Granted Patent B2

US 12,411,957 · App. 17/818,898 · Granted Sep 9, 2025

Inventors: Matilda Lidgi (Tel Aviv, IL); Shai Keren (Tel Aviv, IL); Raaz Herzberg (Tel Aviv, IL); Avi Tal Lichtenstein (Tel Aviv, IL); Ami Luttwak (Binyamina, IL); Roy Reznik (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F21/577G06F2221/034

Abstract

Claims (48)

1. A method for detecting an application path utilizing active inspection of a cloud computing environment, comprising:

selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment;

selecting a second resource having a second network path based on the network path of the reachable resource;

traversing a security graph to detect a second resource node, wherein the second resource node is connected to a first resource node, and wherein the first resource node represents the reachable resource and the second resource node represents the second resource;

generating the second network path further based on an attribute stored in the second resource node; and

actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

2. The method of claim 1 , wherein the reachable resource is any one of: a virtual machine, and a container.

3. The method of claim 1 , wherein the second resource is an application deployed on the reachable resource.

4. The method of claim 1 , further comprising:

generating an access instruction based on the at least one network path and the second network path.

5. The method of claim 1 , wherein the at least one network path includes a hostname, and the second network path includes an application path.

6. The method of claim 1 , wherein any one of further includes an access port: the at least one network path, the second network path, and a combination thereof.

7. The method of claim 1 , further comprising:

determining a plurality of second network paths of the second resource; and

actively inspecting each second network path of the plurality of second network paths to determine if the second resource is accessible through each second network path from the reachable resource.

8. The method of claim 1 , further comprising:

generating the second network path based on a local application address.

9. The method of claim 1 , further comprising:

generating the second network path based on any one of: a predetermined address, a predetermined port, and a combination thereof.

10. The method of claim 1 , wherein the application path includes a value indicating where in a file directory the second resource is stored.

11. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment;

selecting a second resource having a second network path based on the network path of the reachable resource;

traversing a security graph to detect a second resource node, wherein the second resource node is connected to a first resource node, and wherein the first resource node represents the reachable resource and the second resource node represents the second resource;

generating the second network path further based on an attribute stored in the second resource node; and

actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

12. A system for detecting an application path utilizing active inspection of a cloud computing environment, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

select a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment;

select a second resource having a second network path based on the network path of the reachable resource;

traverse a security graph to detect a second resource node, wherein the second resource node is connected to a first resource node, and wherein the first resource node represents the reachable resource and the second resource node represents the second resource;

generate the second network path further based on an attribute stored in the second resource node; and

actively inspect the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

13. The system of claim 12 , wherein the reachable resource is any one of: a virtual machine, and a container.

14. The system of claim 12 , wherein the second resource is an application deployed on the reachable resource.

15. The system of claim 12 , wherein the memory contains further instructions, that when executed by the processing circuitry further configure the system to:

generate an access instruction based on the at least one network path and the second network path.

16. The system of claim 12 , wherein the at lease one network path includes a hostname, and the second network path includes an application path.

17. The system of claim 12 , wherein any one of further includes an access port: the at least one network path, the second network path, and a combination thereof.

18. The system of claim 12 , wherein the memory contains further instructions, that when executed by the processing circuitry further configure the system to:

determine a plurality of second network paths of the second resource; and

actively inspect each second network path of the plurality of second network paths to determine if the second resource is accessible through each second network path from the reachable resource.

19. The system of claim 12 , wherein the memory contains further instructions, that when executed by the processing circuitry further configure the system to:

generate the second network path based on a local application address.

20. The system of claim 12 , wherein the memory contains further instructions, that when executed by the processing circuitry further configure the system to:

generate the second network path based on any one of: a predetermined address, a predetermined port, and a combination thereof.

21. The system of claim 12 , wherein the application path includes a value indicating where in a file directory the second resource is stored.

Assignments (1)

Continuity (1)

References Cited (400)