# US 12,003,517 B2 · Enhanced cloud infrastructure security through runtime visibility into deployed software > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,517 B2 - Document ID: US12003517B2 - Status: Granted - Kind: B2 - Application number: 17/456,335 - Filed: 2021-11-23 - Published: 2023-05-25 - Granted: 2024-06-04 - Earliest claimed: 2021-11-23 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Krishnan Shankar Narayan; Yonghui Cheng - Web page: https://patentgrep.com/patent/US12003517B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system retrieves from cloud storage a packet(s) sampled from network traffic detected for software deployed on a cloud instance within a cloud environment. Each packet is inspected with deep packet inspection (DPI) to determine characteristics of the packet from which the identity/type of the corresponding software are determined. The system correlates the data/metadata generated from DPI with data/metadata of other cloud resources of the cloud environment based on determining the cloud resources to which the cloud instance is related or which also support deployment/execution of the software. The correlated data/metadata are evaluated based on security policies which include criteria for characteristics of software running on the cloud infrastructure rather than criteria for cloud infrastructure configuration alone. The system thus determines whether a cloud resource complies with the security policies based at least partly on the types/characteristics of software with which it is correlated. ## Claims ### Claim 1 A method comprising: determining a first characteristic of software from results of deep packet inspection for a first cloud instance on which the software is deployed within a cloud environment, wherein the deep packet inspection is performed for a first packet destined for the software; determining other cloud resources of the cloud environment to which the first cloud instance is related; correlating an indication of the first characteristic of the software with an indication of the first cloud instance and indications of the other cloud resources to generate a set of correlated cloud data; and performing cloud infrastructure security monitoring for the cloud environment based on the set of correlated cloud data. ### Claim 2 (depends on 1) The method of claim 1, wherein performing cloud infrastructure security monitoring for the cloud environment comprises evaluating the set of correlated cloud data based on a security policy enforced for a first type of cloud resource to determine if the set of correlated cloud data indicate compliance with the security policy, wherein at least one of the first cloud instance and a first of the other cloud resources is of the first type, and wherein the security policy comprises a rule for characteristics of software with which cloud resources of the first type are correlated. ### Claim 3 (depends on 2) The method of claim 2, wherein evaluating the set of correlated cloud data based on the security policy comprises evaluating the first characteristic of the software indicated in the set of correlated cloud data against the rule. ### Claim 4 (depends on 3) The method of claim 3 further comprising determining that the set of correlated cloud data indicate compliance with the security policy based on determining that the first characteristic of the software satisfies the rule. ### Claim 5 (depends on 2) The method of claim 2 further comprising: based on determining that the set of correlated cloud data indicate compliance with the security policy, indicating that the at least one of the first cloud instance and the first of the other cloud resources complies with the security policy; and based on determining that the set of correlated cloud data do not indicate compliance with the security policy, indicating that the at least one of the first cloud instance and the first of the other cloud resources does not comply with the security policy. ### Claim 6 (depends on 1) The method of claim 1, further comprising forwarding the packet to a service that performs deep packet inspection, wherein the results of the deep packet inspection comprise results generated by the service. ### Claim 7 (depends on 6) The method of claim 6, wherein the service that performs deep packet inspection executes on a virtual firewall, and wherein the results of the deep packet inspection comprise results generated by the virtual firewall from the inspection. ### Claim 8 (depends on 1) The method of claim 1, wherein the indications of the first cloud instance and the other cloud resources comprise identifiers of the first cloud instance and the other cloud resources. ### Claim 9 (depends on 8) The method of claim 8, wherein correlating the indication of the first characteristic with the indication of the first cloud instance and the indications of the other cloud resources comprises associating the indication of the first characteristic with the identifiers of the first cloud instance and the other cloud resources to generate the set of correlated cloud data. ### Claim 10 (depends on 1) The method of claim 1, wherein the first characteristic of the software comprises at least one of a communication protocol used by the software, an identity of the software, and a type of the software, and wherein the software comprises a cloud application or server software. ### Claim 11 One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to: indicate a packet detected for a first cloud resource in a cloud environment for deep packet inspection, wherein a cloud