Granted Patent B2

US 11,431,735 · App. 16/585,967 · Granted Aug 30, 2022

Inventor: Avi Shua (Tel Aviv, IL)

Assignee: Orca Security LTD.

H04L63/1416G06F9/45558G06F11/1464G06F16/128H04L63/1433H04L63/1441G06F2009/45562G06F2009/45583G06F2009/45587G06F2009/45591G06F2009/45595G06F2201/84

Abstract

Claims (58)

1. A method for securing virtual cloud assets in a cloud computing environment against cyber threats, comprising:

determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alerting detected potential cyber threats based on a determined priority.

2. The method of claim 1 , further comprising:

prioritizing each of the detected potential cyber threats based on their respective risk to the protected virtual cloud asset; and

mitigating a potential cyber threat posing a risk to the protected virtual cloud asset.

3. The method of claim 1 , wherein determining the location of the snapshot of at least one virtual disk further comprises:

determining a virtual disk allocated to the protected virtual cloud asset.

4. The method of claim 2 , further comprising:

querying a cloud management console of the cloud computing environment to determine the location of the snapshot and the location of the virtual disk.

5. The method of claim 1 , wherein analyzing the snapshot of the protected virtual cloud asset further comprises:

parsing a copy of the snapshot; and

scanning the parsed copy to detect the potential cyber threats, wherein the potential cyber threats include known and unknown vulnerabilities, and wherein the detection is based on a type of vulnerability.

6. The method of claim 5 , wherein scanning the parsed copy further comprises any one of:

checking configuration files of applications and operating system installed in the protected virtual cloud asset;

verifying access times to files by the operating system installed in the operating system;

analyzing system logs to deduce what applications and modules executed in the protected virtual cloud asset; and

analyzing machine memory stored in the snapshot to deduce what applications and modules executed in the protected virtual cloud asset.

7. The method of claim 5 , further comprising:

instantiating an instance copy of the protected virtual cloud asset from the snapshot; and

monitoring all activity performed by the instance copy of the protected virtual cloud asset.

8. The method of claim 5 , wherein scanning the parsed copy further comprises any one of:

reading process identification number (PID) files; and

checking if the at least access times of the PID files match against process descriptors.

9. The method of claim 1 , wherein the protected virtual cloud asset includes any one of: a virtual machine, a software container, a micro-service.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for securing virtual cloud assets in a cloud computing environment against cyber threats, the process comprising:

determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alerting detected potential cyber threats based on a determined priority.

11. A system for securing virtual cloud assets in a cloud computing environment against cyber threats, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

determine a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

access the snapshot of the virtual disk based on the determined location;

analyze the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alert detected potential cyber threats based on a determined priority.

12. The system of claim 11 , wherein the system is further configured to:

prioritize each detected of potential cyber threats based on their respective risk to the protected virtual cloud asset; and

mitigate a potential cyber threat posing a risk to the protected virtual cloud asset.

13. The system of claim 11 , wherein determining the location of the snapshot of at least one virtual disk further comprises:

determining a virtual disk allocated to the protected virtual cloud asset.

14. The system of claim 12 , wherein the system is further configured to:

query a cloud management console of the cloud computing environment to determine the location of the snapshot and the location of the virtual disk.

15. The system of claim 11 , wherein analyzing the snapshot of the protected virtual cloud asset further comprises:

parsing a copy of the snapshot; and

scanning the parsed copy to detect the potential cyber threats, wherein the potential cyber threats include known and unknown vulnerabilities, and wherein the detection is based on a type of vulnerability.

16. The system of claim 15 , wherein scanning the parsed copy further comprises any one of:

checking configuration files of applications and operating system installed in the protected virtual cloud asset;

verifying access times to files by the operating system installed in the operating system;

analyzing system logs to deduce what applications and modules executed in the protected virtual cloud asset; and

analyzing machine memory stored in the snapshot to deduce what applications and modules executed in the protected virtual cloud asset.

17. The system of claim 15 , wherein the system is further configured to:

Instantiate an instance copy of the protected virtual cloud asset from the snapshot; and monitor all activity performed by the instance copy of the protected virtual cloud asset.

18. The system of claim 15 , wherein scanning the parsed copy further comprises any one of:

reading process identification number (PID) files; and

checking if the access times of at least the PID files match against process descriptors.

19. The system of claim 11 , wherein the protected virtual cloud asset includes any one of: a virtual machine, a software container, a micro-service.

Assignments (1)

Continuity (2)

Cited By (113)

US 12,204,930 US 12,206,696 US 12,244,621 US 12,248,581 US 12,261,866 US 12,267,345 US 12,271,490 US 12,284,197 US 12,309,181 US 12,309,182 US 12,309,185 US 12,309,236 US 12,323,449 US 12,335,286 US 12,335,348 US 12,341,797 US 12,348,545 US 12,355,626 US 12,355,787 US 12,355,793 US 12,361,140 US 12,363,148 US 12,368,745 US 12,368,746 US 12,368,747 US 12,375,573 US 12,381,901 US 12,395,573 US 12,401,669 US 12,405,849 US 12,407,701 US 12,407,702 US 12,418,552 US 12,418,555 US 12,425,428 US 12,425,430 US 12,438,902 US 12,445,474 US 12,452,279 US 12,457,231 US 12,463,994 US 12,463,995 US 12,463,996 US 12,463,997 US 12,464,003 US 12,470,577 US 12,470,578 US 12,483,576 US 12,489,770 US 12,489,771 US 12,495,052 US 12,500,910 US 12,500,911 US 12,500,912 US 12,505,126 US 12,506,762 US 12,511,110 US 12,513,221 US 12,517,752 US 12,526,297 US 12,537,836 US 12,537,837 US 12,537,839 US 12,537,840 US 12,537,884 US 12,547,733 US 12,549,575 US 12,549,577 US 12,556,548 US 12,556,559 US 12,563,060 US 12,563,064 US 12,563,071 US 12,563,072 US 12,563,083 US 12,580,932 US 12,580,934 US 12,580,935 US 12,580,936 US 12,580,937 US 12,587,553 US 12,592,950 US 12,598,205 US 12,613,930 US 12,615,271 US 12,621,324 US 12,621,329 US 12,627,686 US 12,627,687 US 12,627,690 US 12,634,312 US 12,634,376 US 12,652,302 US 12,659,325 US 12,659,326 US 12,659,327 US 12,659,333 US 12,676,874 US 12,683,989 US 12,689,638 US 12,689,640 US 12,693,881 US 12,695,768 US 12,706,931 US 12,706,932 US 12,706,933 US 12,706,980 US 12,712,897 US 12,719,896 US 12,726,495 US 12,730,899 US 12,739,266 US 12,739,267