Microsoft patents method to find security flaws in containerized apps
Microsoft has filed a patent for a system that identifies the source of security breaches in containerized software. The method works by checking different layers of the application, from the base image to the cloud commands, to pinpoint where a malicious process started. Once the root cause is found, the system helps apply the correct security fix.
In the filing’s own words
Containerized applications are common in modern software development. However, mitigating security events in containerized environments can be complex because malicious interactions with containerized applications may occur at several levels in a containerized application computing environment—e.g., at the container image level, at the cloud administration level, at the orchestration level, at the container runtime level, etc. This disclosure describes determining the root cause of a security event associated with a containerized software application by successively advancing through a series of steps, starting at the container image level and continuing through the container runtime level, until the root cause is identified. Determining the root cause includes correlating data indicative of possible malicious interactions with the containerized application at these several levels to facilitate effective mitigation of an attack.
What exactly they claim (claim 1)
1. A method for determining a root cause of a security event associated with a containerized software application, the method comprising: (a) determining whether an instance of a malicious process is present in an image of a container running the containerized software application; (b) determining whether the instance of the malicious process is present in an orchestration object configured to run the container; (c) determining whether the instance of the malicious process was initiated by a code execution command associated with the orchestration object; (d) determining whether the instance of the malicious process was initiated by a cloud level command; (e) determining whether the instance of the malicious process resulted from a runtime exploitation based on timing of the security event relative to a container start time; determining the root cause of the security event associated with the containerized software application by successively advancing through one or more of (a) (e); and facilitating execution of a security patch based on the root cause.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- SECURITY EVENT ROOT CAUSE DETERMINATION FOR CONTAINERIZED SOFTWARE APPLICATIONS
- Publication number
- US20260288953A1
- Application number
- 19085359
- Filed
- Mar 20, 2025
- Published
- Sep 24, 2026
- Inventors
- 3
- Claims
- 20
Classified under
G06F 21/562 Physics & computingG06F 21/53 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.