Unsupervised LSTM Autoencoder for Serverless Data Leakage Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Serverless computing environments present challenges for cybersecurity teams due to a larger attack surface, limited infrastructure modification capabilities, and high variability, making it difficult to detect permission misuse and data leakage, especially with existing solutions experiencing high false alert rates and inability to differentiate between malicious and legitimate code.
Innovation Solution
A method utilizing unsupervised deep learning data leakage detection models, specifically LSTM autoencoders, to detect anomalies in serverless cloud environments by generating graph representations, extracting features, and predicting reconstruction errors, which helps in identifying misconfigurations and permission elevation, thereby preventing data leakage and misuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection solutions are used in serverless environments, then detection coverage is provided, but false alert rates are high and malicious code cannot be differentiated from legitimate code
Solution Approach 1:
The patent implements dynamic analysis by instrumenting serverless functions to capture runtime behavior, permissions, and data access patterns. This allows the system to adapt to changing code and detect anomalies based on actual execution rather than static signatures, resolving the contradiction between detection coverage and false alert rates
Solution Approach 2:
The system collects feedback from runtime instrumentation including permission usage, data access patterns, and function behavior. This feedback is used to update detection models and distinguish malicious from legitimate code based on actual operational patterns rather than static analysis alone
2Reliability
If security monitoring is added to serverless functions, then threat detection capability is improved, but the complexity of managing and configuring cloud services increases
Solution Approach 1:
The patent implements self-service security monitoring where the serverless platform automatically instruments functions, collects security-relevant data, and performs analysis without requiring manual configuration by security teams. The system self-configures monitoring parameters and automatically adapts to new functions, reducing operational complexity
Solution Approach 2:
The security monitoring system is designed as a universal solution that works across all serverless functions and cloud services without requiring function-specific configuration. A single monitoring framework handles diverse security scenarios including permission misuse, data leakage, and malicious code detection across the entire serverless environment
3Measurement precision
If high-granularity function-level logging is implemented, then understanding of serverless applications is improved, but the volume of data to maintain and analyze increases
Solution Approach 1:
The patent extracts only the most security-relevant features from function-level logs, such as permission usage patterns, data access operations, and inter-function calls. By selectively extracting critical security attributes rather than analyzing complete log streams, the system maintains high detection precision while reducing the volume of data requiring analysis
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
In a serverless cloud computing environment consisting of one or more computerized devices having a memory and at least one processor and being capable of executing and running application code, a method for data leakage detection in a serverless cloud environment, comprising providing an unsupervised deep learning data leakage detection model for detecting an act of writing sensitive information to a public access bucket, due to misconfigured serverless function; using the unsupervised deep learning data leakage detection model to detect a predefined type of writing information to said bucket in an environment that contains legitimate activities involving the bucket.