Runtime Sensor Baselines for Cloud Identity Misuse Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Identity misuse in cloud computing environments poses significant risks, including unauthorized access to sensitive information, cybercrimes, and erosion of trust in digital systems, necessitating robust security measures to protect against malicious use of identities.

Innovation Solution

Deploying a runtime sensor in a cloud computing environment to continuously monitor and analyze workload activities, generate an activity baseline, and detect anomalous events by associating runtime processes with cloud logs, using cybersecurity objects and eviction policies to identify unauthorized access and potential threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If continuous monitoring and baseline generation are implemented, then detection accuracy is improved, but system complexity increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments monitoring into discrete components: runtime sensor for process detection, cloud log for event tracking, baseline generation module for anomaly detection, and association module for linking runtime processes with cloud events. This modular segmentation allows each component to be optimized independently while reducing overall system complexity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by continuously generating activity baselines that capture normal runtime behavior patterns before anomalies occur. These pre-established baselines enable rapid anomaly detection when deviations are observed, improving detection accuracy without requiring complex real-time analysis during actual threats.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If runtime sensors continuously monitor workload activities, then security detection capability is improved, but energy consumption increases

Engineering Contradiction:

Improvesecurity detection capabilityVSAvoidenergy consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The runtime sensor operates continuously to monitor workload processes and generate activity baselines, ensuring uninterrupted security monitoring. This continuous operation maintains detection capability without requiring periodic interruptions that would reduce reliability, while the monitoring focus remains on identifying meaningful anomalies rather than all activity.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The system uses self-service mechanisms where the runtime sensor automatically collects process data, the baseline generator autonomously creates activity profiles from historical data, and the anomaly detector independently identifies deviations. This automation reduces the need for external intervention and optimizes energy usage by processing only necessary data points.

Inventive Principle:

Principle #25Self-service

3Measurement precision

If association between runtime processes and cloud logs is implemented, then identification accuracy is improved, but processing time increases

Engineering Contradiction:

Improveidentification accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system introduces an intermediary association module that acts as a mediator between runtime process data and cloud log events. This intermediary layer processes and links the two data sources using process identifiers and event correlations, improving identification accuracy by establishing precise relationships while managing processing time through efficient matching algorithms.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces manual or sequential processing mechanisms with automated data association techniques that leverage process identifiers, event timestamps, and contextual metadata to rapidly link runtime processes with cloud events. This substitution of mechanical processing with intelligent data matching reduces processing time while maintaining high identification accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250310356A1Techniques for detecting cloud identity misuse leveraging runtime context

Publication Date: 2025.10.02 WIZ INC

AI summary

A system and method for detecting cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; continuously receiving data from the runtime sensor; generating an activity baseline based on the continuously received data, wherein the runtime sensor is configured to detect runtime processes on the workload; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; and determining that the event is an anomalous event based on the generated activity baseline.