US 12,261,877 B2
Detecting malware infection path in a cloud computing environment utilizing a security graph
Elad Gabay, Tel Aviv (IL); Yaniv Shaked, Tel Aviv (IL); Alon Schindel, Tel Aviv (IL); Roy Reznik, Tel Aviv (IL); and Ami Luttwak, Binyamina (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Mar. 26, 2024, as Appl. No. 18/617,225.
Application 18/617,225 is a continuation of application No. 18/325,361, filed on May 30, 2023, granted, now 12,010,139.
Application 18/325,361 is a continuation of application No. 18/087,936, filed on Dec. 23, 2022, granted, now 11,706,252, issued on Jul. 18, 2023.
Claims priority of provisional application 63/266,033, filed on Dec. 27, 2021.
Prior Publication US 2024/0267405 A1, Aug. 8, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 21/53 (2013.01)
CPC H04L 63/145 (2013.01) [G06F 21/53 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method for detecting a malware infection path in a compute environment, comprising:
detecting a cybersecurity object, indicating a malware, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network;
traversing the security graph from the resource node to the endpoint node to generate a plurality of potential infection paths between the resource node and the endpoint node;
inspecting a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths;
determining that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload;
determining that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object;
monitoring the second workload for the cybersecurity object in response to determining that the first potential infection path is not an infection path; and
initiating a mitigation action in response to detecting the cybersecurity object on the second workload.