Context based risk assessment of a computing resource vulnerability

Patent metadata

Field	Value
Publication number	US-11956266-B2
Application number	US-202017078603-A
Country	US
Kind code	B2
Filing date	Oct 23, 2020
Priority date	Oct 23, 2020
Publication date	Apr 9, 2024
Grant date	Apr 9, 2024

Abstract

According to an embodiment, a computer-implemented method can comprise: inspecting, using a processor, a set of container images respectively associated with pods; identifying, using the processor, a first subset of the pods that contain a vulnerability; classifying, using the processor, the first subset of the pods as primary-infected pods; generating, using the processor, a first list of namespaces in which the primary-infected pods are deployed within a network; checking, using the processor, network policies in connection with the first list of namespaces to determine secondary-suspect pods that have ability to communicate with the primary-infected pods; generating, using the processor, a list of secondary-suspect namespaces in which the secondary-suspect pods are deployed within the network; identifying, using the processor, one or more secondary-suspect pods that communicated with one or more primary-infected pods; and generating, using the processor, a list of secondary-infected pods.

First claim

What is claimed is:

1. A system, comprising:
a processor that executes the following computer-executable components stored in a non-transitory computer readable medium:
an inspection component that inspects a set of container images respectively associated with pods, identifies a first subset of the pods that contain at least one container image comprising at least one vulnerability, and classifies the first subset of the pods as primary-infected pods;
a namespace component that generates a first list of namespaces in which the primary-infected pods are deployed within a network; and
a network component that:
checks network policies in connection with the first list of namespaces to determine secondary-suspect pods that have ability to communicate with the primary-infected pods,
generates a list of secondary-suspect namespaces in which the secondary-suspect pods are deployed within the network, and
identifies one or more secondary-suspect pods that communicated with one or more primary-infected pods;

wherein the inspection component generates a list of secondary-infected pods based on one or more secondary-suspect pods that communicated with one or more primary-infected pods; and
a risk component that generates a contextual risk score and an absolute risk score associated with the primary-infected pods and the secondary-infected pods, wherein the contextual risk score is based on:
security measures capable of mitigating security risks of container images in the primary-infected pods and the secondary-infected pods based on the at least one vulnerability,
abilities of the container images to change a first subset of the security measures, and
inabilities of the container images to change a second subset of the security measures that are different from the first subset, and
wherein the absolute risk score is based on a risk score determined based on respective vulnerability scores from a knowledge base of the security risks of the container images in the primary-infected pods and the secondary-infected pods, and wherein the risk score is adjusted based on the contextual risk score.

2. The system of claim 1 , wherein the risk component determines the contextual risk score further based on checking a specification and privileges associated with the primary-infected pods and the secondary-infected pods to generate a list of suspect machines, primary-infected machines, and secondary-infected machines and to determine an ability of the primary-infected pods and the secondary-infected pods to morph a configuration of the network.

3. The system of claim 1 , wherein the risk component determines the contextual risk score further based on determining respective total resource capacities that the container images in the primary-infected pods and the secondary-infected pods have ability to consume to generate a total-capacity-at-risk measure.

4. The system of claim 1 , wherein the risk component determines the abilities of the container images to change the first subset of the security measures based on determining respective permissions associated with the container images.

5. The system of claim 3 , wherein the total-capacity-at-risk measure is further based on bounded capacity of at least one of: respective processors, respective memory, or respective disks associated with the primary-infected pods and the secondary-infected pods.

6. The system of claim 1 , wherein the risk component dynamically generates a second contextual risk score and a second absolute risk score associated with the primary-infected pods and the secondary-infected pods based on one or more changes to at least one of the primary-infected pods and the secondary-infected pods.

7. The system of claim 1 , wherein the risk component employs a trained model to dynamically generate the contextual risk score and the absolute risk score associated with the primary-infected pods and the secondary-infected pods.

8. A computer-implemented method, comprising:
inspecting, using a processor, a set of container images respectively associated with pods;
identifying, using the processor, a first subset of the pods that contain at least one container image comprising at least one vulnerability;
classifying, using the processor, the first subset of the pods as primary-infected pods;
generating, using the processor, a first list of namespaces in which the primary-infected pods are deployed within a network;
checking, using the processor, network policies in connection with the first list of namespaces to determine secondary-suspect pods that have ability to communicate with the primary-infected pods;
generating, using the processor, a list of secondary-suspect namespaces in which the secondary-suspect pods are deployed within the network;
identifying, using the processor, one or more secondary-suspect pods that communicated with one or more primary-infected pods;
generating, using the processor, a list of secondary-infected pods based on one or more secondary-suspect pods that communicated with one or more primary-infected pods; and
generating, using the processor, a contextual risk score and an absolute risk score associated with the primary-infected pods and the secondary-infected pods, wherein the contextual risk score is based on:
security measures capable of mitigating security risks of container images in the primary-infected pods and the secondary-infected pods based on the at least one vulnerability,
abilities of the container images to change a first subset of the security measures, and
inabilities of the container images to change a second subset of the security measures that are different from the first subset, and
wherein the absolute risk score is based on a risk score determined based on respective vulnerability scores from a knowledge base of the security risks of the container images in the primary-infected pods and the secondary-infected pods, and wherein the risk score is adjusted based on the contextual risk score.

9. The method of claim 8 , further comprising:
checking, using the processor, specification and privileges associated with the primary-infected pods and the secondary-infected pods;
generating, using the processor, a list of suspect machines, primary-infected machines, and secondary-infected machines; and
determining, using the processor, the contextual risk score further based on an ability of the primary-infected pods and the secondary-infected pods to morph a configuration of the network.

10. The method of claim 8 , further comprising determining, using the processor, the contextual risk score further based on determining respective total resource capacities that the container images in the primary-infected pods and the secondary-infected pods have ability to consume, and generating a total-capacity-at-risk measure based on the respective total resource capacities the container images in the primary-infected pods and the secondary-infected pods have ability to consume.

11. The method of claim 8 , further comprising determining, using the processor, the abilities of the container images to change the first subset of the security measures based on determining respective permissions associated with the the container images.

12. The method of claim 10 , wherein the total-capacity-at-risk measure is further based on bounded capacity of at least one of: respective processors, respective memory, or respective disks associated with the primary-infected pods and the secondary-infected pods.

13. The method of claim 8 , further comprising generating, using the processor, a second contextual risk score and a second absolute risk score associated with the primary-i

Assignees

• IBM

Inventors

• Kanso Ali
• Bulut Muhammed Fatih
• Hwang Jinho
• Nadgowda Shripad

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title