Software Container Quarantine via Behavioral Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software containers present vulnerabilities due to limited access for security tools to application-specific runtime data, making it difficult to detect and mitigate unauthorized actions, which can lead to security breaches.

Innovation Solution

Implementing a method to determine and monitor the intended behavior of software containers based on configuration data, detecting unauthorized actions, and quarantining the container by migrating it to a separate execution environment to prevent malicious activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If software containers share the same OS kernel to enable resource isolation and efficient deployment, then productivity and ease of operation are improved, but security vulnerabilities increase due to limited access for security tools to application-specific runtime data

Engineering Contradiction:

Improvedeployment efficiencyVSAvoidsecurity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent segments the execution environment into a primary execution environment for normal container operations and a quarantined execution environment for suspicious containers. This segmentation allows security tools to isolate and analyze potentially malicious containers without affecting the overall system, resolving the contradiction by maintaining both deployment efficiency and security through environmental separation

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a quarantine environment as an intermediary between the trusted execution environment and potentially malicious containers. This intermediary allows security tools to access application-specific runtime data in a controlled manner, enabling detection of unauthorized actions while maintaining system productivity through non-intrusive monitoring

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If security tools are given full access to application-specific runtime data to detect unauthorized actions, then security is improved, but device complexity and difficulty of operation increase

Engineering Contradiction:

Improvesecurity detection capabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by providing different levels of access to different containers based on their security status. Trusted containers operate with normal access rights, while quarantined containers receive enhanced monitoring. This resolves the contradiction by enabling comprehensive security detection only where needed, avoiding unnecessary system complexity

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements dynamic access control where security tool access to application-specific runtime data changes based on the container's security assessment. Containers transition between trusted and quarantined states, with access rights adjusted dynamically. This resolves the contradiction by enabling full security detection capability only when necessary, maintaining simplicity for normal operations

Inventive Principle:

Principle #15Dynamics

3Reliability

If containers are monitored continuously to detect unauthorized actions in real-time, then security is improved, but use of energy and computational resources increase

Engineering Contradiction:

Improvereal-time security detectionVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent implements periodic security monitoring where containers are assessed at intervals and transitions between trusted and quarantined states trigger re-evaluation. This periodic action enables real-time security detection when necessary while reducing continuous monitoring overhead, resolving the contradiction between security and resource consumption

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The patent applies preliminary anti-action by pre-defining unauthorized actions based on configuration data and intended behavior. Security tools compare actual container operations against these predefined restrictions, enabling efficient real-time detection without requiring complex continuous analysis, thus resolving the contradiction by reducing computational resource consumption

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS11625489B2Techniques for securing execution environments by quarantining software containers

Publication Date: 2023.04.11 PALO ALTO NETWORKS INC

AI summary

A system and method for securing execution environments by quarantining software containers. A method includes: determining, based on configuration data for an application stored in the application software container, at least one intended behavior of the application when executed by the application software container; monitoring execution of the application software container in a first execution environment, wherein the monitoring further comprises comparing the execution of the application software container to the at least one intended behavior; detecting an unauthorized action by the application software container when the execution of the application software container is anomalous as compared to the at least one intended behavior; and quarantining the application software container by migrating the application software container from the first execution environment to a second execution environment when the unauthorized action is detected.