Computer Runtime Security Monitoring With Agent Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security and vulnerability scanning tools lack effective monitoring of runtime environments, leading to inadequate prioritization of security threats based on their impact on application execution, and there is a need for tools that can efficiently monitor and manage runtime environments to handle security issues promptly.
Innovation Solution
A system and method for runtime threat detection involving software agents that collect and correlate operating system information with software component data, using a threat detection model to identify risky executions and prioritize security events in real-time, integrated with Kubernetes clusters and platforms like JFrog Artifactory and Xray for comprehensive threat analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software security scanning tools examine source code and binary registries for security vulnerabilities, then security issues can be identified, but visibility into runtime environments and actual process executions is limited
Solution Approach 1:
The system segments runtime environment monitoring into discrete collectable items (process information, file system changes, network connections, registry modifications) that can be independently gathered and analyzed. Software components collect specific types of runtime data separately, then the system correlates these segmented information items to reconstruct comprehensive runtime behavior patterns.
Solution Approach 2:
The patent introduces an intermediary correlation system that bridges the gap between static security scanning tools and dynamic runtime environments. This intermediary layer collects runtime information items, correlates them with software component data, and generates security assessments without requiring direct modification of the monitored applications, thus maintaining monitoring capability while avoiding system complexity.
2Reliability
If a vast number of security issues are identified upon scanning, then comprehensive security coverage is achieved, but issues may be undesirably prioritized without considering which threats directly impact applications in runtime environments
Solution Approach 1:
The system implements feedback loops where runtime behavior data continuously informs security issue prioritization. Collected runtime information items (process executions, file accesses, network connections) are correlated with identified security vulnerabilities to determine actual impact. This feedback mechanism dynamically adjusts priority rankings based on observed runtime behavior, ensuring that vulnerabilities causing actual runtime issues are prioritized over theoretical risks.
Solution Approach 2:
The patent changes the parameters used for prioritization from static vulnerability severity scores to dynamic parameters incorporating runtime behavior patterns. By analyzing correlations between collected runtime information items and security issues, the system adjusts prioritization parameters in real-time, transforming the prioritization criterion from fixed to adaptive based on actual application execution context.
3Productivity
If existing security tools focus on sterile development environments, then security vulnerabilities can be detected in controlled settings, but immediate threats in runtime environments cannot be quickly handled
Solution Approach 1:
The system performs preliminary collection of runtime information items (process metadata, file system state, network connections, registry information) before security issues manifest or escalate. By continuously gathering and correlating these runtime context data in advance, the system prepares security assessments proactively, enabling rapid response when threats are detected without losing critical runtime context information.
Data Source
AI summary
A system and method for runtime detection of threats to a computer system, including, for example: collecting, by a software agent, operating system information items describing a runtime environment; correlating the collected information items with software component information items, describing components deployed in the runtime environment; and identifying a risky execution of a computer application based on the correlating of information items. Some embodiments of the invention may be applied to or be integrated with a Kubernetes cluster, where software agents may be installed or be integrated with specific controllers and/or nodes. Some embodiments may include correlating or integrating information collected by different software agents, as well as defining and using a threat detection model—which may include, e.g., different criteria and priorities to further fine-tune threat detection.