Abstract: Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

Abstract: A method, computer program product, and computer system for constructing, by a computing device, a dependency graph using dependency links provided between layers of an image. Versions of the image may be inspected. Update frequencies of the layers of the image may be identified. A rank to the layers of the image may be assigned based upon, at least in part, the update frequencies of the layers of the image. A new layer arrangement for the image may be generated by ordering the new layer arrangement between a lowest ranked layer and a highest ranked layer based upon, at least in part, the dependency graph. A new standardized deployment image may be built using the image layers reordered in the new layer arrangement.

Abstract: A method, computer program product, and computer system for constructing, by a computing device, a dependency graph using dependency links provided between layers of an image. Versions of the image may be inspected. Update frequencies of the layers of the image may be identified. A rank to the layers of the image may be assigned based upon, at least in part, the update frequencies of the layers of the image. A new layer arrangement for the image may be generated by ordering the new layer arrangement between a lowest ranked layer and a highest ranked layer based upon, at least in part, the dependency graph. A new standardized deployment image may be built using the image layers reordered in the new layer arrangement.

Abstract: A method, computer program product, and computer system for constructing, by a computing device, a dependency graph using dependency links provided between layers of an image. Versions of the image may be inspected. Update frequencies of the layers of the image may be identified. A rank to the layers of the image may be assigned based upon, at least in part, the update frequencies of the layers of the image. A new layer arrangement for the image may be generated by ordering the new layer arrangement between a lowest ranked layer and a highest ranked layer based upon, at least in part, the dependency graph. A new standardized deployment image may be built using the image layers reordered in the new layer arrangement.

Abstract: Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

Abstract: Various approaches are disclosed for protecting vehicle buses from cyber-attacks. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and an external vehicle bus of a vehicle to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS (e.g., using machine learning, anomaly detection, etc.).