Security Graph for IaC Vulnerability Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud computing environments face challenges in detecting vulnerabilities in workloads deployed using Infrastructure as Code (IaC), which can lead to compromised workloads and cybersecurity threats.

Innovation Solution

A method and system that utilize a security graph to detect vulnerable workloads by extracting code objects from IaC files, generating nodes and connections in the security graph, and determining the presence of cybersecurity threats based on associations between code objects and deployed workloads.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If Infrastructure as Code (IaC) is used to deploy multiple workloads from a single code template, then deployment efficiency and resource utilization are improved, but vulnerability propagation risk increases

Engineering Contradiction:

Improvedeployment efficiencyVSAvoidvulnerability propagation risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the monolithic code template into modular, reusable components that can be independently analyzed and secured. By breaking down the IaC code into discrete segments, the system can identify and isolate vulnerabilities without compromising the entire deployment pipeline, thus maintaining high deployment efficiency while reducing vulnerability propagation risk.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary security analysis and validation of code templates before deployment. By performing security checks, vulnerability scanning, and compliance verification in advance, the system prevents vulnerable workloads from being deployed, thereby eliminating the harmful effect before it can propagate across multiple instances.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If extensive inspections are performed on each workload to detect vulnerabilities, then detection accuracy is improved, but compute resource consumption increases

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidcompute resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies partial inspection by focusing security analysis only on the code templates and configurations that actually define workload behavior, rather than inspecting every runtime artifact. This selective approach maintains high detection accuracy for critical vulnerabilities while significantly reducing compute resource consumption compared to exhaustive inspection methods.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent uses code templates and configuration files as proxies for detecting vulnerabilities across multiple workloads. By analyzing the source code representations rather than each deployed instance, the system achieves comprehensive vulnerability detection with minimal compute resources, as one template analysis protects all workloads derived from it.

Inventive Principle:

Principle #26Copying

3Measurement precision

If manual code review is performed on IaC files to detect vulnerabilities, then detection precision is improved, but time consumption increases

Engineering Contradiction:

Improvevulnerability detection precisionVSAvoidtime consumption

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent replaces manual code review with automated security analysis tools and machine learning-based vulnerability detection systems. These automated mechanisms scan IaC code templates for security issues, maintaining high detection precision through sophisticated pattern recognition while eliminating the time-consuming nature of manual review processes.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent implements continuous feedback loops where security analysis results from code templates automatically feed back into the deployment pipeline. This enables real-time detection and remediation of vulnerabilities without requiring manual intervention, thus maintaining high detection precision while significantly reducing time consumption compared to manual review workflows.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250200194A1Detecting vulnerabilities in virtual instances in a cloud environment utilizing infrastructure as code

Publication Date: 2025.06.19 WIZ INC

AI summary

A system and method for detecting a vulnerable workload deployed in a cloud environment based on a code object of an infrastructure as code file utilizes a security graph. The method includes: extracting the code object from a state file, which includes a mapping between the code object to a first deployed workload and a second deployed workload; generating a node representing the code object in the security graph; generating a connection in the security graph between the node representing the code object and a node representing the first workload and a connection between the node representing the code object and a node representing the second workload; and determining that the second workload is a vulnerable workload, in response to detecting that the first workload node is associated with a cybersecurity threat, and that the nodes representing the workloads are each connected to the node representing the code object.