Rogue Cloud Resource Detection Before Data Exfiltration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing security measures are ineffective against rogue resources that perform malicious operations imperceptibly over time, and current detection methods often identify malicious behavior only after it has occurred, leading to potential data loss or damage.
Innovation Solution
Prevent the creation of rogue resources by analyzing key retrieval requests for anomalies and correlating them with resource creation requests, using machine learning to generate anomaly scores, and suspending suspicious requests to block the installation of potentially malicious cloud resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cloud resources are monitored for suspicious activity such as unusual access attempts or network traffic spikes, then malicious behavior can be detected, but the detection occurs only after the attack has already happened, allowing data loss or damage
Solution Approach 1:
The system performs preliminary actions by monitoring and analyzing key retrieval requests before rogue resources are created. The security system proactively identifies suspicious key retrieval patterns and prevents resource creation before malicious operations can occur, rather than detecting attacks after they have executed.
Solution Approach 2:
The system introduces an intermediary security layer between key retrieval and resource creation operations. This intermediary monitors the relationship between these operations and blocks suspicious sequences, preventing attackers from using retrieved keys to create malicious resources.
2Object-affected harmful factors
If IP address-based security measures are used to block unauthorized access, then external attacks can be prevented, but these measures become ineffective when attackers operate from within the cloud computing service
Solution Approach 1:
The system changes the monitoring parameters from external IP addresses to internal operational parameters such as key retrieval requests and resource creation patterns. This allows the security system to detect malicious activity regardless of whether the attacker is external or operating from within the cloud service.
Solution Approach 2:
Instead of focusing on blocking external access attempts, the system inverts the approach by monitoring the operational behavior of authenticated users and resources. It looks for suspicious patterns in how keys are retrieved and used to create resources, making the security effective against both external and internal threats.
3Reliability
If cloud resources are secured with credentials such as passwords and biometric data, then unauthorized access can be prevented, but attackers who gain access can create rogue resources that operate imperceptibly on behalf of the user
Solution Approach 1:
The system implements feedback by monitoring the relationship between key retrieval operations and resource creation operations. When suspicious patterns are detected in this feedback loop, the system intervenes to prevent rogue resource creation, adding a layer of security that operates after authentication but before malicious actions can occur.
Data Source
AI summary
The techniques disclosed herein prevent a rogue resource from being created within a cloud computing environment. For example, a rogue serverless function may be prevented from integrating with a cloud-based database, thereby preventing the serverless function from performing malicious operations such as low-rate data exfiltration. The rogue serverless function is detected before it is installed, heading off the attack completely. In some configurations, a key retrieval request is received. Parameters of the key retrieval request are analyzed for anomalies, and anomalous key retrieval requests are stored in a pool. Then, when a request to create a resource is received, the pool of anomalous key retrieval requests is searched for a match. When a match is found, the resource creation request may be suspended pending a further security review.