Static analysis techniques for determining reachability properties of network and computing objects
AssigneeWiz, Inc.
InventorsShai Keren, Daniel Hershko Shemesh
Life of this patent
Estimating the term…
Abstract
A method and system for modeling a cloud environment as a security graph are provided. The method includes identifying security objects in the cloud environment; collecting object data of the identified security objects; constructing security graph based on collected object data of the identified security objects; determining relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process; updating the constructed security graph with the determined relationships among the identified security objects; and storing the constructed security graph in a graph database.
Claims23
A method for modeling a cloud environment as a security graph, comprising:
- identifying security objects in the cloud environment;
- collecting object data of the identified security objects;
- constructing a security graph based on the collected object data of the identified security objects;
- determining relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process;
- updating the constructed security graph with the determined relationships among the identified security objects;
- generating insights based on the security graph and the determined relationships;
- tagging security objects of the identified security objects with the generated insights;
- and
- storing the constructed security graph in a graph database.
A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for modeling a cloud environment as a security graph, comprising:
- identifying security objects in the cloud environment;
- collecting object data of the identified security objects;
- constructing a security graph based on the collected object data of the identified security objects;
- determining relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process;
- updating the constructed security graph with the determined relationships among the identified security objects;
- generating insights based on the security graph and the determined relationships;
- tagging security objects of the identified security objects with the generated insights;
- and
- storing the constructed security graph in a graph database.
A system for modeling a cloud environment as a security graph, comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- identify security objects in the cloud environment;
- collect object data of the identified security objects;
- construct a security graph based on the collected object data of the identified security objects;
- determine relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process;
- update the constructed security graph with the determined relationships among the identified security objects;
- generate insights based on the security graph and the determined relationships;
- tag security objects of the identified security objects with the generated insights;
- and
- store the constructed security graph in a graph database.
Dependencies are inferred from the claim text.