Office Action 1: Notice of Allowance (2024-09-11)

CLAIMS:
CLAIMS What is claimed is:
1\. A method for identifying cloud identity misuse based on run-time time data and static analysis, comprising: detecting a workload in a cloud computing environment; configuring the workload to deploy thereon a sensor application, the sensor configured to detect data respective of a runtime process executed on the workload; detecting an original disk associated with the workload; generating an inspectable disk based on the original disk; inspecting the inspectable disk for a cybersecurity object utilizing static analysis; detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspecting a code object for an identity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on: an identifier of the workload, the identity object, and the cybersecurity object; and generating an enriched log including an identifier of the runtime process associated with the event.
2\. The method of claim 1, further comprising: detecting an identifier of the cybersecurity object; and determining that the runtime process is executed based on a software associated with the cybersecurity object based on the detected identifier.
3\. The method of claim 1, further comprising: cloning the original disk into the inspectable disk; and releasing a resource allocated to the inspectable disk in response to completing inspection of the inspectable disk.
4\. The method of claim 1, further comprising: configuring the sensor to detect a cloud API call, the cloud API call including an identifier of the identity object.
5\. The method of claim 1, further comprising: storing a representation of the workload, a representation of the identity and a representation of the event in a security database, in response to detecting the cybersecurity object on the inspectable disk.
6\. The method of claim 1, further comprising: accessing an infrastructure as code (IaC) platform to detect the code object.
7\. The method of claim 1, further comprising: associating the runtime process with the event further based on the detected runtime data.
8\. The method of claim 1, further comprising: applying a cybersecurity policy to the enriched log.
9\. The method of claim 8, further comprising: initiating a remediation action, in response to detecting that a condition of the applied cybersecurity policy results in a failure.
10\. A non-transitory computer-readable medium storing a set of instructions for identifying cloud identity misuse based on run-time time data and static analysis, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: detect a workload in a cloud computing environment; configure the workload to deploy thereon a sensor application, the sensor configured to detect data respective of a runtime process executed on the workload; detect an original disk associated with the workload; generate an inspectable disk based on the original disk; inspect the inspectable disk for a cybersecurity object utilizing static analysis; detect in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspect a code object for an identity object, the code object utilized in deploying the workload in the cloud computing environment; associate the runtime process with the event based on: an identifier of the workload, the identity object, and the cybersecurity object; and generate an enriched log including an identifier of the runtime process associated with the event.
11\. A system for identifying cloud identity misuse based on run-time time data and static analysis comprising: a processing circuitry; a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: detect a workload in a cloud computing environment; configure the workload to deploy thereon a sensor application, the sensor configured to detect data respective of a runtime process executed on the workload; detect an original disk associated with the workload; generate an inspectable disk based on the original disk; inspect the inspectable disk for a cybersecurity object utilizing static analysis; detect in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspect a code object for an identity object, the code object utilized in deploying the workload in the cloud computing environment; associate the runtime process with the event based on: an identifier of the workload, the identity object, and the cybersecurity object; and generate an enriched log including an identifier of the runtime process associated with the event.
12\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect an identifier of the cybersecurity object; and determine that the runtime process is executed based on a software associated with the cybersecurity object based on the detected identifier.
13\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: clone the original disk into the inspectable disk; and release a resource allocated to the inspectable disk in response to completing inspection of the inspectable disk.
14\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: configure the sensor to detect a cloud API call, the cloud API call including an identifier of the identity object.
15\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: store a representation of the workload, a representation of the identity and a representation of the event in a security database, in response to detecting the cybersecurity object on the inspectable disk.
16\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: access an infrastructure as code (IaC) platform to detect the code object.
17\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: associate the runtime process with the event further based on the detected runtime data.
18\. The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: apply a cybersecurity policy to the enriched log.
19\. The system of claim 18, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate a remediation action, in response to detecting that a condition of the applied cybersecurity policy results in a failure.

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-19 are pending in this application.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 06/28/2024 was filed before the mailing date of this allowability notice. The submission is in compliance with the provisions of 37 CFR 1.97.  Accordingly, the information disclosure statement is being considered by the examiner.
Allowable Subject Matter
Claims 1-19 are allowed.
Examiner’s Statement for Reasons for Allowance
The following is an examiner’s statement of reasons for allowance:
Regarding independent claims 1, 10 and 11, the examiner found the following relevant prior art:
Yellapragada et al. (US 2023/0208871 A1) teaches generate snapshot (herein, generating snapshot for virtual hard disk is equivalent to generating an inspectable disk) in monitored instances in cloud provider for virtual hard disk and then share that into a version of snapshot stored in cloud service provider; where that copy of the snapshot is then available for analysis by one or more analysis instances (e.g., see, [0118], see also, [0121]). Yellapragada further teaches an analyzer analyzes one or more memory captures to identify the list of running processes, suspicious processes not having a disk image, and/or network related activity, e.g., to gain insight into vulnerabilities which are critical and running on the VM, and/or any malicious programs which do not have a disk image (e.g., see, [0131]).
