OCR-Based Cloud Application Inspection With Targeted Vulnerability Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Active scanning methods for detecting vulnerabilities in cloud computing environments generate excessive network traffic and risk service disruptions, making them detrimental to production environments.
Innovation Solution
Utilizing optical character recognition (OCR) to analyze graphical outputs from network paths, detect predetermined data indicators, and initiate further inspections based on these indicators, minimizing network traffic and reducing service disruptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active scanning is used to detect vulnerabilities in cloud environments, then vulnerability detection capability is improved, but network traffic volume increases excessively
Solution Approach 1:
The patent applies preliminary action by first obtaining network paths through static analysis before performing active scanning. This pre-screening step filters out unreachable or irrelevant targets, so that subsequent active scanning is performed only on promising paths, thereby maintaining vulnerability detection capability while significantly reducing the volume of network traffic generated.
Solution Approach 2:
The patent implements partial action by selectively applying active scanning only to specific network paths that pass static analysis criteria, rather than scanning all possible targets. This partial approach focuses resources on high-probability vulnerability targets, improving detection efficiency while minimizing unnecessary network traffic to other systems.
2Loss of information
If active scanning is performed on production environments, then vulnerability information is obtained, but service stability deteriorates due to network congestion
Solution Approach 1:
The patent uses static analysis as a preliminary filtering step to identify and prioritize network paths that are most likely to lead to vulnerabilities. By pre-screening targets and focusing active scanning only on high-value paths, the system obtains comprehensive vulnerability information while limiting the intensity and scope of scanning activities, thereby preserving production service stability.
3Measurement precision
If comprehensive network scanning is conducted to ensure thorough vulnerability detection, then detection coverage is improved, but resource consumption increases
Solution Approach 1:
The patent implements a two-stage approach where static analysis serves as a low-resource preliminary filter that identifies promising network paths. Only paths passing this initial screening undergo resource-intensive active scanning. This hierarchical strategy maintains comprehensive detection coverage for critical paths while dramatically reducing overall resource consumption by avoiding exhaustive scanning of all possible targets.
Data Source
AI summary
A system and method for performing active inspection of a cloud computing environment is presented. The method includes receiving a network path to access a resource, wherein the resource is a cloud object deployed in the cloud computing environment; generating an instruction to access the resource based on a plurality of reachability parameters designated in the network path; executing the generated instruction to access the resource through an external network, wherein the external network is external to the cloud computing environment; receiving an output generated in response to executing the generated instruction; detecting in the output a predetermined data indicator; and initiating further inspection in response to detecting the data indicator.