and validating network paths for accessibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active scanning is used to discover external attack surface, then vulnerability detection capability is improved, but network traffic volume increases and service reliability deteriorates
Solution Approach 1:
The system performs preliminary actions by obtaining cloud environment configuration information and constructing a security graph before active inspection, allowing it to pre-identify potential attack paths and resources. This preliminary mapping enables targeted inspection that avoids random scanning and reduces unnecessary network traffic.
Solution Approach 2:
The patent introduces an intermediary security graph that models cloud resources, network paths, and access relationships. This security graph acts as a mediator between the inspection system and the actual cloud environment, enabling indirect analysis that reduces direct network traffic and minimizes disruption to production services.
2Loss of information
If active scanning attempts random domains and ports, then path discovery capability is improved, but network resource consumption increases
Solution Approach 1:
The system performs preliminary action by constructing a security graph from cloud configuration information that maps known resources and their access paths. This pre-established knowledge base guides subsequent active inspection, eliminating the need for random domain and port scanning while maintaining comprehensive path discovery capability.
Solution Approach 2:
The system uses feedback from the security graph construction phase to inform and guide the active inspection phase. By analyzing the constructed security graph, the system identifies specific resources and paths that require inspection, creating a feedback loop that optimizes network resource usage by focusing efforts only where vulnerabilities are most likely to exist.
3Measurement precision
If comprehensive active inspection is performed on all network paths, then vulnerability detection accuracy is improved, but inspection time increases
Solution Approach 1:
The patent segments the cloud environment into discrete resources and network paths represented in the security graph. This segmentation allows the inspection system to divide and conquer the inspection task, focusing on specific resources and their associated paths rather than performing blanket inspection of all possible network destinations, thereby reducing overall inspection time.
Solution Approach 2:
The system performs partial action by conducting active inspection only on network paths and resources identified through security graph analysis, rather than inspecting all possible paths. This selective approach maintains vulnerability detection accuracy for critical paths while significantly reducing inspection time by excluding paths that are unlikely to be vulnerable based on the security graph model.
Data Source
AI summary
A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.