PaaS Application Threat Detection via Resource Anomaly Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In PaaS cloud services, there is a lack of effective detection for security threats due to the isolation of virtual machines from physical resources, which can lead to undetected malicious activities affecting application security.
Innovation Solution
An application threat detection system monitors historical resource usage to establish normal consumption patterns and alerts for anomalies, utilizing statistical models and resource logs to identify potential security threats in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If virtual machines are isolated from physical resources in PaaS services, then application portability and ease of management are improved, but security threat detection capability deteriorates
Solution Approach 1:
The patent introduces an intermediary component that sits between the virtual machine layer and physical resource layer. This intermediary collects and analyzes resource usage data without breaking the isolation architecture, enabling security monitoring while maintaining virtualization benefits. The intermediary acts as a mediator that translates physical resource metrics into application-level security insights.
Solution Approach 2:
The patent adds a new dimension of monitoring by collecting resource usage data across multiple dimensions (CPU, memory, disk, network) and time periods. This multi-dimensional analysis enables detection of security threats that manifest as anomalous patterns across different resource dimensions, rather than relying on single-point checks that would break isolation.
2Reliability
If traditional security controls are provided by cloud provider, then infrastructure security is improved, but application-level security monitoring deteriorates
Solution Approach 1:
The patent segments security monitoring into two distinct layers: infrastructure-level security (handled by cloud provider) and application-level security (handled by the new system). This segmentation allows each layer to focus on its specific security concerns without interference, enabling both infrastructure reliability and application threat detection to coexist.
Solution Approach 2:
The patent implements a feedback mechanism where resource usage data continuously flows from the application through the monitoring system back to generate security alerts. This closed-loop feedback enables real-time detection and response to security threats while maintaining the separation between infrastructure and application security responsibilities.
3Measurement precision
If statistical models analyze historical resource usage, then normal behavior baseline is established, but detection time and computational overhead increase
Solution Approach 1:
The patent performs preliminary actions by pre-processing and storing resource usage data in structured formats during normal operation. Historical data is organized and indexed in advance, so when security analysis is needed, the system can quickly retrieve and analyze relevant information without performing heavy computation from scratch, reducing detection time while maintaining precision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security threat detection system is used to monitor the physical resource usage of a hosted application in a PaaS service in order to detect anomalous behavior indicative of a security threat. The system analyzes the historical usage of the application's physical resources in order to determine the normal range of consumption of a resource by the application. A security threat alert is then provided when the application's resource consumption exceeds the normal range of consumption.