Security Graph Malware Infection Path Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions struggle to efficiently detect and mitigate malware threats across diverse technology stacks in cloud environments, often requiring resource-intensive virtual machines and separate solutions for each stack, which can lead to performance degradation and increased costs.
Innovation Solution
The use of a security graph to detect malware infection paths by representing workloads as resource nodes and traversing potential infection paths between these nodes and endpoint nodes accessible to public networks, allowing for efficient inspection and mitigation of malware threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software is deployed to prevent and mitigate malware, then security protection is improved, but computer performance deteriorates significantly
Solution Approach 1:
The patent introduces a cloud-based malware detection service as an intermediary between the endpoint device and malware threats. Instead of running resource-intensive antivirus software locally, the system uploads files to cloud-based sandbox environments for analysis. The cloud service acts as a mediator that performs security checks remotely, allowing local devices to maintain full performance while still receiving comprehensive security protection through the intermediary cloud analysis service.
2Reliability
If virtual machines are deployed for malware scanning in cloud environments, then malware detection capability is improved, but resource consumption increases significantly
Solution Approach 1:
The patent merges multiple malware scanning functions into a single shared cloud-based sandbox environment. Instead of deploying separate virtual machines for each scanning task, the system consolidates malware analysis capabilities into centralized sandbox infrastructure that can handle multiple files and workloads. This merging approach maintains comprehensive malware detection capability while significantly reducing resource consumption through shared hardware resources and efficient virtualization management.
Solution Approach 2:
The cloud-based sandbox environment is designed as a universal platform that can analyze multiple types of malware across different technology stacks (virtual machines, containers, serverless functions) using a single infrastructure. The sandbox service performs multi-functional analysis including static analysis, dynamic execution, and behavioral monitoring, eliminating the need for separate specialized scanning systems for each workload type or malware category.
3Adaptability or versatility
If separate cybersecurity solutions are implemented for each technology stack, then coverage of different stacks is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal cybersecurity platform that provides comprehensive protection across multiple technology stacks through a single system. The cloud-based sandbox environment can analyze malware targeting virtual machines, containers, serverless functions, and other workloads using unified analysis methodologies. This universal approach maintains adaptability to different stacks while reducing system complexity by eliminating the need to deploy, manage, and coordinate multiple separate security solutions.
Data Source
AI summary
A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.