# US 12,603,897 B2 · Attack chain identification via misconfigurations in cloud resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,897 B2 - Document ID: US12603897B2 - Status: Granted - Kind: B2 - Application number: 17/816,334 - Filed: 2022-07-29 - Published: 2024-02-01 - Granted: 2026-04-14 - Earliest claimed: 2022-07-29 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Krishnan Shankar Narayan; Praveen Herur - Web page: https://patentgrep.com/patent/US12603897B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cloud resource management system detects resource misconfiguration for resources in a cloud including cloud policy misconfigurations and resource vulnerabilities. An attack chain analyzer identifies attack chains from misconfigured resources ordered according to stages in an attack framework that models sequential behavior for malicious attacks. The attack chains are detected according to a depth-first search traversal of adjacent resources that have pairwise exposure according to characteristics indicated in the cloud policy misconfigurations and resource vulnerabilities. The attack chain analyzer generates further diagnostics that inform remediation of resource misconfigurations for malicious attack prevention. ## Claims ### Claim 1 A method comprising: detecting a plurality of misconfigurations for a subset of resources in a plurality of resources, wherein the plurality of misconfigurations comprises at least one of policy misconfigurations and vulnerabilities for the subset of resources; generating a graph structure having vertices corresponding to the subset of resources and edges corresponding to pairs of resources in the subset of resources with pairwise exposure characteristics indicated in the plurality of misconfigurations; identifying, from sequences of resources in the graph structure, a first sequence of resources arranged according to sequential stages in an attack stage framework, wherein each pair of consecutive resources in the first sequence of resources comprises a pair of resources that correspond to a sequential stage of the sequential stages in the attack stage framework; and based on identifying the first sequence of resources, remediating misconfigurations for one or more resources in the first sequence of resources. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the first sequence of resources from the subset of resources arranged according to sequential stages of corresponding resources in an attack stage framework comprises traversing the graph structure for the plurality of resources from a first vertex corresponding to a first initial resource in the first sequence of resources, wherein traversing the graph structure comprises traversing the graph structure along edges in the graph structure to adjacent vertices corresponding to resources having same or later stages in the attack stage framework. ### Claim 3 (depends on 2) The method of claim 2, wherein traversing the graph structure for the plurality of resources comprises depth-first searching the graph structure for the plurality of resources. ### Claim 4 (depends on 3) The method of claim 3, further comprising ordering adjacent vertices during the depth-first searching of the graph structure for the plurality of resources according to sequential stages in the attack stage framework for resources corresponding to the adjacent vertices. ### Claim 5 (depends on 1) The method of claim 1, further comprising identifying a second sequence of resources from the subset of resources. ### Claim 6 (depends on 5) The method of claim 5, wherein identifying the second sequence of resources comprises traversing the graph structure for the plurality of resources from a second vertex corresponding to a second initial resource in the second sequence of resources. ### Claim 7 (depends on 1) The method of claim 1, wherein remediating misconfigurations for one or more resources in the first sequence of resources comprises, determining that a severity metric for a vulnerable resource in the one or more resources is above a first threshold for remediation; and based on determining that the severity metric for the vulnerable resource in the one or more resources is above the first threshold, updating at least one of software and firmware at the vulnerable resource corresponding to a security vulnerability for the vulnerable resource. ### Claim 8 (depends on 1) The method of claim 1, wherein remediating misconfigurations for one or more resources in the first sequence of resources comprises, determining that a severity metric for pairwise exposure characteristics for a first pair of resources in the one or more resources is above a second threshold for remediation; and based on determining that the severity metric is above the second threshold for remediation, updating a policy for at least one resource in the first pair of resources. ### Claim 9 (depends on 1) The method of claim 1, wherein remediating misconfigurations for one or more resources in the first sequence of resources comprises, identifying a set of key resources from the first sequence of resources that expose remaining resources in the first sequence of resources to security vulnerabilities; and remediating misconfigurations for the set of key resources. ### Claim 10 (depends on 1) The method of claim 1, wherein the first sequence of resources comprises a potential attack chain for a malicious attack to the plurality of resources. ### Claim 11 A