# US 12,010,139 B2 · Detecting malware infection path in a cloud computing environment utilizing a security graph > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,139 B2 - Document ID: US12010139B2 - Status: Granted - Kind: B2 - Application number: 18/325,361 - Filed: 2023-05-30 - Published: 2023-09-21 - Granted: 2024-06-11 - Earliest claimed: 2021-12-27 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Elad Gabay; Yaniv Shaked; Alon Schindel; Roy Reznik; Ami Luttwak - Web page: https://patentgrep.com/patent/US12010139B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware. ## Claims ### Claim 1 A method for detecting a malware infection path in a compute environment, comprising: detecting a malware object on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network; traversing the security graph from the resource node to the endpoint node to generate a potential infection path between the resource node and the endpoint node; inspecting a second workload of the plurality of workloads represented by a second resource node for the malware object, wherein the second resource node is on the potential infection path; determining that the potential infection path is a confirmed infection path, in response to detecting the malware object on the second workload; determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware object; generating an impact analysis output of the malware object on the potential infection path, including an identifier of the second workload represented in the security graph by a node connected via a vertex to the node representing the first workload, wherein the vertex indicates that the first workload is configured to access the second workload. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating an instruction to inspect the first workload to detect the malware object. ### Claim 3 (depends on 2) The method of claim 2, further comprising: generating an inspectable disk based on a disk of the first workload; and providing access of the inspectable disk to a malware inspector, wherein the malware inspector is a software application deployed in a software container cluster. ### Claim 4 (depends on 1) The method of claim 1, further comprising: accessing a malware database to retrieve a first malware signature corresponding to the malware object; and inspecting the first workload for the malware object based on the first malware signature. ### Claim 5 (depends on 1) The method of claim 1, further comprising: generating an alert based on detecting the malware object. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating an instruction for the first workload on which the malware object is detected, which when executed configures the first workload to isolate the malware object. ### Claim 7 (depends on 1) The method of claim 1, further comprising: initiating an instruction which when executed removes network access from the first workload. ### Claim 8 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: detecting a malware object on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network; traversing the security graph from the resource node to the endpoint node to generate a potential infection path between the resource node and the endpoint node; inspecting a second workload of the plurality of workloads represented by a second resource node for the malware object, wherein the second resource node is on the potential infection path; determining that the potential infection path is a confirmed infection path, in response to detecting the malware object on the second workload; determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware object; and generating an impact analysis output of the malware object on the potential infection path, including an identifier of the second workload represented in the security graph by a node connected via a vertex to the node representing the first workload, wherein the vertex indicates that the first workload is configured to access the second workload. ### Claim 9 A system for detecting a malware infection path in a compute environment, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: detect a malware object on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network; traverse the security graph from the resource node to the endpoint node to generate a potential infection path between the resource node and the endpoint node; inspect a second workload of the plurality of workloads represented by a second resource node for the malware object, wherein the second resource node is on the potential infection path; determine that the potential infection path is a confirmed infection path, in response to detecting the malware object on the second workload; determine that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware object; and generate an impact analysis output of the malware obiect on the potential infection path, including an identifier of the second workload represented in the security graph by a node connected via a vertex to the node representing the first workload, wherein the vertex indicates that the first workload is configured to access the second workload. ### Claim 10 (depends on 9) The system of claim 9, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: generate an instruction to inspect the first workload to detect the malware object. ### Claim 11 (depends on 10) The system of claim 10, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: generate an inspectable disk based on a disk of the first workload; and provide access of the inspectable disk to a malware inspector, wherein the malware inspector is a software application deployed in a software container cluster. ### Claim 12 (depends on 9) The system of claim 9, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: access a malware database to retrieve a first malware signature corresponding to the malware object; and inspect the first workload for the malware object based on the first malware signature. ### Claim 13 (depends on 9) The system of claim 9, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: generate an alert based on detecting the malware object. ### Claim 14 (depends on 9) The system of claim 9, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: generate an instruction for the first workload on which the malware object is detected, which when executed configures the first workload to isolate the malware object. ### Claim 15 (depends on 9) The system of claim 9, wherein the memory includes further instruction which when executed by the processing circuitry configure the system further to: initiate an instruction which when executed removes network access from the first workload.