US 11,943,240 B2
Cloud data attack detection based on network vulnerability signatures in traced resource network paths
Ravishankar Ganesh Ithal, Los Altos, CA (US); Yang Zhang, Los Altos, CA (US); and Mummoorthy Murugesan, Fremont, CA (US)
Assigned to Normalyze, Inc., Los Altos, CA (US)
Filed by Normalyze, Inc., Los Altos, CA (US)
Filed on Dec. 28, 2022, as Appl. No. 18/090,195.
Application 18/090,195 is a continuation of application No. 17/858,903, filed on Jul. 6, 2022, granted, now 11,575,696.
Claims priority of provisional application 63/246,310, filed on Sep. 21, 2021.
Claims priority of provisional application 63/246,313, filed on Sep. 21, 2021.
Claims priority of provisional application 63/246,315, filed on Sep. 21, 2021.
Claims priority of provisional application 63/246,303, filed on Sep. 20, 2021.
Prior Publication US 2023/0134945 A1, May 4, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 9/451 (2018.01); G06F 16/21 (2019.01); G06F 16/245 (2019.01); G06F 16/35 (2019.01); G06F 16/95 (2019.01); G06F 21/57 (2013.01); G06F 21/62 (2013.01)
CPC H04L 63/1416 (2013.01) [G06F 9/451 (2018.02); G06F 16/211 (2019.01); G06F 16/24569 (2019.01); G06F 16/355 (2019.01); G06F 16/95 (2019.01); G06F 21/577 (2013.01); G06F 21/6227 (2013.01); H04L 63/083 (2013.01); H04L 63/102 (2013.01); H04L 63/104 (2013.01); H04L 63/1433 (2013.01); H04L 63/18 (2013.01); H04L 63/205 (2013.01); G06F 2221/034 (2013.01); G06F 2221/2141 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A computer-implemented method of streamlined analysis of security posture of a cloud environment, the method comprising:
accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment;
tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data; accessing sensitivity classification data for objects in the storage resources;
receiving a query specifying a subject vulnerability signature; in response to the query, qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the subject vulnerability signature relative to the network communication paths and the sensitivity classification data; and
generating a representation of propagation of the breach attack along the network communication paths, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources,
wherein generating the representation of propagation of the breach attack comprises:
constructing a cloud attack surface map that graphically depicts propagation of the breach attack along the network communication paths as edges between nodes representing the subset of the pairs of the compute resources and the storage resources.