Xiao et al. (US 2021/0194853 A1) teaches generating a profile of attack traffic based on attack history (e.g., log of events) and implementing a contextual-based analysis for selecting a matching type of vulnerable service from the plurality of container images (e.g., workloads) of distinct types of vulnerable services (e.g., see, [0132]). Xiao further discloses a security agent associated with the instance of the matching type of vulnerable service is executed to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities (e.g., see, [0134]).
Kulkarni et al. (US 11,636,198 B1) teaches analyzing suspicious object in an emulated environment. The analyzer may examine the characteristics of the analyzer may examine the characteristics of the file during and after execution. These characteristics may include the types of data stored as a result of the object's execution, calls made to other systems, contents of memory stacks, etc. the analyzers may utilize static means of threat analysis including, but not limited to, examining object characteristics without execution, and/or generating a hash of the object for comparison with a pre-existing hash database -e.g., see, col. 12, lines 40-67 to col. 13, lines 1-10 of Kulkarni.
Mehrotra et al. (US 2022/0100851 A1) teaches generation of log files which includes files that provide information about the components of the industrial automation system, such as operation histories, maintenance histories, electrical power consumption data, and the like. Log files and events associated with components of the industrial automation system or software utilized to operate or control the components of the industrial automation system-e.g., see, [0067] of Mehrotra.
However, examining the independent claims 1, 10 and 11, especially reviewing the limitation in light of the specification while considering the special meaning of the claimed terms, e.g., “original disk”, “inspectable disk” and “the workload” etc., the examiner concluded that none of the discovered prior art, anticipate or fairly suggest the limitation of applicant’s independent claims, in such a manner that a rejection under 35 U.S.C. 102 or 103 would be proper. As a result, the claimed invention is considered to be in condition for allowance as being novel and non-obvious over prior art.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion



CITED REFERENCE SUMMARIES: Ref US20230208871A1: Claims:
A computer-implemented method comprising: generating an image for an enterprise that indicates one or more software application stacks of a virtual instance of a cloud provider from an application programming interface of the cloud provider and a network architecture for the one or more software application stacks without installing and utilizing security monitoring software on the cloud provider; determining one or more vulnerabilities of the one or more software application stacks and one or more vulnerabilities of the network architecture from the image; providing the one or more vulnerabilities of the one or more software application stacks, and the one or more vulnerabilities of the network architecture as input to a machine learning model; generating an inference by the machine learning model that indicates one or more attack paths for an attacker in the one or more software application stacks and the network architecture; and transmitting the inference to a storage location or a security software application.
generating an image for an enterprise that indicates one or more software application stacks of a virtual instance of a cloud provider from an application programming interface of the cloud provider and a network architecture for the one or more software application stacks without installing and utilizing security monitoring software on the cloud provider;
determining one or more vulnerabilities of the one or more software application stacks and one or more vulnerabilities of the network architecture from the image;
providing the one or more vulnerabilities of the one or more software application stacks, and the one or more vulnerabilities of the network architecture as input to a machine learning model;
generating an inference by the machine learning model that indicates one or more attack paths for an attacker in the one or more software application stacks and the network architecture; and
transmitting the inference to a storage location or a security software application.
The computer-implemented method of claim 1 , wherein the generating the image comprises performing a memory capture of the virtual instance of the cloud provider.
The computer-implemented method of claim 2 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a machine image of the virtual instance and sharing it with a trusted account; creating a test instance from the machine image and isolating the test instance by removing its network access; logging in to the test instance and creating the memory capture of the virtual instance from memory of the test instance; uploading the memory capture to a trusted source; and terminating the test instance.
creating a machine image of the virtual instance and sharing it with a trusted account;
creating a test instance from the machine image and isolating the test instance by removing its network access;
logging in to the test instance and creating the memory capture of the virtual instance from memory of the test instance;
uploading the memory capture to a trusted source; and
terminating the test instance.
The computer-implemented method of claim 3 , wherein the memory capture of the memory of the test instance includes a memory capture of a virtual hard disk and a memory capture of a virtual random access memory (RAM) of the test instance.
The computer-implemented method of claim 2 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a virtual disk; mounting the virtual disk with the virtual instance; and creating the memory capture of the virtual instance from the virtual disk.
creating a virtual disk;
mounting the virtual disk with the virtual instance; and
creating the memory capture of the virtual instance from the virtual disk.
