Continuous Vulnerability Management for Microservice Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern applications with microservices are vulnerable to security threats due to dependencies on third-party libraries, which are difficult to manage manually and require automated solutions for continuous and accurate vulnerability management.
Innovation Solution
A system and method for continuous and automatic vulnerability management that identifies affected libraries, quantifies their impact, and assigns risk scores to APIs, enabling proactive detection and remediation of vulnerabilities by mapping dependencies, analyzing code calls, and comparing risk scores to threshold values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual inspection is performed for each update of an API or microservice, then vulnerabilities can be identified, but the process becomes time-consuming and resource draining
Solution Approach 1:
The system performs automated vulnerability assessment by having the software package itself provide dependency information through dependency files, eliminating the need for external manual inspection. The processing device automatically receives dependency information, determines afflicted libraries, and identifies code calls containing vulnerabilities without human intervention.
Solution Approach 2:
The patent replaces manual mechanical inspection processes with an automated computational system. The processing device uses algorithmic approaches to analyze dependency trees, identify vulnerable code calls, and generate risk scores, substituting human analysts with automated software that can process updates rapidly and consistently.
2Adaptability or versatility
If the number of third-party libraries is increased to provide more functionality, then the software package becomes more versatile, but the attack surface increases creating more opportunities for malicious attacks
Solution Approach 1:
The system implements continuous feedback loops where the processing device regularly receives updated dependency information from the software package, reassesses vulnerability risks, and provides ongoing security assessments. This allows the system to adapt to new libraries and dependencies as they are added, maintaining security awareness throughout the software lifecycle.
Solution Approach 2:
The patent performs preliminary vulnerability assessment by analyzing the dependency tree before vulnerabilities can be exploited. By receiving dependency information and identifying afflicted libraries in advance, the system proactively detects potential security issues before they can be targeted by attackers, enabling preventive rather than reactive security measures.
3Productivity
If automated vulnerability assessment is implemented, then inspection speed increases, but the complexity of the system increases
Solution Approach 1:
The patent segments the vulnerability assessment process into distinct modular components: receiving dependency information, determining afflicted libraries, identifying code calls, calculating risk scores, and generating reports. Each module performs a specific function independently, making the overall complex system manageable through functional decomposition and enabling parallel processing of different assessment tasks.
Data Source
AI summary
Apparatuses, methods, and systems are provided for making continuous vulnerability management for modern applications. A dependency tree can be created mapping third-party libraries to microservices used in an application of a software package. Natural language processing can be used on release notes and changelogs of new library versions to generate a list of libraries afflicted with common vulnerabilities and exposures (“CVEs”). A number of code calls from an application program interface (“API”) can be made to an afflicted library. A number of code calls including CVEs can be enumerated for each afflicted library. A risk score can be assigned to the API based on the number of code calls including CVEs. The risk score can be compared against a threshold value to cause a remedial action to occur, including updating libraries to newer versions to resolve CVE issues or generating a report regarding the afflicted libraries.