API Response Field Classification for Focused Security Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of determining which API response fields are relevant to security monitoring is labor-intensive and inefficient, as most response fields do not pertain to security but distinguishing those that are pertinent from those that are not consumes substantial resources in security policy creation.
Innovation Solution
A text classification service uses machine learning models, such as BERT, to automatically classify API response fields as related or unrelated to security by training on labeled data derived from API documentation and security policies, enabling focused security policy creation on relevant fields.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual methods are used to determine security-relevant API response fields, then accuracy in identifying security fields can be maintained, but the process becomes labor-intensive and inefficient
Solution Approach 1:
The patent replaces manual mechanical analysis of API documentation with an automated text classification system using machine learning models. The system processes API response field descriptions through trained classifiers that automatically determine security relevance, eliminating the need for manual review while maintaining consistent accuracy standards.
Solution Approach 2:
The system enables the API documentation and security policies to self-classify response fields through automated text processing. The classification service independently analyzes field descriptions and determines security relevance without requiring external manual intervention, allowing the system to serve itself in identifying security-critical fields.
2Reliability
If all API response fields are reviewed for security relevance, then comprehensive security coverage is achieved, but substantial resources are consumed
Solution Approach 1:
The classification system extracts and identifies only the security-relevant subset of API response fields from the complete set of all fields. By using text classification to filter and extract only those fields that pertain to security monitoring, the system achieves comprehensive security coverage for critical fields while avoiding the resource expenditure of analyzing all non-security fields.
3Ease of operation
If automated text classification is implemented, then manual effort is reduced, but implementation complexity increases
Solution Approach 1:
The system performs preliminary training of text classification models using labeled examples of security-relevant and non-security fields before deployment. This preliminary action creates a pre-trained classifier that can be directly applied to new API documentation, reducing the operational complexity during actual use while maintaining ease of operation for field identification.
Data Source
AI summary
An API response field classification service obtains API documentation published by a vendor and defined security policies and matches the response fields represented in the security policies to their descriptions in the API documentation. The service generates labelled training data that comprise the identified response field descriptions with labels indicating that their corresponding response field is security related. Additional labelled training data for security unrelated response fields comprises descriptions of response fields that are known not to be represented with any security policies. The service trains a text classifier on the labelled training data. The trained text classifier accepts inputs comprising descriptions of unknown response fields and outputs predicted classes indicating whether the corresponding response fields are predicted to be security related. Subsequent creation of security policies can be focused on these response fields predicted to be security related.