application or server software executes on the first cloud resource, and wherein the first cloud resource is a cloud instance; determine a first characteristic of the cloud application or server software executing on the first cloud resource from results of the deep packet inspection; determine a second cloud resource in the cloud environment to which the first cloud resource is related; correlate an indication of the first characteristic with indications of the first and second cloud resources to generate a set of correlated cloud data; and perform security monitoring for infrastructure of the cloud environment based on the set of correlated cloud data. ### Claim 12 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the instructions to perform security monitoring comprise instructions to evaluate the set of correlated cloud data based on a first of a plurality of security policies enforced for a first type of cloud resource, wherein the first type of cloud resource corresponds to a type of at least one of the first and second cloud resources, and wherein the first security policy comprises a rule for characteristics of cloud applications or server software with which cloud resources of the first type are correlated. ### Claim 13 (depends on 12) The non-transitory machine-readable media of claim 12, wherein the instructions to evaluate the set of correlated cloud data based on the first security policy comprise instructions to determine whether the first characteristic of the cloud application or software server indicated in the correlated cloud data satisfies the rule. ### Claim 14 (depends on 13) The non-transitory machine-readable media of claim 13, further comprising instructions to, based on a determination that the first characteristic satisfies the rule, indicate that the at least one of the first and second cloud resources complies with the first security policy; and based on a determination that the first characteristic does not satisfy the rule, indicate that the at least one of the first and second cloud resources does not comply with the first security policy. ### Claim 15 An apparatus comprising: a processor; and a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, determine a first characteristic of software from results of deep packet inspection of at least a first packet sampled from network traffic for a first cloud resource on which the software is deployed within a cloud environment, wherein the first packet is destined for the software, and wherein the first cloud resource is a cloud instance; determine others of a plurality of cloud resources of the cloud environment to which the first cloud resource is related, generate a set of correlated cloud data based on correlation of an indication of the first characteristic of the software with an indication of the first cloud resource and indications of the other cloud resources; and monitor security of infrastructure of the cloud environment based on the set of correlated cloud data. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the instructions executable by the processor to cause the apparatus to monitor security of the infrastructure of the cloud environment comprise instructions executable by the processor to cause the apparatus to evaluate the set of correlated cloud data based on a security policy enforced for a first type of cloud resource to determine if the set of correlated cloud data indicate compliance with the security policy, wherein at least one of the first cloud resource and a first of the other cloud resources is of the first type, and wherein the security policy comprises a rule for characteristics of software with which cloud resources of the first type are correlated. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the instructions executable by the processor to cause the apparatus to evaluate the set of correlated cloud data based on the security policy comprise instructions executable by the processor to cause the apparatus to evaluate the first characteristic of the software indicated in the set of correlated cloud data against the rule and determine if the set of correlated cloud data indicate compliance with the security policy based on a determination of whether the first characteristic satisfies the rule. ### Claim 18 (depends on 16) The apparatus of claim 16 further comprising instructions executable by the processor to cause the apparatus to: based on a determination that the set of correlated cloud data indicate compliance with the security policy, indicate that the at least one of the first cloud resource and the first of the other cloud resources complies with the security policy; and based on a determination that the set of correlated cloud data do not indicate compliance with the security policy, indicating that the at least one of the first cloud resource and the first of the other cloud resources does not comply with the security policy. ### Claim 19 (depends on 15) The apparatus of claim 15 further comprising instructions executable by the processor to cause the apparatus to forward the packet to a service that performs deep packet inspection, wherein the results of the deep packet inspection comprise results generated by the service. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the instructions executable by the processor to cause the apparatus to generate the set of correlated cloud data comprise instructions executable by the processor to cause the apparatus to associate the indication of the first characteristic with identifiers of the first cloud resource and the other cloud resource.