Data Link Layer Sensor for Cloud Privilege Escalation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions for cloud computing environments face challenges in providing comprehensive threat detection due to the impracticality of agent-based solutions that require heavy resource usage and root privileges, while agentless solutions lack real-time data and fail to provide a complete picture, leading to undetected threats.
Innovation Solution
A sensor is deployed on a data link layer of cloud resources to listen for events, utilizing static analysis and runtime data to detect privilege escalation events, complemented by a backend server for efficient threat detection and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-based solutions are deployed to detect cybersecurity threats, then comprehensive threat detection capability is improved, but resource consumption (processor and memory) increases significantly
Solution Approach 1:
The system segments the threat detection functionality into a lightweight sensor component that runs on the endpoint and a backend service that performs heavy analysis. The sensor collects runtime data and forwards it to the backend, which performs static analysis and threat detection. This segmentation allows comprehensive detection without burdening endpoint resources.
Solution Approach 2:
The patent introduces a backend service as an intermediary between the endpoint sensor and the threat analysis process. The sensor on the endpoint collects data and forwards it to the backend, which then performs the computationally intensive static analysis and threat detection. This intermediary approach enables comprehensive detection while keeping endpoint resource usage minimal.
2Reliability
If agent-based solutions are deployed to detect cybersecurity threats, then real-time threat detection is improved, but security risk increases due to requiring root privileges or privileged software container
Solution Approach 1:
The sensor is designed with local quality by implementing minimal permissions on the endpoint - it only needs to collect runtime data without requiring root privileges. The privileged operations are performed by the backend service in a controlled environment, not on the endpoint itself. This localized permission structure reduces security risk while maintaining detection capability.
3Use of energy by moving object
If agentless static analysis solutions are used to detect cybersecurity threats, then resource consumption is reduced, but real-time threat detection capability is lost
Solution Approach 1:
The patent merges the advantages of both agent-based and agentless solutions by combining a lightweight endpoint sensor (agentless approach) with backend static analysis capabilities. The sensor collects runtime data in real-time with minimal resource usage, while the backend performs comprehensive static analysis. This combination achieves both low resource consumption and real-time detection capability.
Data Source
AI summary
A system and method for detecting privilege escalation on a resource deployed in a computing environment is presented. The method includes configuring the resource to deploy thereon a sensor, the sensor configured to detect events on a data link layer of the resource; receiving from the sensor a detection indicating a permission-based event of a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; detecting a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to detecting the privilege escalation event.