Secure Software Build Monitoring via Dynamic Trace Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring and auditing secure software builds are challenging due to the complexity of various sources used in building an OCI image, making it difficult to detect potential malicious code effectively and efficiently.
Innovation Solution
A method that determines an indicator value for each build instruction, allowing for fine-grained control of logging, focusing on capturing only suspicious data, and using a hardcoded mapping table to differentiate between allowed and unpermitted instructions, thereby reducing the size of manifest files and analysis time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive logging of all build instructions is performed to ensure high detection rate of malicious code, then security detection capability is improved, but analysis time and resource consumption increase significantly
Solution Approach 1:
The patent segments the build process into individual build instructions and assigns different monitoring levels to each instruction based on its security risk. This allows the system to focus detailed analysis only on high-risk instructions rather than uniformly logging all instructions, thereby reducing overall analysis time while maintaining high detection rates for malicious code in critical operations.
Solution Approach 2:
The patent applies local quality by differentiating the monitoring intensity for different build instructions based on their security sensitivity. High-risk instructions receive detailed logging and analysis (high monitoring level), while low-risk instructions receive minimal or no logging (low monitoring level). This selective approach reduces resource consumption and analysis time while maintaining effective detection where it matters most.
2Reliability
If detailed trace information is logged for all build instructions to ensure thorough security auditing, then security monitoring capability is improved, but the size of manifest files increases significantly
Solution Approach 1:
The patent extracts only the essential security-relevant information from build instructions and includes it in manifest files, rather than logging complete detailed traces of all instructions. By selectively extracting only critical data elements related to security auditing, the system maintains thorough security monitoring capability while significantly reducing the quantity of data stored in manifest files.
3Reliability
If comprehensive logging of all build instructions is performed to ensure thorough security monitoring, then security coverage is improved, but resource consumption increases significantly
Solution Approach 1:
The patent implements dynamic monitoring that adjusts the level of logging and analysis based on the risk profile of each build instruction. The system dynamically determines monitoring levels and applies them selectively, ensuring comprehensive security coverage for high-risk operations while minimizing resource consumption for low-risk operations. This dynamic approach allows the system to maintain thorough security monitoring where needed while optimizing resource usage overall.
Data Source
AI summary
A computer-implemented method for monitoring and auditing secure software builds is disclosed. The computer-implemented includes receiving a build file containing a sequence of build instructions. The computer-implemented method further includes, for each build instruction being executed: determining an indicator value corresponding to a monitoring level associated with a build instruction; and modifying logging of trace information associated with a computing system executing the build instruction based, at least in part, on the indicator value corresponding to the monitoring level.