Security Graph Malware Path Detection in Cloud Workloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection solutions in cloud computing environments are resource-intensive, require separate implementations for different technology stacks, and struggle to detect and contain malware infection paths efficiently due to the dynamic nature of cloud infrastructure.
Innovation Solution
A security graph-based system that represents cloud environments as nodes, allowing for the detection of malware objects and tracing potential infection paths, prioritizing high-risk resources for inspection to contain the threat efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software is deployed to prevent and mitigate malware, then malware protection capability is improved, but computer performance deteriorates significantly
Solution Approach 1:
The patent introduces a cloud-based malware detection service as an intermediary between the endpoint device and malware threats. Instead of running resource-intensive antivirus software locally, the system uploads files to the cloud where specialized malware detection engines analyze them. This mediator approach provides comprehensive malware protection while keeping local device performance unaffected, as the heavy computational burden is offloaded to remote servers.
2Reliability
If cloud-based malware detection services are deployed to improve malware detection capability, then malware detection effectiveness is improved, but resource consumption increases due to VM deployment and scaling
Solution Approach 1:
The patent implements a universal cloud-based malware detection platform that can analyze multiple types of files and detect various malware strains through a single unified service. Instead of deploying separate virtual machines for different malware detection scenarios, the system uses a multi-functional detection engine that handles diverse file types (executables, documents, archives, etc.) and malware categories within the same infrastructure, thereby reducing overall resource consumption while maintaining comprehensive detection effectiveness.
3Reliability
If comprehensive malware scanning is performed across all workloads, then malware detection coverage is improved, but inspection time and resource usage increase
Solution Approach 1:
The patent applies local quality by prioritizing malware inspection based on the specific characteristics and risk profiles of individual files and workloads. Instead of uniformly scanning all files with the same intensity, the system analyzes file metadata, user behavior patterns, and system context to determine inspection priority. High-risk files receive thorough multi-layered analysis while low-risk files undergo faster verification, thereby achieving comprehensive coverage while minimizing overall inspection time through differentiated quality levels of scanning.
Data Source
AI summary
A system and method provide detection of a malware attack path. The method includes detecting at a first time a malware object on a first workload deployed in the compute environment, wherein the first workload is represented by a first node in a security graph, the security graph including a representation of the compute environment; querying the security graph to detect a second node connected to the first node, wherein the connection indicates that the first workload represented by the first node can access a second workload represented by the second node; and generating an instruction to inspect the second workload represented by the second node at a second time, occurring after the first time.