Detecting malware infection path in a cloud computing environment utilizing a security graph

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• detecting a malware object on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing a resource which is accessible to a public access network;
• traversing the security graph from the resource node to the endpoint node to generate a potential infection path between the resource node and the endpoint node including a plurality of second nodes, each second node of the plurality of second nodes connected to at least another second node of the plurality of second nodes with a vertex indicating that a workload represented by the second node can access a workload represented by the another second node, wherein a second resource node of the plurality of second nodes is connected to the resource node;
• generating a list including a plurality of Identifiers, each identifier corresponding to a workload represented by a second node of the plurality of second nodes;
• inspecting, based on the generated list, a second workload of the plurality of workloads represented by the second resource node;
• determining that the potential infection path is a confirmed infection path, in response to detecting the malware object on the second workload;
• and
• determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware object.

A system for detecting a malware infection path in a compute environment, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• detect a malware object on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing a resource which is accessible to a public access network;
• traverse the security graph from the resource node to the endpoint node to generate a potential infection path between the resource node and the endpoint node including a plurality of second nodes, each second node of the plurality of second nodes connected to at least another second node of the plurality of second nodes with a vertex indicating that a workload represented by the second node can access a workload represented by the another second node, wherein a second resource node of the plurality of second nodes is connected to the resource node;
• generate a list including a plurality of identifiers, each identifier corresponding to a workload represented by a second node of the plurality of second nodes;
• inspect, based on the generated list, a second workload of the plurality of workloads represented by the second resource node;
• determine that the potential infection path is a confirmed infection path, in response to detecting the malware object on the second workload;
• and
• determine that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware object.