System and method for tracing cloud computing environment deployments to code objects utilizing unique fingerprints
A system and method for improving inspection of software containers is presented. The method includes detecting a plurality of configuration files, each corresponding to a software container image corresponding to a software container deployed in the cloud computing environment; parsing a first configuration file to detect a first plurality of commands; generating a first fingerprint based on the detected first plurality of commands; parsing a second configuration file to detect a second plurality of commands; generating a second fingerprint based on the detected second plurality of commands; determining that the first configuration file matches the second configuration file in response to detecting a match based on the fingerprints; determining that the first configuration file mismatches the second configuration file in response to detecting a mismatch; and inspecting the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.
1. A method for improving inspection of software containers deployed in a cloud computing environment, comprising:
detecting a plurality of configuration files, each configuration file corresponding at least to a software container image, the software container image corresponding to a software container deployed in the cloud computing environment;
parsing a first configuration file of the plurality of configuration files to detect a first plurality of commands;
generating a first fingerprint based at least on the detected first plurality of commands;
parsing a second configuration file of the plurality of configuration files to detect a second plurality of commands;
generating a second fingerprint based at least on the detected second plurality of commands;
determining that the first configuration file matches the second configuration file in response to detecting a match based on the first fingerprint and the second fingerprint;
determining that the first configuration file mismatches the second configuration file in response to detecting a mismatch based on the first fingerprint and the second fingerprint; and
inspecting the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.
2. The method of claim 1 , further comprising:
generating another second fingerprint when it is determined that the first configuration file mismatches the second configuration file.
3. The method of claim 2 , further comprising:
generating another second fingerprint based on an another configuration file, which is not the second configuration file.
4. The method of claim 1 , further comprising:
generating a first fingerprint based on: a command, a number of commands, a sequence of commands, a configuration of a command, an argument of a command, a parameter of a command, and any combination thereof.
5. The method of claim 1 , further comprising:
generating a second fingerprint based on: commands, number of commands, sequence of commands, a configuration of commands, and any combination thereof.
6. The method of claim 1 , further comprising:
parsing the first configuration file to detect code objects, code, commands, and any combination thereof.
7. The method of claim 1 , further comprising:
parsing the second configuration file to detect code objects, code, commands, and any combination thereof.
8. The method of claim 1 , further comprising:
detecting a cybersecurity object, wherein the cybersecurity object is associated with a cybersecurity threat.
9. The method of claim 8 , wherein the cybersecurity threat includes any one of: an exposure, a vulnerability, malware, ransomware, spyware, a misconfiguration, and any combination thereof.
10. A non-transitory computer-readable medium storing a set of instructions for improving inspection of software containers deployed in a cloud computing environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
detect a plurality of configuration files, each configuration file corresponding at least to a software container image, the software container image corresponding to a software container deployed in the cloud computing environment;
parse a first configuration file of the plurality of configuration files to detect a first plurality of commands;
generate a first fingerprint based at least on the detected first plurality of commands;
parse a second configuration file of the plurality of configuration files to detect a second plurality of commands;
generate a second fingerprint based at least on the detected second plurality of commands;
determine that the first configuration file matches the second configuration file in response to detecting a match based on the first fingerprint and the second fingerprint;
determine that the first configuration file mismatches the second configuration file in response to detecting a mismatch based on the first fingerprint and the second fingerprint; and
inspect the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.
11. A system for improving inspection of software containers deployed in a cloud computing environment comprising:
one or more processing circuitries configured to:
detect a plurality of configuration files, each configuration file corresponding at least to a software container image, the software container image corresponding to a software container deployed in the cloud computing environment;
parse a first configuration file of the plurality of configuration files to detect a first plurality of commands;
generate a first fingerprint based at least on the detected first plurality of commands;
parse a second configuration file of the plurality of configuration files to detect a second plurality of commands;
generate a second fingerprint based at least on the detected second plurality of commands;
determine that the first configuration file matches the second configuration file in response to detecting a match based on the first fingerprint and the second fingerprint;
determine that the first configuration file mismatches the second configuration file in response to detecting a mismatch based on the first fingerprint and the second fingerprint; and
inspect the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.
12. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
generate another second fingerprint when it is determined that the first configuration file mismatches the second configuration file.
13. The system of claim 12 , wherein the one or more processing circuitries are further configured to:
generate another second fingerprint based on an another configuration file, which is not the second configuration file.
14. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
generate a first fingerprint based on: a command, a number of commands, a sequence of commands, a configuration of a command, an argument of a command, a parameter of a command, and any combination thereof.
15. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
generate a second fingerprint based on: commands, number of commands, sequence of commands, a configuration of commands, and any combination thereof.
16. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
parse the first configuration file to detect code objects, code, commands, and any combination thereof.
17. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
parse the second configuration file to detect code objects, code, commands, and any combination thereof.
18. The system of claim 11 , wherein the one or more processing circuitries are further configured to:
detect a cybersecurity object, wherein the cybersecurity object is associated with a cybersecurity threat.
19. The system of claim 18 , wherein the cybersecurity threat includes any one of: an exposure, a vulnerability, malware, ransomware, spyware, a misconfiguration, and any combination thereof.