Runtime Sensor Aggregation for Cloud Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity threat detection methods for cloud computing environments face challenges due to the impracticality of agent-based solutions, which require heavy resource usage and root privileges, and the incompleteness of agentless solutions, which lack real-time threat detection and fail to provide a comprehensive picture.
Innovation Solution
A system utilizing a runtime sensor to aggregate and analyze data, combining runtime and static analysis to detect software applications, initiate inspections, and implement mitigation actions, thereby reducing resource usage and enhancing threat detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-based solutions are deployed to detect cybersecurity threats, then comprehensive threat detection capability is improved, but resource consumption and system complexity increase significantly
Solution Approach 1:
The patent extracts the agent component from the endpoint machine and relocates it to a centralized cloud-based inspection system. The runtime sensor on the endpoint machine performs only lightweight data collection and aggregation, while the heavy inspection logic is performed remotely by the inspection system, eliminating the need for resource-intensive agents on each endpoint.
Solution Approach 2:
The patent introduces a runtime sensor as an intermediary component that bridges the endpoint machine and the cloud-based inspection system. The sensor aggregates runtime execution data locally and transmits it to the inspection system, enabling comprehensive threat detection without requiring full agent deployment on each endpoint.
2Reliability
If agent-based solutions are deployed to provide complete cybersecurity visibility, then detection comprehensiveness is improved, but installation complexity and security risks increase
Solution Approach 1:
The patent extracts the complex agent functionality from the endpoint and consolidates it in a centralized inspection system. The runtime sensor on endpoints performs only simple data aggregation, eliminating the need for complex agent installation and management on each machine while maintaining comprehensive detection capability.
Solution Approach 2:
The centralized inspection system serves multiple functions that were previously distributed across individual agents: runtime data collection, static analysis, threat detection, and response coordination. This universal system eliminates the need for multiple agent instances and simplifies deployment across the entire network.
3Use of energy by moving object
If agentless solutions are used to avoid resource consumption, then resource usage is reduced, but real-time threat detection capability is lost
Solution Approach 1:
The runtime sensor performs preliminary data aggregation and filtering locally on the endpoint machine, preparing and prioritizing events for transmission to the inspection system. This preliminary action ensures that only relevant data is transmitted, reducing network overhead and enabling faster processing while maintaining real-time detection capability.
Data Source
AI summary
A system and method for detecting cybersecurity threats in a cloud computing environment utilizing sensor based runtime execution data is presented. The method includes receiving aggregated runtime execution data from a runtime sensor deployed on a resource in a cloud computing environment, wherein the runtime sensor is configured to aggregate runtime execution data; generating an event log based on the aggregated runtime execution data, each event in the event log generated by extracting data from the aggregated runtime execution data; detecting in the event log a software application identifier; and initiating inspection of the resource in response to determining that a software application corresponding to the software application identifier was not previously detected on the resource.