Host-Based Whitelist Construction for Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in preventing data exfiltration and malware spread within cloud-based environments due to the limitations of traditional network-based security controls, which are not applicable in cloud settings where enterprises lack control over physical hardware or network infrastructure.
Innovation Solution
The implementation of host-based security controls to automate the construction of process-aware network whitelists by inspecting configuration files of applications, identifying expected network communications, and generating whitelists to authorize or block network activities, thereby enhancing anomaly detection and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network-based security controls are used to prevent data exfiltration, then network traffic can be monitored and controlled, but these controls are not available in cloud-based environments where enterprises lack control over physical hardware or network infrastructure
Solution Approach 1:
The patent introduces a host-based security control as an intermediary solution that operates within the cloud instance itself, bypassing the need for network-based controls. This mediator (host-based control) enables enterprises to maintain security capabilities in environments where traditional network controls are inaccessible
Solution Approach 2:
The patent replaces the mechanical/network-based security control system with a software-based host-level control mechanism. Instead of relying on physical network infrastructure control, the solution uses software agents and configuration file inspection at the host level to achieve similar security objectives in cloud environments
2Reliability
If manual whitelist construction is used to detect unauthorized communications, then security monitoring can be implemented, but the process is time-consuming and requires extensive manual configuration
Solution Approach 1:
The patent performs preliminary action by automatically inspecting configuration files during application deployment or initialization to pre-construct whitelists of expected network communications. This eliminates the need for manual whitelist construction and ensures security policies are in place before threats can exploit gaps
Solution Approach 2:
The system performs self-service by automatically generating whitelists through configuration file inspection without requiring manual security administrator intervention. The host-based control autonomously analyzes application configurations and constructs security policies, reducing both time and human resource requirements
3Reliability
If traditional security monitoring is used in cloud environments, then basic network traffic monitoring is possible, but false positives increase due to lack of process awareness
Solution Approach 1:
The patent applies local quality by making the security control process-aware at the application level. Instead of generic network monitoring, the host-based control inspects configuration files of specific applications to understand their unique communication patterns, thereby reducing false positives through localized, context-aware security policies
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Techniques are disclosed for constructing network whitelists in server endpoints using host-based security controls. Once constructed, the network whitelists are used to detect unauthorized communications at the server endpoints. In one embodiment, a method is disclosed for constructing a network whitelist. The method includes identifying at least a first application hosted on a computing system. The method also includes inspecting one or more configuration files associated with the first application to identify one or more configuration settings that specify how the first application communicates with one or more second applications. The method further includes generating a whitelist that specifies expected network communications activity for the first application, based on the configuration settings.