Automated Cloud Vulnerability Hotspot Discovery via API Resilience Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for evaluating the resilience of cloud-based systems are inadequate as they fail to identify unknown resources and analyze unknown or partially known networks, leading to vulnerabilities that can cause failures and outages.
Innovation Solution
A system and method that utilize API calls to automatically discover network elements and analyze resilience based on discovered resources, without requiring predefined network architectures, thereby identifying vulnerability hotspots and generating resource mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If predefined network architectures are used for resilience evaluation, then the evaluation process is simplified and faster, but unknown resources and partially known networks cannot be identified, leading to vulnerability hotspots being missed
Solution Approach 1:
The system performs preliminary automatic discovery of network elements and resources before conducting resilience evaluation. By using API calls to pre-fetch and store network topology and resource information, the system prepares comprehensive data about unknown resources in advance, ensuring that subsequent vulnerability assessments cover all resources including previously unidentified ones, thus resolving the contradiction between evaluation speed and detection accuracy.
2Measurement precision
If manual network discovery methods are used, then resource information can be obtained, but the process is time-consuming and requires significant human intervention
Solution Approach 1:
The system enables self-service automatic discovery by utilizing cloud service APIs to autonomously retrieve and analyze network element information without human intervention. The system automatically generates API calls, processes responses, and builds a complete resource inventory, eliminating the need for manual network discovery while maintaining comprehensive resource identification and significantly reducing discovery time.
3Measurement precision
If cloud applications are accessed directly for analysis, then detailed information can be obtained, but data security and privacy are compromised
Solution Approach 1:
The system introduces an intermediary layer that uses cloud service APIs to access and analyze application information without directly accessing the cloud applications themselves. This intermediary approach allows detailed analysis of configuration data, resource information, and potential vulnerabilities while maintaining data security and privacy by avoiding direct application access and sensitive data exposure.
Data Source
AI summary
A non-transitory, processor-readable medium stores instructions that, when executed by a processor, cause the processor to retrieve, from a database associated with a cloud service, first resource configuration data associated with a first resource. The first resource is analyzed to produce first resilience data, and a second resource associated with the cloud service is identified based on an indication of a load balancer associated with the cloud service. Based on the authentication data and an indication of the second resource, a second API call is generated to retrieve, from the database, second resource configuration data associated with the second resource is also retrieved from the database. A second resource is analyzed based on the second resource configuration data to produce second resilience data. Based on the first resilience data and the second resilience data, an indication of a vulnerability hotspot and an indication of a resource mitigation are generated.