non-transitory computer-readable medium having program code stored thereon, the program code comprising instructions to: detect a first cloud resource of a plurality of cloud resources that has a misconfiguration, wherein cloud resources in the plurality of cloud resources are related according to a graph structure with vertices of the graph structure corresponding to cloud resources and edges of the graph structure corresponding to exposure characteristics for pairs of cloud resources in the plurality of cloud resources; traverse the graph structure from a first vertex indicating the first cloud resource, wherein the instructions to traverse the graph structure comprise instructions to traverse the graph structure through vertices indicating cloud resources arranged according to sequential attack stages in an attack stage framework; and identify a potential attack chain of cloud resources in the plurality of cloud resources based, at least in part, on the traversal of the graph structure. ### Claim 12 (depends on 11) The computer-readable medium of claim 11, wherein the instructions to traverse the graph structure according to sequential stages in the attack framework indicated in vertices corresponding to resources in the plurality of cloud resources comprise instructions to depth-first search the graph structure with adjacent vertices in the graph structure ordered according to sequential stages in the attack framework indicated in the adjacent vertices. ### Claim 13 (depends on 11) The computer-readable medium of claim 11, wherein the program code further comprises instructions to, based on identifying the potential attack chain of cloud resources in the plurality of cloud resources, remediate one or more resources in the potential attack chain of cloud resources. ### Claim 14 (depends on 13) The computer-readable medium of claim 13, wherein the instructions to remediate one or more resources in the potential attack chain of cloud resources comprise instructions to at least one of, update policy misconfigurations of resources in the one or more resources; and update at least of one of software and firmware of resources in the one or more resources, wherein the at least one of software and firmware is exposed to one or more security vulnerabilities. ### Claim 15 An apparatus comprising: a processor; and a non-transitory computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, generate one or more structures comprising a graph structure of a first plurality of cloud resources based on at least one of policy misconfigurations and resource vulnerabilities for resources of the first plurality of cloud resources; identify one or more potential attack chains based on traversal of the one or more structures comprising the graph structure, wherein each potential attack chain in the one or more potential attack chains comprises an ordered sequence of cloud resources from the first plurality of cloud resources, wherein the instructions executable by the processor to cause the apparatus to identify the one or more potential attack chains based on traversal of the one or more structures comprising the graph structure comprise instructions executable by the processor to cause the apparatus to, for each structure in the one or more structures corresponding to an attack chain in the one or more potential attack chains, traverse the structure from a first vertex in the structure according to sequential stages in an attack stage framework for resources corresponding to additional vertices in the structure; and remediate at least a subset of the one or more potential attack chains based, at least in part, on the policy misconfigurations and resource vulnerabilities for resources in the first plurality of cloud resources. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the instructions executable by the processor to cause the apparatus to traverse the structure from the first vertex in the structure according to sequential stages in the attack stage framework for resources corresponding to vertices in the structure comprise instructions executable by the processor to cause the apparatus to depth-first search the structure from the first vertex according to sequential stages in the attack stage framework for resources corresponding to vertices in the structure. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the instructions to remediate at least the subset of the one or more potential attack chains comprise instructions executable by the processor to cause the apparatus to, identify the subset of the one or more potential attack chains for remediation based, at least in part, on severity metrics for policy misconfigurations and resource vulnerabilities of resources in the one or more potential attack chains; and remediate at least one of policy misconfigurations and resource vulnerabilities for resources in the identified subset of the one or more potential attack chains. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the instructions to remediate the at least the subset of the one or more potential attack chains comprise instructions executable by the processor to cause the apparatus to at least one of, update policy misconfigurations of resources in the first plurality of cloud resources; and update at least of one of software and firmware of resources in the first plurality of cloud resources, wherein the at least one of software and firmware is exposed to one or more resource vulnerabilities.