# US 12,223,055 B2 · System and method for performing hierarchical and incremental workload scanning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,055 B2 - Document ID: US12223055B2 - Status: Granted - Kind: B2 - Application number: 17/835,066 - Filed: 2022-06-08 - Published: 2023-12-14 - Granted: 2025-02-11 - Earliest claimed: 2022-06-08 - Assignees: Check Point Serverless Security Ltd. - Applicants: Check Point Serverless Security Ltd. - Inventors: Ohad Tanami; Itay Harush - Web page: https://patentgrep.com/patent/US12223055B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer executed method is presented for identifying security issues in a workload. The method identifies instance(s) of the workload and scans each instance for security vulnerabilities using hierarchical and incremental scanning. The hierarchical and incremental scan of each instance is performed by identifying as a base machine image a machine image that has previously been scanned for security vulnerabilities and that the instance originated from. The differences between the instance and the base machine image are then identified and scanned for security vulnerabilities. ## Claims ### Claim 1 A method executed by processor circuitry for performing hierarchical and incremental scanning to identify security issues in a workload executed using a set of electronic resources, the method comprising: identifying with the processor circuitry at least one instance of the workload; for each of the identified at least one instance, using the processor circuitry to perform hierarchical and incremental scanning by: identifying as parent machine images one or more machine images that the instance originated from, wherein: the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes; each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance; a volume of the instance includes the entire content of each identified parent machine image, wherein a volume of each identified parent machine image includes at least a portion of the volume of the instance; and each of the nodes in the hierarchical tree structure is at least one of: connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node; or connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node; determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that: has previously been scanned to identify security vulnerabilities; and is most closely related to the instance according to the hierarchical tree structure; identifying differences between a-the volume of the instance and the content of the base machine image; scanning the identified differences for security vulnerabilities; and when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities. ### Claim 2 (depends on 1) The method of claim 1, wherein the scanning of the identified differences for the security vulnerabilities is performed by the processor circuitry: causing the workload to generate a snapshot of the volume of the instance; attaching the generated snapshot to a scanner workload, such that the scanner workload has a same file system as the workload; and causing the scanner workload to scan the identified differences in the generated snapshot for the security vulnerabilities, such that operation of the workload is not impacted. ### Claim 3 (depends on 1) The method of claim 1, further comprising: comparing the issued notifications to a list of remedies to known security vulnerabilities; generate a report including remedies associated with the identified security vulnerabilities. ### Claim 4 (depends on 1) The method of claim 1, further comprising for each of the identified at least one instance, repeatedly performing the hierarchical and incremental scanning based on a run time of the instance. ### Claim 5 (depends on 1) The method of claim 1, wherein the determining by the processor circuitry of whether the identified base machine image has been previously scanned is performed by comparing an identifier of the base machine image to a list of previously scanned machine images. ### Claim 6 (depends on 1) The method of claim 1, wherein the security vulnerabilities include at least one of security vulnerabilities, secret keys, malicious files, malicious IP addresses, or malicious URLs. ### Claim 7 (depends on 1) The method of claim 1, wherein the workload is an EC2 instance and the base machine image is an Amazon Machine Image (AMI). ### Claim 8 (depends on 1) The method of claim 1, wherein the base machine image is a docker image. ### Claim 9 A system for performing hierarchical and incremental scanning to identify security vulnerabilities comprising: electronic resources configured to execute a dynamic workload, wherein: the electronic resources include memory and an electronic processor; the electronic processor is configured to dynamically scale a number of instances of the dynamic workload based on demand for the dynamic workload and to execute the instances of the dynamic workload, such that: increased demand results in a creation of new instances of the dynamic workload; and decreased demand results in a termination of existing instances of the dynamic workload; processor circuitry configured to: identify at least one instance of the dynamic workload; for each of the identified at least one instance, perform hierarchical and incremental scanning by: identifying as parent machine images one or more machine images that the instance originated from, wherein: the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes; each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance; a volume of the instance includes the entire content of each identified parent machine image, wherein a volume of each identified parent machine image includes at least a portion of the volume of the instance; and each of the nodes in the hierarchical tree structure is at least one of: connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node; or connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node; determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that: has previously been scanned to identify security vulnerabilities; and identifying differences between the volume of the instance and the content of the base machine image; scanning the identified differences for security vulnerabilities; and when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities. ### Claim 10 (depends on 9) The system of claim 9, wherein the scanning of the identified differences for the security vulnerabilities is performed by the processor circuitry: causing the workload to generate a snapshot of the volume of the instance; attaching the generated snapshot to a scanner workload, such that the workload has a same file system as the workload; and causing the scanner workload to scan the identified differences in the generated snapshot for the security vulnerabilities, such that operation of the workload is not impacted. ### Claim 11 (depends on 9) The system of claim 9, wherein the processor circuitry is further configured to: compare the issued notifications to a list of remedies to known security vulnerabilities; and generate a report including remedies associated with the identified security vulnerabilities. ### Claim 12 (depends on 9) The system of claim 9, wherein the processor circuitry is further configured to, for each of the identified at least one instance, repeatedly perform the hierarchical and incremental scanning based on a run time of the instance. ### Claim 13 (depends on 9) The system of claim 9, wherein the processor circuitry is configured to determine whether the identified base machine image has been previously scanned by comparing an identifier of the base machine image to a list of previously scanned machine images. ### Claim 14 (depends on 9) The system of claim 9, wherein the security vulnerabilities include at least one of security vulnerabilities, secret keys, malicious files, malicious IP addresses, or malicious URLs. ### Claim 15 An electronic device for performing hierarchical and incremental scanning to identify security vulnerabilities in a workload executed using a set of electronic resources, the electronic device comprising: a network interface configured to communicate with the set of electronic resources; processor circuitry configured to: identify at least one instance of the workload; for each of the identified at least one instance, perform hierarchical and incremental scanning by: identifying as parent machine images one or more machine images that the instance originated from, wherein: the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes; each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance; a volume of the instance includes the entire content of each identified parent machine image, wherein a volume of each identified parent machine image includes at least a portion of the volume of the instance; and each of the nodes in the hierarchical tree structure is at least one of: connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node; or connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node; determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that: has previously been scanned to identify security vulnerabilities; and identifying differences between the volume of the instance and the content of the base machine image; scanning the identified differences for security vulnerabilities; and when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities. ### Claim 16 (depends on 15) The electronic device of claim 15, wherein the scanning of the identified differences for the security vulnerabilities is performed by the processor circuitry: causing the workload to generate a snapshot of the volume of the instance; attaching the generated snapshot to a scanner workload, such that the workload has a same file system as the workload; and causing the scanner workload to scan the identified differences in the generated snapshot for the security vulnerabilities, such that operation of the workload is not impacted. ### Claim 17 (depends on 15) The electronic device of claim 15, wherein the processor circuitry is further configured to: compare the issued notifications to a list of remedies to known security vulnerabilities; and generate a report including remedies associated with the identified security vulnerabilities. ### Claim 18 (depends on 15) The electronic device of claim 15, wherein the processor circuitry is further configured to, for each of the identified at least one instance, repeatedly perform the hierarchical and incremental scanning based on a run time of the instance. ### Claim 19 (depends on 15) The electronic device of claim 15, wherein the processor circuitry is configured to determine whether the identified base machine image has been previously scanned by comparing an identifier of the base machine image to a list of previously scanned machine images. ### Claim 20 (depends on 15) The electronic device of claim 15, wherein the security vulnerabilities include at least one of security vulnerabilities, secret keys, malicious files, malicious IP addresses, or malicious URLs.