Cloud Resource Data Flow Mapping for Exfiltration Risk Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data flow analysis tools are not well suited for cloud-based applications, often overinclusive in their reporting of risks, requiring manual review by security engineers and prone to human errors, especially in rapid development settings.
Innovation Solution
A code analysis system operates at the cloud-resource level, using API data to map cloud-level resource identifiers to source code, performing data flow analysis through taint analysis and concretization to trace data flows, and mapping cloud-level data sources and sinks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing data flow analysis tools are used for cloud-based applications, then data exfiltration risks can be identified, but the tools are overinclusive in their reporting, requiring manual review by security engineers
Solution Approach 1:
The patent introduces an intermediary layer that maps cloud-resource level identifiers to source code and performs concretization of cloud resources. This intermediary mapping layer enables precise tracking of data flows from specific cloud resources through the application code to destination resources, eliminating the overinclusiveness of traditional tools while maintaining automated analysis capability.
Solution Approach 2:
The analysis system segments the data flow tracking into distinct phases: cloud-resource level identification, mapping to source code, taint analysis through code paths, and mapping back to cloud resources. This segmentation allows the system to focus analysis on relevant portions of the codebase, improving precision without requiring complete manual review of all code.
2Reliability
If existing data flow analysis tools are used, then potential data exfiltration pathways can be detected, but manual review is required which is time-consuming and prone to human errors
Solution Approach 1:
The system performs self-service automated analysis by automatically mapping cloud-resource identifiers to source code, executing taint analysis to trace data flows, and generating results without human intervention. The concretization service automatically resolves cloud resource references, and the mapping services automatically connect cloud-level abstractions to code-level details, eliminating the need for manual review while maintaining high reliability.
Solution Approach 2:
The system incorporates feedback mechanisms where analysis results are automatically generated and can be used to refine the mapping between cloud resources and code. The automated tracking of data flows provides feedback on actual data exfiltration pathways, enabling continuous improvement of the analysis accuracy without requiring manual time investment.
3Productivity
If cloud-level data flow analysis is performed, then accurate automated analysis can be provided, but the system complexity increases due to mapping between cloud resources and source code
Solution Approach 1:
The mapping services perform multiple functions: they map cloud-resource identifiers to source code, track data flows between cloud resources, and generate analysis results. This multi-functionality reduces the need for separate specialized tools and manual processes, improving productivity despite the inherent complexity of the mapping operations.
Data Source
AI summary
Techniques for data flow analysis of cloud-based software applications are described. A first portion of source code of a software application is determined to obtain data from a data source identified by a first resource identifier of a cloud provider network, the determination based on a mapping of a first statement in the first portion of the source code to an application programming interface (API) call. A trace of a data flow from the first portion of the source code to a second portion of the source code is obtained. A data sink identified by a second resource identifier of the cloud provider network is determined based on a mapping of a second statement in the second portion of the source code to another API call. A result that includes an identification of a data flow from the data source identified by the first resource identifier to the data sink identified by the second resource identifier is generated.