The computer-implemented method of claim 5 , wherein the memory capture of the memory of the virtual instance includes a memory capture of a virtual hard disk and a memory capture of a virtual random access memory (RAM) of the virtual instance.
The computer-implemented method of claim 2 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a plurality of virtual disks; mounting the plurality of virtual disks with the virtual instance; and creating the memory capture of the virtual instance from the plurality of virtual disks.
creating a plurality of virtual disks;
mounting the plurality of virtual disks with the virtual instance; and
creating the memory capture of the virtual instance from the plurality of virtual disks.
The computer-implemented method of claim 1 , wherein the generating the image is without changing a state of the virtual instance.
The computer-implemented method of claim 1 , wherein the generating the image includes determining an operating system of the virtual instance.
The computer-implemented method of claim 1 , wherein the generating the image includes determining any installed software application packages, currently running software, and containers running on the virtual instance.
A computer-implemented method comprising: generating an image for an enterprise that indicates one or more software application stacks of a virtual instance of a cloud provider from an application programming interface of the cloud provider and a network architecture for the one or more software application stacks without installing and utilizing security monitoring software on the cloud provider; determining one or more vulnerabilities of the one or more software application stacks and one or more vulnerabilities of the network architecture from the image; determining one or more anomalies within network traffic of the network architecture; providing the one or more vulnerabilities of the one or more software application stacks, the one or more vulnerabilities of the network architecture, and the one or more anomalies within network traffic of the network architecture as input to a machine learning model; generating an inference by the machine learning model that indicates one or more attack paths for an attacker in the one or more software application stacks and the network architecture; and transmitting the inference to a storage location or a security software application.
determining one or more anomalies within network traffic of the network architecture;
providing the one or more vulnerabilities of the one or more software application stacks, the one or more vulnerabilities of the network architecture, and the one or more anomalies within network traffic of the network architecture as input to a machine learning model;
The computer-implemented method of claim 11 , wherein the generating the image comprises performing a memory capture of the virtual instance of the cloud provider.
The computer-implemented method of claim 12 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a machine image of the virtual instance and sharing it with a trusted account; creating a test instance from the machine image and isolating the test instance by removing its network access; logging in to the test instance and creating the memory capture of the virtual instance from memory of the test instance; uploading the memory capture to a trusted source; and terminating the test instance.
The computer-implemented method of claim 13 , wherein the memory capture of the memory of the test instance includes a memory capture of a virtual hard disk and a memory capture of a virtual random access memory (RAM) of the test instance.
The computer-implemented method of claim 12 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a virtual disk; mounting the virtual disk with the virtual instance; and creating the memory capture of the virtual instance from the virtual disk.
The computer-implemented method of claim 15 , wherein the memory capture of the memory of the virtual instance includes a memory capture of a virtual hard disk and a memory capture of a virtual random access memory (RAM) of the virtual instance.
The computer-implemented method of claim 12 , wherein the performing the memory capture of the virtual instance of the cloud provider comprises: creating a plurality of virtual disks; mounting the plurality of virtual disks with the virtual instance; and creating the memory capture of the virtual instance from the plurality of virtual disks.
The computer-implemented method of claim 11 , wherein the generating the image is without changing a state of the virtual instance.
The computer-implemented method of claim 11 , wherein the generating the image includes determining an operating system of the virtual instance.
The computer-implemented method of claim 11 , wherein the generating the image includes determining any installed software application packages, currently running software, and containers running on the virtual instance.
Ref US20210194853A1: Claims:
A system comprising: a processor configured to: receive tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; select a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forward the tunneled traffic to an instance of the matching type of vulnerable service; and a memory coupled to the processor and configured to provide the processor with instructions.
a processor configured to: receive tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; select a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forward the tunneled traffic to an instance of the matching type of vulnerable service; and
receive tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services;
select a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and
forward the tunneled traffic to an instance of the matching type of vulnerable service; and
a memory coupled to the processor and configured to provide the processor with instructions.
The system recited in claim 1 , wherein the sensor is an agent executed on a network device and/or a server, and wherein the server is located on the Internet or in an enterprise network.
The system recited in claim 1 , wherein the smart proxy is located in a cloud network of a security service provider, and wherein the sensor and a plurality of other sensors are located in different geographic locations on one or more other enterprise networks and/or the Internet.
The system recited in claim 1 , wherein the smart proxy performs deep packet inspection (DPI).
The system recited in claim 1 , wherein the smart proxy performs deep packet inspection (DPI) of the tunneled traffic for generating the profile of the attack traffic for selecting the matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on the profile of the attack traffic.
