Container Service Static Analysis With Integrated Image Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application security tools fail to adequately analyze container images in the context of the full application architecture, leading to potential data exfiltration, account compromise, and intellectual property theft, as they do not account for modern applications that utilize container images encapsulating dependencies and configuration.
Innovation Solution
An integrated application and container image scanning pipeline that coordinates primary and secondary scans, extracting and analyzing container images alongside application source code, using configured scanners to detect vulnerabilities and malicious intent, and optimizing performance through caching and result sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security review tools are used to scan application source code, then the scanning process is simple and fast, but the detection accuracy is insufficient because container images cannot be analyzed in the context of the full application architecture
Solution Approach 1:
The patent merges the application source code scanning process with container image scanning into a single integrated pipeline. The scanning system combines results from both the application code scan and the extracted container image scan to produce a unified security verdict, enabling comprehensive analysis of the full application architecture while maintaining a coordinated scanning process.
Solution Approach 2:
The patent implements nesting by extracting and scanning container images that are embedded within the application package. The container images are nested within the application architecture, and the scanning system nests the image scanning process within the overall application security review pipeline, analyzing components at multiple levels of abstraction.
2Reliability
If container images are extracted and scanned separately for every application, then comprehensive security coverage is achieved, but redundant scanning of common base images increases processing time and resource consumption
Solution Approach 1:
The patent implements preliminary action by pre-scanning container images and storing their security results in a cache before they are needed for application scanning. When a container image is required for application scanning, the system first checks whether it has already been scanned and cached the results, thereby avoiding redundant scanning of common base images and improving processing efficiency.
Solution Approach 2:
The patent uses copying by creating and storing copies of container image scan results in a cache. Instead of re-scanning the same container image multiple times, the system copies the security analysis results and reuses them across multiple application scans, significantly reducing redundant processing while maintaining comprehensive security coverage.
3Measurement precision
If comprehensive scanning of all application components including container images is performed, then security detection accuracy improves, but the scanning process becomes more complex and time-consuming
Solution Approach 1:
The patent performs preliminary scanning of container images and caches the results before the main application security review. This preliminary action ensures that when container images need to be analyzed as part of the full application architecture, the scanning time is significantly reduced because the images have already been pre-processed and their security characteristics are cached for quick retrieval.
Data Source
AI summary
A data platform having an anti-abuse analysis pipeline is provided. The anti-abuse analysis pipeline detects an image referenced in an application package and schedules an application scan to scan application source files and generate application scan results. The anti-abuse analysis pipeline also schedules an image scan to scan the image and generate image scan results. The anti-abuse analysis pipeline extracts application source files from the application package and executes an application scan using the extracted application source files to generate application scan results. The anti-abuse analysis pipeline extracts artifacts from the referenced image and executes an image scan using the artifacts to generate image scan results. The anti-abuse analysis pipeline determines a completion of the application scan and the image scan and generates a scan result using the application scan results and image scan results.