Container Image Layer Diffing for Cybersecurity Risk Source Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Scanning each layer of a container image for cybersecurity threats is inefficient due to processing and storage requirements, and existing methods often miss threats in lower layers or redundantly detect threats across dependent layers.

Innovation Solution

A system that inspects a bottom layer for cybersecurity threats, generates a diff between the bottom and upper layers, and associates detected threats with specific layers, reducing redundant inspections and pinpointing threats accurately.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If each layer of a container image is scanned for cybersecurity threats, then detection completeness is improved, but processing time and storage requirements increase

Engineering Contradiction:
Improvedetection completenessVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the container image into multiple layers and associates each layer with its source image. By detecting cybersecurity objects in the context of layer associations rather than treating all layers uniformly, the system improves detection completeness while managing processing time through targeted analysis of layer relationships.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by generating representations of layers and their associations with source images before conducting cybersecurity scans. This pre-processing organizes the data structure so that when scanning occurs, the system can efficiently determine which layers need inspection based on their source image associations, reducing redundant processing.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If each layer of a container image is scanned for cybersecurity threats, then detection completeness is improved, but storage requirements increase

Engineering Contradiction:
Improvedetection completenessVSAvoidstorage requirements
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

The patent creates representations (copies) of layer data and their associations with source images rather than storing and processing the actual layer contents repeatedly. These representations enable the system to track layer relationships and perform cybersecurity detection without duplicating the full storage burden of each layer multiple times.

Inventive Principle:
Principle #26Copying

3Measurement precision

If cybersecurity scans are performed on container layers, then threat detection accuracy is improved, but redundant detections across dependent layers increase

Engineering Contradiction:
Improvethreat detection accuracyVSAvoidscan efficiency
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the container image into multiple layers and associates each layer with its source image. By detecting cybersecurity objects in the context of layer associations rather than treating all layers uniformly, the system improves detection accuracy while reducing redundant detections through targeted analysis of layer relationships.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Instead of scanning layers independently from bottom to top or top to bottom, the patent inverts the approach by scanning layers in association with their source images. This allows the system to detect cybersecurity objects once at the source image level and automatically propagate findings to all dependent layers, eliminating redundant detections while maintaining accuracy.

Inventive Principle:
Principle #13The other way round (Inversion)

4Reliability

If comprehensive layer inspection is performed, then cybersecurity issue detection is improved, but resource consumption increases

Engineering Contradiction:
Improvecybersecurity issue detectionVSAvoidresource consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent performs preliminary actions by generating representations of layers and their associations with source images before conducting cybersecurity scans. This pre-processing organizes the data structure so that when scanning occurs, the system can efficiently determine which layers need inspection based on their source image associations, reducing redundant processing and resource consumption.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent creates representations (copies) of layer data and their associations with source images rather than storing and processing the actual layer contents repeatedly. These representations enable the system to track layer relationships and perform cybersecurity detection without duplicating the full storage and processing burden of each layer multiple times.

Inventive Principle:
Principle #26Copying

Data Source

PatentUS20250356002A1System and method for identifying cybersecurity risk source in container image layers
Publication Date: 2025.11.20 WIZ INC
  • US20250356002A1 patent drawing
  • US20250356002A1 patent drawing
  • US20250356002A1 patent drawing

AI summary

A system and method for detecting a cybersecurity issue in a software container layer and mitigating the same is presented. The method includes: detecting a software container including a plurality of layers; associating a first layer of the plurality of layers with a first image of the software container, and associating a second layer of the plurality of layers with a second image of the software container; inspecting each of the plurality of layers for a cybersecurity issue; detecting a cybersecurity object on the first layer, wherein the cybersecurity object indicates the cybersecurity issue; initiating a remediation action on the first image, in response to detecting the cybersecurity object on the first layer.