Reachable Cloud Code Inspection for Low-Traffic Vulnerability Scanning

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing active scanning methods for cloud computing environments generate excessive network traffic and risk service disruptions, making them unsuitable for production environments.

Innovation Solution

A system and method for detecting network paths and inspecting only reachable code objects in cloud environments, using static analysis and active inspection to identify cybersecurity risks and initiate remediation actions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If active scanning is used to discover vulnerabilities in cloud environments, then vulnerability detection capability is improved, but network traffic volume increases causing congestion and service disruptions

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidnetwork traffic volume

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent segments the codebase into individual code objects and analyzes their reachability separately. By identifying and inspecting only those code objects that are actually reachable from external networks, the system avoids generating network traffic to inaccessible resources, thus reducing overall network traffic volume while maintaining vulnerability detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs static analysis to pre-identify reachable code objects before conducting active scanning. This preliminary action filters out inaccessible code objects, allowing the active scanning phase to focus only on reachable targets, thereby reducing the network traffic that would otherwise be generated by attempting to scan all code objects.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If active scanning attempts random domains and ports to discover vulnerabilities, then external attack surface discovery is improved, but network bandwidth consumption increases

Engineering Contradiction:

Improveexternal attack surface discoveryVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The patent performs static analysis as a preliminary step to identify which code objects are actually reachable from external networks. This pre-filtering ensures that subsequent active scanning efforts are directed only at reachable targets, eliminating wasted bandwidth on inaccessible resources while maintaining comprehensive attack surface discovery.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates a static model or map of the codebase structure and reachability relationships, allowing the system to simulate and identify accessible paths without actually traversing them through network traffic. This virtual copy guides the active scanning process to focus only on reachable endpoints.

Inventive Principle:

Principle #26Copying

3Measurement precision

If comprehensive code inspection is performed on all code objects, then cybersecurity risk identification is improved, but computational resources are wasted on unreachable code

Engineering Contradiction:

Improvecybersecurity risk identificationVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The patent divides the codebase into discrete code objects and evaluates the reachability of each one. By segmenting the inspection process and applying reachability filters, the system inspects only those code objects that can be accessed from external networks, reducing computational resource consumption while maintaining accurate cybersecurity risk identification.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs static analysis to pre-determine which code objects are reachable before conducting detailed security inspections. This preliminary classification allows the system to skip inspection of unreachable code objects, thereby reducing computational resource consumption while ensuring that all potentially vulnerable reachable code is thoroughly examined.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260106820A1System and method for determining code reachability in a networked computing environment

Publication Date: 2026.04.16 WIZ INC

AI summary

A system and method for performing inspection of a reachable code object of a cloud computing environment is presented. The method includes detecting a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment; determining reachability parameters of each resource of the plurality of resources for which a network path is detected; accessing a code repository including a plurality of code objects; actively inspecting the network path of a resource to determine if the network path is a viable network path; mapping each resource having a viable network path to a code object of the plurality of code objects; inspecting a mapped code object for a cybersecurity object; and initiating a remediation action based on the cybersecurity object.