Serverless Flow Graph for FaaS Security Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and mitigating security threats in daisy-chained serverless Function-as-a-Service (FaaS) functions is challenging due to complex network architectures and the difficulty in monitoring and logging data across disparate systems, making it hard to detect advanced security attacks like function event-data injection and role/privilege escalation in real-time.
Innovation Solution
The method involves injecting trace and span identifiers into the daisy-chained FaaS functions to generate a serverless flow graph, performing trace-based analysis to detect anomalies, and mitigating these anomalies by delinking specific function calls, using machine learning techniques to classify and cluster data for anomaly detection and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If daisy-chained serverless FaaS functions are used to implement cloud-native application logic, then application functionality and service capability are improved, but security threat detection capability deteriorates due to complex distributed architecture and limited debugging tools
Solution Approach 1:
The patent introduces trace identifiers and span identifiers as intermediary elements that mediate between distributed FaaS functions and the security monitoring system. These identifiers are injected into function invocations and responses, enabling the security monitoring system to track and correlate events across disparate functions without requiring direct access to function internals or modification of function code.
Solution Approach 2:
The system implements feedback mechanisms by continuously collecting trace data from FaaS function executions, analyzing it through machine learning models, and using the results to detect security anomalies. The security monitoring system receives feedback from each function invocation and adjusts its detection behavior based on learned patterns of normal versus malicious behavior.
2Reliability
If monitoring and logging data collection is implemented across disparate FaaS systems, then security visibility is improved, but system complexity and integration difficulty increase
Solution Approach 1:
The patent implements a universal trace identifier format and correlation mechanism that works across different FaaS providers and function types. The same trace and span identifier structure is used regardless of the underlying FaaS platform, enabling standardized security monitoring without requiring provider-specific integrations or custom monitoring solutions for each system.
Solution Approach 2:
The monitoring system is segmented into independent components: trace identifier injection, data collection agents, machine learning analysis modules, and security response systems. Each component operates independently and can be deployed separately, reducing integration complexity while maintaining comprehensive security visibility across the distributed FaaS architecture.
3Speed
If real-time security analysis is performed on daisy-chained functions, then threat detection speed is improved, but computational overhead and processing time increase
Solution Approach 1:
The system performs preliminary actions by pre-processing trace data during normal function execution, organizing and storing it in structured formats with associated metadata. Machine learning models are pre-trained on historical trace data to establish baselines of normal behavior. When security analysis is needed, the pre-processed data and trained models enable rapid real-time detection without requiring intensive computational resources during the actual analysis phase.
Data Source
AI summary
In one embodiment, a method comprises: receiving, by a process, an executed function flow of a daisy chained serverless function-as-a-service (FaaS) function, the executed function flow having been injected with a particular trace identifier in response to an initial event trigger and span identifiers having been injected by each service that was executed; generating, by the process, a serverless flow graph associated with the particular trace identifier based on linking a path of serverless functions according to correlation of the span identifiers between the serverless functions; performing, by the process, a trace-based analysis of the serverless flow graph through comparison to a baseline of expectation; detecting, by the process, one or more anomalies in the serverless flow graph according to the trace-based analysis; and mitigating, by the process, the one or more anomalies in the serverless flow graph.