Runtime Cybersecurity Analysis Using Shared API Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Performing runtime cybersecurity analysis in computing environments without full authorization or access to components is challenging, leading to inaccurate analyses and increased false positives/negatives, and deploying new agents requires additional labor and cooperation.
Innovation Solution
Utilizing existing application programming interfaces (APIs) to upload, run, and obtain results of inspection code without deploying a new agent, leveraging existing agents to analyze runtime behavior and identify potential vulnerabilities and threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If new agents are deployed to enable runtime analysis access, then access to runtime-relevant data is improved, but deployment complexity and labor requirements increase
Solution Approach 1:
The system leverages existing agents that are already deployed in the computing environment for their primary purposes. These agents have inherent access to runtime data needed for cybersecurity analysis, eliminating the need for separate dedicated analysis agents. The existing agents serve dual purposes: their original function and providing runtime data access for security analysis.
Solution Approach 2:
Existing agents in the computing environment are utilized for multiple functions - their original operational roles plus providing runtime data access for cybersecurity analysis. This multi-functionality approach allows the system to obtain runtime-relevant data without deploying specialized agents solely for analysis purposes.
2Ease of manufacture
If existing APIs are utilized for agentless analysis, then deployment effort is reduced, but access to comprehensive runtime behavior data may be limited
Solution Approach 1:
The system segments the data access approach by identifying and utilizing multiple existing APIs that provide different aspects of runtime data. Rather than relying on a single comprehensive API that may not exist, the system combines data from multiple specialized APIs to reconstruct complete runtime behavior profiles for analysis.
Solution Approach 2:
The system introduces an intermediary analysis layer that aggregates and synthesizes data from multiple existing APIs. This intermediary component combines information from various API sources to create a comprehensive view of runtime behavior, effectively bridging the gap between limited individual API capabilities and the need for complete runtime data.
Data Source
AI summary
Techniques for cybersecurity analysis. A method includes identifying a first set of paths to a first asset. The first set of paths includes a first path which allows for uploading inspection code, a second path which allows for running the inspection code, and a third path which allows for obtaining results of running the inspection code. The first set of paths is selected such that application programming interfaces (APIs) of the first set of paths are at least partially shared with APIs of a second set of paths to each of at least one second asset and, further, selected based on at least one request processing attribute of the at least one API used in order to access the first asset. The inspection code is uploaded via the first path and run via the second path. Outputs of the inspection code are obtained via the third path and analyzed.