Instruction-level threat assessment
Instruction-level threat assessment, including: identifying one or more probe insertion points in code of a package corresponding to one or more vulnerabilities of the package; inserting, into one or more instances of the package deployed in one or more hosts of a cloud deployment, one or more probes based on the one or more probe insertion points; and elevating a severity of a particular vulnerability in response to reaching a particular probe of the one or more probes.
1. A method of instruction-level threat assessment, the method comprising:
identifying one or more probe insertion points in code of a package corresponding to one or more vulnerabilities of the package;
inserting, into one or more instances of the package deployed in one or more hosts of a cloud deployment, one or more probes based on the one or more probe insertion points, wherein inserting the one or more probes comprises inserting the one or more probes for a binary instance of the package corresponding to the one or more probe insertion points in the code of the package; and
elevating a severity of a particular vulnerability in response to reaching a particular probe of the one or more probes.
2. The method of claim 1 , wherein identifying the one or more probe insertion points comprises identifying the one or more probe insertion points based on one or more changes to the code of the package in one or more patches for the one or more vulnerabilities of the package.
3. The method of claim 1 , wherein inserting the one or more probes is performed by an agent executed in each of the one or more hosts.
4. The method of claim 3 , wherein elevating the severity of the particular vulnerability is performed in response to the agent detecting that an execution of a binary instance package has reached the particular probe.
5. The method of claim 1 , wherein identifying the one or more probe insertion points comprises:
identifying a plurality of potential probe insertion points;
determining that the plurality of potential probe insertion points share a common execution path; and
identifying, as one of the one or more probe insertion points, a single probe insertion point instead of the plurality of potential probe insertion points.
6. The method of claim 1 , further comprising terminating an execution of the package in response to reaching the particular probe of the one or more probes.
7. The method of claim 6 , wherein terminating the execution of the package is based on an exploit enabled by the particular vulnerability.
8. The method of claim 1 , wherein the one or more probe insertion points correspond to the particular vulnerability, and wherein elevating the severity of the particular vulnerability comprises elevating the severity of the particular vulnerability in response to determining that each of the one or more probe insertion points have been reached.
9. The method of claim 1 , further comprising providing an indication that the particular probe has been reached to an anomaly detection framework.
10. A computer program product for instruction-level threat assessment, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions configurable to carry out the steps of:
identifying one or more probe insertion points in code of a package corresponding to one or more vulnerabilities of the package;
inserting, into one or more instances of the package deployed in one or more hosts of a cloud deployment, one or more probes based on the one or more probe insertion points, wherein inserting the one or more probes comprises inserting the one or more probes for a binary instance of the package corresponding to the one or more probe insertion points in the code of the package; and
elevating a severity of a particular vulnerability in response to reaching a particular probe of the one or more probes.
11. The computer program product of claim 10 , wherein identifying the one or more probe insertion points comprises identifying the one or more probe insertion points based on one or more changes to the code of the package in one or more patches for the one or more vulnerabilities of the package.
12. The computer program product of claim 10 , wherein inserting the one or more probes is performed by an agent executed in each of the one or more hosts.
13. The computer program product of claim 12 , wherein elevating the severity of the particular vulnerability is performed in response to the agent detecting that an execution of a binary instance package has reached the particular probe.
14. The computer program product of claim 10 , wherein identifying the one or more probe insertion points comprises:
identifying a plurality of potential probe insertion points;
determining that the plurality of potential probe insertion points share a common execution path; and
identifying, as one of the one or more probe insertion points, a single probe insertion point instead of the plurality of potential probe insertion points.
15. The computer program product of claim 10 , wherein the steps further comprise terminating an execution of the package in response to reaching the particular probe of the one or more probes.
16. The computer program product of claim 15 , wherein terminating the execution of the package is based on an exploit enabled by the particular vulnerability.
17. The computer program product of claim 10 , wherein the one or more probe insertion points correspond to the particular vulnerability, and wherein elevating the severity of the particular vulnerability comprises elevating the severity of the particular vulnerability in response to determining that each of the one or more probe insertion points have been reached.
18. The computer program product of claim 10 , wherein the steps further comprise providing an indication that the particular probe has been reached to an anomaly detection framework.