# US 12,225,025 B2 · Enhanced cloud infrastructure security through runtime visibility into deployed software > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,025 B2 - Document ID: US12225025B2 - Status: Granted - Kind: B2 - Application number: 18/645,290 - Filed: 2024-04-24 - Published: 2024-08-15 - Granted: 2025-02-11 - Earliest claimed: 2021-11-23 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Krishnan Shankar Narayan - Web page: https://patentgrep.com/patent/US12225025B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system retrieves from cloud storage a packet(s) sampled from network traffic detected for software deployed on a cloud instance within a cloud environment. Each packet is inspected with deep packet inspection (DPI) to determine characteristics of the packet from which the identity/type of the corresponding software are determined. The system correlates the data/metadata generated from DPI with data/metadata of other cloud resources of the cloud environment based on determining the cloud resources to which the cloud instance is related or which also support deployment/execution of the software. The correlated data/metadata are evaluated based on security policies which include criteria for characteristics of software running on the cloud infrastructure rather than criteria for cloud infrastructure configuration alone. The system thus determines whether a cloud resource complies with the security policies based at least partly on the types/characteristics of software with which it is correlated. ## Claims ### Claim 1 A method comprising: determining one or more characteristics of software that executes on a first instance in a cloud environment based on analysis of first data obtained for the first instance; determining a first cloud resource of the cloud environment that is related to the first instance based on at least one of metadata and data of the first instance; and evaluating compliance of the first cloud resource with a first security policy based on the one or more characteristics determined for the software executing on the first instance. ### Claim 2 (depends on 1) The method of claim 1, wherein the first data comprises a first packet obtained for the first instance, wherein determining the one or more characteristics of the software comprises inspecting the first packet with deep packet inspection and determining the one or more characteristics based on results of deep packet inspection of the first packet. ### Claim 3 (depends on 1) The method of claim 1, further comprising indicating compliance of the first cloud resource with the first security policy based on results of evaluating compliance of the first cloud resource with the first security policy. ### Claim 4 (depends on 1) The method of claim 1, wherein evaluating compliance of the first cloud resource with the first security policy comprises evaluating compliance of the first cloud resource with the first security policy based, at least in part, on a type of the first cloud resource, wherein the first security policy indicates the type of the first cloud resource. ### Claim 5 (depends on 1) The method of claim 1, wherein the first security policy comprises a rule indicating one or more criteria for characteristics of software that can be determined based on inspection of packets sampled from network traffic of the cloud environment, wherein evaluating compliance comprises evaluating the one or more characteristics based on the one or more criteria indicated in the rule. ### Claim 6 (depends on 1) The method of claim 1, further comprising obtaining the at least one of metadata and data of the first instance from a provider of the cloud environment, wherein the at least one of metadata and data of the first instance indicate one or more cloud resources with which the first instance has a relationship, wherein the one or more cloud resources includes the first cloud resource. ### Claim 7 (depends on 1) The method of claim 1, further comprising correlating the one or more characteristics of the software executing on the first instance with an indication of the first cloud resource that is related to the first instance to generate correlated data, wherein evaluating compliance of the first cloud resource with the first security policy comprises evaluating the correlated data based on the first security policy. ### Claim 8 (depends on 1) The method of claim 1, wherein the first data were obtained for the first instance by at least one of an agent executing in the cloud environment and a service offered by a provider of the cloud environment. ### Claim 9 (depends on 8) The method of claim 8, further comprising obtaining the first data from cloud storage of the cloud environment, wherein the first data comprises a first packet that was sampled from network traffic corresponding to the first instance by at least one of the agent and the service offered by the provider of the cloud environment, and wherein at least one of the agent and the service stored the first packet in the cloud storage based on sampling of the first packet from network traffic. ### Claim 10 (depends on 1) The method of claim 1, wherein the software executing on the first instance comprises application software or server software. ### Claim 11 One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to: determine one or more characteristics of software that executes on a first instance in a cloud environment based on analysis of first data obtained for the first instance; determine a first cloud resource of the cloud environment that is related to the first instance based on at least one of metadata and data of the first instance; and evaluate compliance of the first cloud resource with a first security policy based on the one or more characteristics determined for the software executing on the first instance. ### Claim 12 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the first data comprises a first packet obtained for the first instance, wherein the instructions to determine the one or more characteristics of the software comprise instructions to inspect he first packet with deep packet inspection and determine the one or more characteristics based on results of deep packet inspection of the first packet. ### Claim 13 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the program code further comprises instructions to indicate compliance of the first cloud resource with the first security policy based on results of evaluating compliance of the first cloud resource with the first security policy. ### Claim 14 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the first data were obtained for the first instance by at least one of an agent executing in the cloud environment and a service offered by a provider of the cloud environment. ### Claim 15 An apparatus comprising: a processor; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, determine one or more characteristics of software that executes on a first instance in a cloud environment based on analysis of first data obtained for the first instance; determine a first cloud resource of the cloud environment that is related to the first instance based on at least one of metadata and data of the first instance; and evaluate compliance of the first cloud resource with a first security policy based on the one or more characteristics determined for the software executing on the first instance. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the first data comprises a first packet obtained for the first instance, wherein the instructions executable by the processor to cause the apparatus to determine the one or more characteristics of the software comprise instructions executable by the processor to cause the apparatus to inspect he first packet with deep packet inspection and determine the one or more characteristics based on results of deep packet inspection of the first packet. ### Claim 17 (depends on 15) The apparatus of claim 15, further comprising instructions executable by the processor to cause the apparatus to indicate compliance of the first cloud resource with the first security policy based on results of evaluating compliance of the first cloud resource with the first security policy. ### Claim 18 (depends on 15) The apparatus of claim 15, further comprising instructions executable by the processor to cause the apparatus to obtain the at least one of metadata and data of the first instance from a provider of the cloud environment, wherein the at least one of metadata and data of the first instance indicate one or more cloud resources with which the first instance has a relationship, wherein the one or more cloud resources includes the first cloud resource. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the first data were obtained for the first instance by at least one of an agent executing in the cloud environment and a service offered by a provider of the cloud environment. ### Claim 20 (depends on 19) The apparatus of claim 19, further comprising instructions executable by the processor to cause the apparatus to obtain the first data from cloud storage of the cloud environment, wherein the first data comprises a first packet that was sampled from network traffic corresponding to the first instance by at least one of the agent and the service offered by the provider of the cloud environment, and wherein at least one of the agent and the service stored the first packet in the cloud storage based on sampling of the first packet from network traffic.