Granted Patent B2

US 12,701,133 · App. 18/883,275 · Granted Aug 4, 2026

Inventor: Nitesh Surana (Bengaluru, IN)

Assignee: Trend Micro Incorporated

H04L63/1433H04L63/1483

Abstract

Claims (38)

1 . A method of scanning a codebase to identify dependencies on vulnerable cloud resources, the method comprising:

identifying a plurality of trusted cloud resources that are accessible over a computer network;

receiving a codebase from a codebase repository;

scanning a source code of the codebase to detect one or more cloud resources that are referenced in the source code by way of a subdomain and that are accessible over the computer network;

for each detected cloud resource, flagging the detected cloud resource as an untrusted cloud resource responsive to determining that the detected cloud resource is not one of the plurality of trusted cloud resources; and

for each untrusted cloud resource, detecting that the untrusted cloud resource is vulnerable to being exploited by a cyberattack in response to determining that the subdomain of the untrusted cloud resource cannot be resolved into an Internet Protocol (IP) address by a Domain Name System (DNS) server and that the subdomain of the untrusted cloud resource can be registered with a cloud service provider.

2 . The method of claim 1 , further comprising:

raising an alert responsive to detecting that the untrusted cloud resource is vulnerable to being exploited by a cyberattack.

3 . The method of claim 2 , wherein raising the alert includes sending a notification to an administrator.

4 . The method of claim 1 , wherein the codebase repository is a version control platform.

5 . The method of claim 1 , wherein the plurality of trusted cloud resources is hosted on a cloud computing platform.

6 . The method of claim 5 , wherein the plurality of trusted cloud resources is identified on the cloud computing platform by a Cloud Security Posture Management (CSPM) tool that is hosted on the cloud computing platform.

7 . A computer system comprising at least one processor and a memory, the memory of the computer system storing instructions that when executed by the at least one processor of the computer system cause the computer system to:

receive a codebase from a codebase repository;

scan a source code of the codebase to detect one or more cloud resources that are referenced in the code source code by way of a subdomain and that are accessible over a computer network;

for each detected cloud resource, flag the detected cloud resource as an untrusted cloud resource responsive to determining that the detected cloud resource is not in an inventory of a plurality of trusted cloud resources; and

for each untrusted cloud resource, detect that the untrusted cloud resource is vulnerable to being exploited by a cyberattack in response to determining that the subdomain of the untrusted cloud resource cannot be resolved into an Internet Protocol (IP) address by a Domain Name System (DNS) server and that the subdomain of the untrusted cloud resource can be registered with a cloud service provider.

8 . The computer system of claim 7 , wherein the instructions stored in the memory of the computer system when executed by the at least one processor of the computer system cause the computer system to:

raise an alert responsive to detecting that the untrusted cloud resource is vulnerable to being exploited by a cyberattack.

9 . The computer system of claim 8 , wherein the alert includes a notification that is sent to another computer.

10 . The computer system of claim 7 , wherein the codebase repository is a version control platform.

11 . The computer system of claim 7 , wherein the plurality of trusted cloud resources is hosted on a cloud computing platform.

12 . The computer system of claim 11 , wherein the plurality of trusted cloud resources is identified on the cloud computing platform by a Cloud Security Posture Management (CSPM) tool that is hosted on the cloud computing platform.

13 . A method of scanning a codebase to identify dependencies on vulnerable cloud resources, the method comprising:

scanning a source code of a codebase for references to cloud resources that are accessible over a computer network;

detecting a referenced cloud resource that is referenced in the source code of of the codebase by way of a subdomain of the referenced cloud resource;

comparing the referenced cloud resource to an inventory of trusted cloud resources; and

detecting that the referenced cloud resource is vulnerable to being exploited by a cyberattack based at least in response to determining that the referenced cloud resource is not listed in the inventory of trusted cloud resources and that the subdomain of the referenced cloud resource cannot be resolved into an Internet Protocol (IP) address by a Domain Name System (DNS) server.

14 . The method of claim 13 , further comprising:

further detecting that the referenced cloud resource is vulnerable to being exploited by a cyberattack in response to determining that the subdomain of the referenced cloud resource can be registered with a cloud service provider.

15 . The method of claim 13 , further comprising:

raising an alert responsive to detecting that the referenced cloud resource is vulnerable to a cyberattack.

16 . The method of claim 15 , wherein raising the alert includes sending a notification to another computer.

17 . The method of claim 13 , further comprising:

receiving the codebase from a codebase repository.

18 . The method of claim 17 , wherein the codebase repository is a version control platform.

19 . The method of claim 13 , wherein the trusted cloud resources in the inventory are hosted on a cloud computing platform.

20 . The method of claim 19 , wherein the trusted cloud resources in the inventory are identified on the cloud computing platform by a Cloud Security Posture Management (CSPM) tool that is hosted on the cloud computing platform.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (25)