Disk Clone Inspection for Low-Traffic Cloud Vulnerability Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity inspection methods, such as active scanning, generate excessive network traffic and risk service disruptions in cloud computing environments, and port scanning is computationally intensive, making them inefficient and potentially harmful to production environments.
Innovation Solution
A system and method for generating an inspectable disk based on a reachable resource in a cloud computing environment, using static analysis to determine network paths and actively inspecting these paths to detect cybersecurity issues, reducing the need for exhaustive port scanning by focusing on predetermined applications associated with open ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active scanning is used to discover vulnerabilities, then vulnerability detection capability is improved, but network traffic volume increases and service disruption risk worsens
Solution Approach 1:
The system performs preliminary actions by generating a disk clone before conducting security inspections. This clone contains a snapshot of the file system state, allowing inspectors to analyze vulnerabilities offline without sending traffic to the production system, thereby detecting vulnerabilities while avoiding network congestion and service disruption.
Solution Approach 2:
The system creates a copy (disk clone) of the production file system that can be inspected independently. This copy contains sufficient information for vulnerability detection through static analysis, eliminating the need for active network scanning and thus preventing network congestion and service disruption while maintaining vulnerability detection capability.
2Measurement precision
If port scanning is performed to identify open ports, then port discovery accuracy is improved, but computational resources consumed worsen
Solution Approach 1:
The system extracts port information directly from the disk clone by analyzing file system metadata, configuration files, and process information stored on the disk. This extraction method obtains port discovery accuracy without performing computationally intensive network-based port scanning, thereby reducing computational resource consumption.
Solution Approach 2:
The system replaces the mechanical network-based port scanning process with a file-system-based information extraction approach. By analyzing static data on the disk clone rather than actively probing network ports, the system achieves port discovery accuracy while dramatically reducing computational resource usage.
3Measurement precision
If comprehensive security inspection is conducted on production environment, then security vulnerability detection is improved, but system performance and operational stability worsen
Solution Approach 1:
The system performs preliminary security inspection actions on a disk clone rather than on the running production system. This allows comprehensive vulnerability detection including static analysis of code, configuration files, and dependencies without impacting the performance or operational stability of the production environment.
Solution Approach 2:
The system creates a copy of the production file system that serves as a sandbox for comprehensive security inspection. This clone can be thoroughly analyzed for vulnerabilities while the production system continues to operate normally, thus improving security vulnerability detection while maintaining system performance and operational stability.
Data Source
AI summary
A system and method for technology stack discovery by performing active inspection of a cloud computing environment utilizing disk cloning is described. The method includes: generating an inspectable disk based on an original disk of a reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; detecting a cybersecurity object on the inspectable disk, the cybersecurity object indicating a cybersecurity issue; selecting a network path including a network protocol to access the reachable resource; and actively inspecting the network path to detect the cybersecurity issue.