Runtime Workload Behavior Monitoring for 0-Day Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SBOM tools for cloud-native applications provide only static, periodic updates and fail to monitor software components' behavior in real-time, leaving them vulnerable to 0-day and supply chain attacks, and cannot trace the source of vulnerabilities.
Innovation Solution
A system that generates a baseline for container behavior, monitors for changes, and uses machine learning to identify and mitigate malicious activity in real-time, tracing back to the exact software package causing the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static periodic updates are used for vulnerability reporting, then system complexity is reduced, but real-time detection capability deteriorates
Solution Approach 1:
The system transitions from static periodic vulnerability updates to dynamic real-time monitoring. Behavior monitoring agents continuously collect runtime data from containers, and the machine learning model dynamically updates threat assessments based on changing behavior patterns, enabling real-time detection without excessive complexity
Solution Approach 2:
The patent replaces traditional mechanical periodic scanning with intelligent behavior analysis. Instead of periodically checking for known vulnerabilities, the system uses machine learning models to analyze runtime behavior patterns and detect anomalies, substituting mechanical updates with intelligent continuous monitoring
2Measurement precision
If comprehensive behavior monitoring is implemented, then detection accuracy is improved, but computational resources increase
Solution Approach 1:
The system implements partial monitoring by focusing on specific behavior metrics relevant to security threats rather than comprehensively monitoring all container activities. The behavior monitoring agents track key parameters such as network connections, system calls, and resource usage patterns, applying monitoring intensity only where security risks are most likely to manifest
Solution Approach 2:
The machine learning model changes parameters dynamically based on risk assessment. When normal behavior is detected, monitoring intensity is reduced to save resources. When suspicious patterns emerge, the system increases monitoring granularity and data collection frequency, optimizing the balance between detection accuracy and computational resource consumption
3Loss of time
If real-time behavior monitoring is deployed, then response time is reduced, but system complexity increases
Solution Approach 1:
The system segments the monitoring architecture into independent modular components: behavior monitoring agents deployed in containers, data collection modules, machine learning analysis engines, and response execution systems. Each component performs a specific function and can be independently managed, reducing overall system complexity while enabling real-time response through coordinated operation
Solution Approach 2:
The patent introduces behavior monitoring agents as intermediaries between container applications and the security analysis system. These agents collect and pre-process behavior data locally, filtering and formatting information before transmission to the central analysis platform, reducing network overhead and enabling faster real-time response
Data Source
AI summary
Software bill of materials (SBOM) vulnerability systems do not monitor software components behavior in real time, and rather rely on the static periodic updates. This gap leaves cloud-native software applications exposed to 0-day or supply chain attacks that exploit vulnerabilities that are not known or updated into the public vulnerability data sources. The techniques described herein provide dynamic and intelligent identification of 0-day and supply chain attacks in runtime environments, mitigate the attacks in real-time, and share intelligence to prevent a malicious workload from being deployed through the CI/CD pipeline.