The system recited in claim 1 , wherein the smart proxy is a stateful proxy that performs deep packet inspection (DPI) of the tunneled traffic for generating the profile of the attack traffic and implementing a contextual-based analysis for selecting the matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on the profile of the attack traffic, and wherein the smart proxy is located in a cloud network of a security service provider.
The system recited in claim 1 , wherein the smart proxy is a stateful proxy that performs deep packet inspection (DPI) of the tunneled traffic for generating the profile of the attack traffic and implementing a contextual-based analysis for selecting the matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on the profile of the attack traffic including one or more of the following: destination port, payload DPI results, source IP reputation and attacking history, payload history and similarity, and/or randomization.
The system recited in claim 1 , wherein an orchestration manager is executed in the honeypot cloud for managing the plurality of container images of distinct types of vulnerable services.
The system recited in claim 1 , wherein the instance of the matching type of vulnerable service includes a security agent that identifies a threat by monitoring behaviors and detecting anomalies or post exploitation activities.
The system recited in claim 1 , wherein the honeypot farm is executed in the honeypot cloud that is located in a cloud network of a security service provider, and wherein the security service provider provides an interface for accessing a threat report generated based on monitoring behaviors and detecting anomalies or post exploitation activities.
A method of synchronizing a honey network configuration to reflect a target network environment, comprising: receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.
receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services;
selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and
forwarding the tunneled traffic to an instance of the matching type of vulnerable service.
The method of claim 11 , wherein the sensor is an agent executed on a network device and/or a server, and wherein the server is located on the Internet or in an enterprise network.
The method of claim 11 , wherein the smart proxy is located in a cloud network of a security service provider, and wherein the sensor and a plurality of other sensors are located in different geographic locations on one or more other enterprise networks and/or the Internet.
The method of claim 11 , wherein the smart proxy performs deep packet inspection (DPI).
The method of claim 11 , wherein the smart proxy performs deep packet inspection (DPI) of the tunneled traffic for generating the profile of the attack traffic for selecting the matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on the profile of the attack traffic.
A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.
The computer program product recited in claim 16 , wherein the sensor is an agent executed on a network device and/or a server, and wherein the server is located on the Internet or in an enterprise network.
The computer program product recited in claim 16 , wherein the smart proxy is located in a cloud network of a security service provider, and wherein the sensor and a plurality of other sensors are located in different geographic locations on one or more other enterprise networks and/or the Internet.
The computer program product recited in claim 16 , wherein the smart proxy performs deep packet inspection (DPI).
The computer program product recited in claim 16 , wherein the smart proxy performs deep packet inspection (DPI) of the tunneled traffic for generating the profile of the attack traffic for selecting the matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on the profile of the attack traffic.
Ref US11636198B1: Claims:
An electronic device for receiving and seamlessly updating a cybersecurity agent comprising: a processor; and a non-transitory storage medium communicatively coupled to the processor, the non-transitory storage medium comprises the cybersecurity agent that comprises: an analyzer logic configured to receive cybersecurity analytics content data and generate a first analyzer, the first analyzer is configured to receive a suspicious object for threat evaluation and to conduct one or more threat evaluation operations based on a portion of the cybersecurity analytics content data, an inspection logic configured to manage a queue and to receive and assign a first plurality of suspicious objects to the first analyzer for threat evaluation, and an update logic configured to receive updated cybersecurity analytics content data, wherein the analyzer logic is further configured to receive the updated cybersecurity analytics content data from the update logic and generate a second analyzer that conducts one or more threat evaluation operations based on at least a portion of the updated cybersecurity analytics content data and wherein the inspection logic, in response to the generation of the second analyzer, is configured to assign a second plurality of suspicious objects that would have otherwise been directed to the first analyzer to the second analyzer for threat evaluation while both the first analyzer and the second analyzer operate concurrently as the first analyzer continues to process the first plurality of suspicious objects remaining in the queue for threat evaluation based on at least the portion of the cybersecurity analytics content data as the second analyzer processes the second plurality of suspicious objects for threat evaluation based on at least the portion of the updated cybersecurity analytics content data.
a processor; and
a non-transitory storage medium communicatively coupled to the processor, the non-transitory storage medium comprises the cybersecurity agent that comprises: an analyzer logic configured to receive cybersecurity analytics content data and generate a first analyzer, the first analyzer is configured to receive a suspicious object for threat evaluation and to conduct one or more threat evaluation operations based on a portion of the cybersecurity analytics content data, an inspection logic configured to manage a queue and to receive and assign a first plural
[Truncated to input limit]