Granted Patent B2

US 12,554,856 · App. 18/115,101 · Granted Feb 17, 2026

Inventors: Shachee Mishra Gupta (Gurgaon, IN); Ashok Pon Kumar Sree Prakash (Bangalore, IN); Abhishek Jain (Pune, IN)

Assignee: International Business Machines Corporation

G06F21/577G06F8/61G06F21/554G06F2221/033

Abstract

Claims (60)

1 . An apparatus, comprising:

a memory configured to store computer-executable instructions; and

a processor configured to execute the computer-executable instructions to:

perform a static analysis of a code associated with a software artifact, wherein the software artifact is hosted by a first pod within a cluster of a host platform;

determine, based on the static analysis, that the code comprises a security vulnerability;

identify, based on the determination, a specific function among a plurality of functions within the software artifact, wherein the specific function requests the code;

activate, within the first pod, a filter on the specific function to restrict execution of the specific function while allowing the plurality of functions other than different from the specific function within the software artifact to continue with operations uninterrupted;

identify, based on the activation of the filter, a second pod, different from the first pod, within the cluster, wherein

the second pod is capable of execution of the specific function, and

the second pod does not contain the security vulnerability;

detect a request for the specific function;

offload, based on the detection of the request, the request to the second pod within the cluster for the execution of the specific function;

install, based on the offload of the request, a fix for the security vulnerability within the software artifact; and

deactivate, based on the installation of the fix within the software artifact, the filter within the first pod.

2 . The apparatus of claim 1 , wherein;

the filter comprises a secure computing mode (SECCOMP) filter, and

the processor is further configured to:

apply the SECCOMP filter to a kernel of an operating system of the first pod.

3 . The apparatus of claim 1 , wherein the processor is further configured to:

scan log data of the first pod; and

identify, based on the scanned log data, a version of the software artifact and a name of the software artifact.

4 . The apparatus of claim 3 , wherein the processor is further configured to:

query, based on the identified version and the identified name, a database to identify the security vulnerability.

5 . The apparatus of claim 1 , wherein the processor is further configured to:

download the fix from a software repository, wherein the software repository is associated with an operating system of the first pod.

6 . A computer-implemented method, comprising:

performing a static analysis of a code associated with a software artifact, wherein the software artifact is hosted by a first pod within a cluster of a host platform;

determining, based on the static analysis, that the code comprises a security vulnerability;

identifying, based on the determination, a specific function among a plurality of functions within the software artifact, wherein the specific function requests the code;

activating, within the first pod, a filter on the specific function to restrict execution of the specific function while allowing the plurality of functions different from the specific function within the software artifact to continue operating uninterrupted;

identifying, based on the activating of the filter, a second pod, different from the first pod, within the cluster, wherein

the second pod is capable of execution of the specific function, and

the second pod does not contain the security vulnerability;

detecting a request for the specific function;

offloading, based on the detecting of the request, the request to the second pod within the cluster for the execution of the specific function;

installing, based on the offloading of the request, a fix for the security vulnerability within the software artifact; and

deactivating, based on the installing of the fix within the software artifact, the filter within the first pod.

7 . The computer-implemented method of claim 6 , wherein:

the filter further comprises a secure computing mode (SECCOMP) filter, and

the computer-implemented method further comprises:

applying the SECCOMP filter to a kernel of an operating system of the first pod.

8 . The computer-implemented method of claim 6 , wherein the determining further comprises:

scanning log data of the first pod; and

identifying, based on the scanning of the log data, a version of the software artifact and a name of the software artifact.

9 . The computer-implemented method of claim 8 , wherein the determining further comprises:

querying, based on the identified version and the identified name, a database to identify the security vulnerability.

10 . The computer-implemented method of claim 6 , wherein the computer-implemented method further comprises:

downloading the fix from a software repository, wherein the software repository is associated with an operating system of the first pod.

11 . A computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:

performing a static analysis of a code associated with a software artifact, wherein the software artifact is hosted by a first pod within a cluster of a host platform;

determining, based on the static analysis, that the code comprises a security vulnerability;

identifying, based on the determination, a specific function among a plurality of functions within the software artifact, wherein the specific function requests the code;

activating, within the first pod, a filter on the specific function to restrict execution of the specific function while allowing the plurality of functions other than different from the specific function within the software artifact to continue operating uninterrupted;

identifying, based on the activating of the filter, a second pod, different from the first pod, within the cluster, wherein

the second pod is capable of execution of the specific function, and

the second pod does not contain the security vulnerability;

detecting a request for the specific function;

offloading, based on the detecting of the request, the request to the second pod within the cluster for the execution of the specific function;

installing, based on the offloading of the request, a fix for the security vulnerability within the software artifact; and

deactivating, based on the installing of the fix within the software artifact, the filter within the first pod.

Assignments (1)

Continuity (1)

References Cited (25)