Graph-Based Security Introspection for Cloud Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques fail to effectively secure cloud computing environments against malicious or defective external applications, leading to exposure of private data and other deleterious consequences, particularly in serverless-oriented architectures where manual inspection is inadequate to detect malicious or erroneous code.
Innovation Solution
A system that performs dynamic process code introspection on a virtual machine to analyze function calls and package import statements, producing a graph representation of applications to detect and mitigate information disclosure, unsafe function calls, and security events using machine learning, heuristics, and probabilistic models, updating a function call pattern blacklist to prevent potential security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual inspection techniques are used to evaluate application security, then the system is easier to operate and understand, but it cannot effectively detect malicious or defective external applications in cloud environments
Solution Approach 1:
The patent introduces an application evaluation engine as an intermediary system between external applications and the cloud computing environment. This engine automatically evaluates applications by analyzing their code, detecting security risks, and determining whether to permit execution. The intermediary handles the complexity of security analysis internally while presenting a simplified interface to users, thus improving reliability without requiring users to directly manage the complex detection mechanisms.
Solution Approach 2:
The system implements self-service by automatically evaluating applications without requiring manual inspection. The application evaluation engine autonomously analyzes application code, identifies security risks using multiple evaluation techniques, and makes execution decisions. This automated self-evaluation process improves detection effectiveness while reducing the operational burden on users, effectively managing complexity through automation rather than human intervention.
2Object-affected harmful factors
If conventional security techniques are applied to cloud computing environments, then the system structure remains simple, but private data exposure and security breaches occur due to inadequate detection of malicious applications
Solution Approach 1:
The patent implements preliminary action by evaluating applications before they are permitted to execute in the cloud environment. The application evaluation engine analyzes application code, detects security risks, and determines execution permission in advance. This preliminary evaluation prevents malicious applications from accessing private data, addressing the harmful factor of data exposure risk while utilizing automated analysis techniques to manage the complexity of security enforcement.
Solution Approach 2:
The system incorporates feedback mechanisms where the application evaluation engine continuously monitors and evaluates applications, using the results to update security policies and improve future evaluations. The engine provides feedback on detected security risks and adjusts its evaluation criteria based on learned patterns, thereby reducing data exposure risk through iterative improvement while maintaining automated operation.
3Reliability
If automated application evaluation is implemented to detect malicious code, then security detection effectiveness improves, but the system complexity and computational resources increase
Solution Approach 1:
The patent segments the application evaluation process into multiple independent components: static code analysis, dynamic analysis, sandboxed execution, and risk scoring mechanisms. Each component handles a specific aspect of security evaluation, allowing the system to achieve high detection accuracy through specialized analysis while managing overall complexity by dividing the evaluation task into manageable segments that can be executed independently and combined for final assessment.
Data Source
AI summary
A graph representation of a designated application may be created. The graph representation may include nodes that each represent a computer programming code statement associated with the designated application as well as edges that each represent a logical linkage between two or more computer programming code statements. A determination may be made as to whether the designated application constitutes an unacceptable security risk by comparing the designated graph representation with a plurality of comparison graph representations. When it is determined that the designated application constitutes an unacceptable security risk, a message may be transmitted to prevent the designated application from being executed.