Detecting malware infection path in a cloud computing environment utilizing a security graph
A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.
1. A method for detecting a malware infection path in a compute environment, comprising:
detecting a cybersecurity object, indicating a malware, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network;
traversing the security graph from the resource node to the endpoint node to generate a plurality of potential infection paths between the resource node and the endpoint node;
inspecting a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths;
determining that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload;
determining that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object;
monitoring the second workload for the cybersecurity object in response to determining that the first potential infection path is not an infection path; and
initiating a mitigation action in response to detecting the cybersecurity object on the second workload.
2. The method of claim 1 , further comprising:
generating the mitigation action to isolate the cybersecurity object, wherein the cybersecurity object is a malware code.
3. The method of claim 1 , further comprising:
traversing the security graph to detect a number of second resource nodes connected to the resource node; and
initiating the mitigation action in response to determining that the number of second resource nodes exceeds a threshold.
4. The method of claim 1 , further comprising:
determining that the first workload is authorized to access the second workload.
5. The method of claim 4 , further comprising:
determining that the first workload is authorized to access the second workload by detecting a vertex in the security graph connecting the second resource node to the resource node, wherein the vertex indicates an authorization to access.
6. The method of claim 5 , further comprising:
generating an impact analysis of the malware on a potential infection path of the plurality of potential infections paths, including an identifier of the second workload, in response to detecting the vertex in the security graph.
7. The method of claim 1 , further comprising:
generating an instruction to inspect the second workload to detect the cybersecurity object.
8. The method of claim 7 , further comprising:
generating an inspectable disk based on a disk of the second workload; and
providing access of the inspectable disk to a malware inspector, wherein the malware inspector is a software application deployed in a software container cluster.
9. The method of claim 8 , further comprising:
initiating the mitigation action on the second workload.
10. The method of claim 1 , further comprising:
accessing a malware database to retrieve a first malware signature corresponding to the malware; and
inspecting the first workload for the malware based on the first malware signature.
11. A non-transitory computer-readable medium storing a set of instructions for detecting a malware infection path in a compute environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect a cybersecurity object, indicating a malware, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network;
traverse the security graph from the resource node to the endpoint node to generate a plurality of potential infection paths between the resource node and the endpoint node
inspect a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths
determine that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload;
determine that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object;
monitor the second workload for the cybersecurity object in response to determining that the first potential infection path is not an infection path; and
initiate a mitigation action in response to detecting the cybersecurity object on the second workload.
12. A system for detecting a malware infection path in a compute environment comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a cybersecurity object, indicating a malware, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph further including an endpoint node representing access to a public access network;
traverse the security graph from the resource node to the endpoint node to generate a plurality of potential infection paths between the resource node and the endpoint node
inspect a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths
determine that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload;
determine that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object;
monitor the second workload for the cybersecurity object in response to determining that the first potential infection path is not an infection path; and
initiate a mitigation action in response to detecting the cybersecurity object on the second workload.
13. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the mitigation action to isolate the cybersecurity object, wherein the cybersecurity object is a malware code.
14. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
traverse the security graph to detect a number of second resource nodes connected to the resource node; and
initiate the mitigation action in response to determining that the number of second resource nodes exceeds a threshold.
15. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the first workload is authorized to access the second workload.
16. The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the first workload is authorized to access the second workload by detecting a vertex in the security graph connecting the second resource node to the resource node, wherein the vertex indicates an authorization to access.
17. The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an impact analysis of the malware on a potential infection path of the plurality of potential infections paths, including an identifier of the second workload, in response to detecting the vertex in the security graph.
18. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an instruction to inspect the second workload to detect the cybersecurity object.
19. The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an inspectable disk based on a disk of the second workload; and
provide access of the inspectable disk to a malware inspector, wherein the malware inspector is a software application deployed in a software container cluster.
20. The system of claim 19 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action on the second workload.
21. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
access a malware database to retrieve a first malware signature corresponding to the malware; and
inspect the first workload for the malware based on the first malware signature.