Serverless Log Ontology for Faster Attack Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security frameworks for serverless applications face challenges in identifying and mitigating application-layer attacks due to high granularity of CSP logging, obscure context, limited root cause analysis, and lack of expertise in managed serverless environments, leading to increased Mean Time To Detect (MTTD) and reduced observability.
Innovation Solution
A log-based serverless ontology method that transforms semi-structured application logs into a graph-based representation using a Perimeterless framework, enabling faster incident response and observability without requiring knowledge of the application's resources or code, by constructing activity Knowledge Graphs (KGs) and utilizing AWS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If high granularity CSP logging capabilities are used, then detailed logging is achieved, but identifying and mitigating application-layer attacks becomes more challenging
Solution Approach 1:
The patent introduces an intermediary layer (security framework with ontology-based log analysis) between the raw CSP logs and the security analysis process. This intermediary transforms high-granularity logs into structured, meaningful security events, making attack detection easier despite the detailed logging capability.
Solution Approach 2:
The patent replaces manual log analysis mechanisms with automated ontology-based analysis systems. The ontology automatically processes and interprets high-granularity logs, substituting human effort with intelligent automation that can handle the complexity of detailed logging data.
2Adaptability or versatility
If multiple triggering options are provided in serverless apps, then functionality is enhanced, but context becomes obscure and root cause analysis capabilities are limited
Solution Approach 1:
The patent segments the complex serverless application context into distinct ontological categories and relationships. By organizing context information into structured ontology segments, the system can trace and analyze root causes across multiple triggering options without losing contextual information.
Solution Approach 2:
The patent implements feedback mechanisms through ontology-based correlation that traces back from security events to their root causes. The system provides feedback loops that connect observed security events with their originating contexts, enabling comprehensive root cause analysis despite multiple triggering options.
3Ease of operation
If CSP fully manages serverless services, then operational effort is reduced, but application developers cannot implement existing cybersecurity frameworks and tools
Solution Approach 1:
The patent creates a universal security framework based on ontology that can operate across different CSP-managed serverless services. This universal approach allows the security framework to adapt to various services without requiring service-specific implementations, maintaining versatility while working within the managed environment.
Solution Approach 2:
The patent introduces an intermediary ontology layer that bridges between CSP-managed services and cybersecurity frameworks. This intermediary enables existing security frameworks to function in managed serverless environments by translating service-specific operations into ontology-based security events.
4Reliability
If existing security frameworks are adapted and integrated within each application architecture, then security coverage is improved, but implementation becomes difficult and requires considerable expertise and time
Solution Approach 1:
The patent implements self-service capabilities through automated ontology-based analysis that requires minimal human configuration. The system automatically processes logs, identifies security events, and performs analysis without requiring extensive manual setup or expert intervention, reducing implementation complexity while maintaining security coverage.
Solution Approach 2:
The patent changes the fundamental parameters of security framework implementation by using ontology-based log analysis instead of traditional code-instrumentation approaches. This parameter change simplifies implementation by working with existing logs rather than requiring code modifications, reducing both complexity and expertise requirements.
5Difficulty of detecting and measuring
If access to application code and data is required for security framework implementation, then security analysis capability is enhanced, but latency and computational overhead are added
Solution Approach 1:
The patent extracts security analysis capabilities from the application code execution path by using ontology-based analysis of existing CSP logs. This extraction removes the overhead of code instrumentation and data access, allowing security analysis to proceed independently without adding latency to application operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A serverless ontology framework, for improving observability and incident response in managed serverless applications, comprising a log-based managed serverless ontology for creating a structured graph-based activity representation for application logs; a Perimeterless framework, adapted to construct activity Knowledge Graph (KGs) created by a parser to transform semi- structured activity logs into an activity knowledge graph; and monitor and analyze activity logs for investigating and prioritizing cyber incidents.