Vulnerability Detection in Cloud-Native Web Applications
AssigneeGitLab Inc.
InventorsDean Agron, Ron Vider
Life of this patent
Estimating the term…
Abstract
A method for assessing vulnerable flows in a cloud-native application, the method including the steps of: mapping runtime functions in microservices in the cloud-native application; mapping the application cloud-native stack infrastructure configurations; mapping logical flows between microservices and third-party components in the cloud-native application; creating and executing security tests on the mapped logical flows, infrastructure configurations and runtime functions to return tested runtime behavior; and analyzing the tested runtime behavior of the cloud native application to validate the potential vulnerable logical flows so as to return validated vulnerable flows.
Claims20
A method for assessing vulnerable flows in a cloud-native application deployed in a runtime environment, the method comprising:
- observing a plurality of microservices of the cloud-native application in the runtime environment;
- analyzing files on a file system that are accessed by the microservices;
- mapping, based on the observing and the analyzing, runtime functions of the plurality of microservices, wherein mapping the runtime functions comprises;
- mapping stack infrastructure configurations of cloud infrastructure of the cloud-native application;
- mapping logical flows between the plurality of microservices and one or more third-party components in the cloud-native application based on an analysis of the inputs of the input functions and internal communication functions, the mapping of the logical flows generating a list of potential vulnerable logical flows;
- creating security tests to analyze runtime behavior to reduce false positives in the list of potential vulnerable flows;
- validating at least some of the potential vulnerable flows as validated vulnerable flows by executing the security tests on the mapped logical flows, the infrastructure configurations, and the runtime functions of the cloud-native application;
- and
- providing a visualization for display including information about at least some of the validated vulnerable flows.
A non-transitory computer-readable medium comprising stored instructions that, when executed, cause a computing system to perform operations including:
- observing a plurality of microservices of the cloud-native application in the runtime environment;
- analyzing files on a file system that are accessed by the microservices;
- mapping, based on the observing and the analyzing, runtime functions of the plurality of microservices, wherein mapping the runtime functions comprises;
- mapping stack infrastructure configurations of cloud infrastructure of the cloud-native application;
- mapping logical flows between the plurality of microservices and one or more third-party components in the cloud-native application based on an analysis of the inputs of the input functions and internal communication functions, the mapping of the logical flows generating a list of potential vulnerable logical flows;
- creating security tests to analyze runtime behavior to reduce false positives in the list of potential vulnerable flows;
- validating at least some of the potential vulnerable flows as validated vulnerable flows by executing the security tests on the mapped logical flows, the infrastructure configurations, and the runtime functions of the cloud-native application;
- and
- providing a visualization for display including information about at least some of the validated vulnerable flows.
Dependencies are inferred from the claim text.