Serverless Application Flow Recognition Using Event-Based Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In managed serverless computing environments, recognizing application flows and identifying potential security risks is challenging due to the ephemeral nature of functions and the abstracted infrastructure, making it difficult for security teams to derive meaningful operational information and enforce security policies effectively.
Innovation Solution
A graph-based method is employed to recognize application flows by constructing an event-based graph from managed serverless activity logs, using community detection algorithms and centrality measures to identify groups of nodes and detect overlapping flows, without requiring manual intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If serverless architecture is used to provide automatic scaling and high availability, then productivity and service reliability are improved, but security monitoring capability deteriorates due to abstracted infrastructure and ephemeral functions
Solution Approach 1:
The patent introduces an intermediary system that sits between the serverless infrastructure and security monitoring tools. This intermediary captures and standardizes logs from ephemeral functions, transforming them into a format that security teams can analyze. The intermediary acts as a bridge that preserves security monitoring capability despite the abstracted nature of serverless infrastructure.
Solution Approach 2:
The system performs preliminary actions by pre-defining security policies and patterns before incidents occur. It proactively monitors function invocations, data access patterns, and inter-function communications against these predefined security rules, enabling early detection of potential security issues rather than reactive analysis after incidents occur.
2Measurement precision
If high granularity logging is implemented in serverless applications, then measurement precision is improved, but loss of information increases due to the ephemeral nature of functions
Solution Approach 1:
The patent merges multiple discrete log entries from ephemeral functions into unified application flow representations. By combining related log events and correlating them across function boundaries, the system reconstructs complete application flows even though individual functions are short-lived. This merging process prevents information loss by synthesizing fragmented logs into coherent narratives.
Solution Approach 2:
The system transitions from analyzing logs in the time dimension alone to adding a structural dimension by organizing logs into application flow graphs. This dimensional change allows reconstruction of complete application behaviors by mapping log events to structural flow representations, preserving information that would be lost in traditional time-series log analysis.
3Reliability
If third-party security service providers are granted access to raw data logs for monitoring, then security operations management is improved, but object-generated harmful factors increase due to potential information leakage
Solution Approach 1:
The patent extracts only the essential security-relevant information from raw logs and presents it to third-party security providers in an anonymized format. By taking out and isolating specific security indicators while removing sensitive identifying information, the system enables effective security monitoring by external providers while minimizing the risk of information leakage and misuse.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A method for automatically recognizing the structure and the flows of an application, according to which data is collected from managed serverless activity logs of a computational cloud provider that provides on-demand computing resources using distributed servers and then, an event-based graph is constructed, based on the activity logs, such that each node in the graph represents an entity of the application and each edge in the event-based graph represents an event being an interaction between entities or nodes. Application flows are recognized in the applications, based on the event-based graph and overlaps between the application flows are identified, based on the event-based graph characteristics.