Cloud Workload Runtime Sensors for Identity Misuse Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity misuse in cloud computing environments poses significant risks, including unauthorized access to sensitive information, cybercrimes, and erosion of trust in digital systems, necessitating robust security measures to protect against malicious use of identities.
Innovation Solution
A system is configured to deploy sensors in cloud workloads to detect runtime processes, inspect code objects for cybersecurity objects, and generate enriched logs associating runtime processes with events, using identity management systems to identify and mitigate potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity management systems are used in cloud computing environments, then basic authentication is provided, but they cannot detect or prevent runtime identity misuse
Solution Approach 1:
The system performs preliminary actions by injecting sensors into workloads before runtime identity misuse can occur. These sensors proactively monitor and detect identity usage patterns, allowing the system to identify and respond to potential security threats before they result in actual damage. This aligns with the patent's approach of deploying monitoring infrastructure in advance within cloud workloads.
Solution Approach 2:
The patent introduces an intermediary layer consisting of sensors and security agents that bridge the gap between traditional identity management systems and runtime processes. These intermediaries monitor identity usage without disrupting normal operations, enabling detection of misuse while maintaining system performance. The sensors act as mediators between the identity provider and the workload executing with those identities.
2Measurement precision
If comprehensive monitoring of runtime processes is implemented, then identity misuse can be detected, but system performance and resource consumption increase
Solution Approach 1:
The system applies partial monitoring by focusing sensors on specific critical operations and identity-related events rather than monitoring all processes comprehensively. This selective approach maintains detection accuracy for security-relevant activities while reducing overall computational overhead. The sensors prioritize monitoring of authentication events, privilege escalations, and unusual access patterns.
Solution Approach 2:
The monitoring system is designed to be self-service by leveraging existing cloud infrastructure and logging mechanisms. Sensors utilize already-available process information and system events, reducing the need for additional computational resources. The system serves itself by automatically correlating events and generating security insights without requiring extensive external processing power.
3Loss of information
If detailed logging of all events is performed, then security analysis is enhanced, but data volume and storage requirements increase
Solution Approach 1:
The system extracts only the most security-relevant information from runtime events rather than logging all generated data. Sensors identify and extract critical fields such as identity identifiers, access outcomes, and anomaly indicators, discarding redundant information. This extraction approach maintains comprehensive security coverage while significantly reducing the volume of data requiring storage and analysis.
Solution Approach 2:
Event filtering and enrichment are performed preliminarily at the source before data is stored or transmitted for analysis. The system pre-processes events by tagging them with security-relevant metadata and filtering out non-critical information upfront. This preliminary action reduces downstream data processing requirements and minimizes storage needs while preserving all information necessary for security investigations.
4Difficulty of detecting and measuring
If runtime process monitoring is added to traditional security measures, then detection capability is improved, but operational complexity increases
Solution Approach 1:
The patent merges runtime process monitoring capabilities with existing identity management and cloud security infrastructure. Sensors are integrated into standard workload deployment processes, and monitoring data is consolidated with existing security logs and event streams. This merging approach improves detection capability while avoiding the need for separate, complex operational systems.
Solution Approach 2:
The monitoring system is designed with multi-functionality to handle multiple security tasks through a single unified platform. Sensors can detect various types of identity misuse, generate enriched logs, and provide alerts across different cloud environments and workload types. This universal approach simplifies operations by providing comprehensive security monitoring through one system rather than multiple specialized tools.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for associating an event in a cloud computing log to a process running on a workload is presented. The method includes: configuring a workload deployed in a cloud computing environment to deploy thereon a sensor, the sensor configured to detect a runtime process on the workload, the runtime process utilizing an identity; detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspecting a code object for a cybersecurity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on an identifier of the workload and the cybersecurity object, wherein the cybersecurity object indicates the identity; and generating an enriched log including an identifier of the runtime process associated with the event and the cybersecurity object.