Audit Log Analysis for Identifying Unregistered Webservice Consumers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant network environments, identifying consuming applications of legacy web services is challenging due to misleading information in source codes and configuration files, and existing methods are inefficient in tracing connections accurately.
Innovation Solution
An automated script generates an output file by determining process and container identifications of client applications through real-time or near-real-time audit log analysis, matching IP addresses and process IDs to identify connected applications consuming a service application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If source codes and configuration files are scanned to trace host webservice endpoints, then identification of consuming applications can be performed, but misleading information in source codes and configuration files results in inaccurate identification
Solution Approach 1:
The patent introduces an intermediary mechanism (audit logging system) between the client applications and the webservice to capture actual connection information. Instead of relying on potentially misleading source code or configuration data, the system uses audit logs that record actual network connections, providing accurate identification of consuming applications regardless of what the application code claims.
2Productivity
If existing scanning methods are used to trace connections, then identification process can be performed, but the methods are inefficient in tracing connections accurately
Solution Approach 1:
The system performs preliminary action by implementing audit logging before connection tracing is needed. Audit logs continuously record connection information as it occurs, so when identification is required, the data is already captured and ready for analysis. This eliminates the need for time-consuming scanning operations while providing accurate connection information.
3Measurement precision
If audit log analysis is performed in real-time or near real-time, then accurate identification of consuming applications is achieved, but processing time and computational resources are required
Solution Approach 1:
The system performs preliminary action by continuously capturing and storing audit log data as connections occur. This pre-capturing of data means that when identification is needed, the information is already available in structured logs, eliminating the need for time-consuming real-time analysis or retroactive scanning, thus providing both accuracy and efficiency.
Data Source
AI summary
Computerized systems and methods are provided for identifying connection between at least one application in a set of client applications within a multi-tenant network and a service application hosted on a server. Audit logs are generated that track activities for respective ones of the client applications over a predetermined duration. Information from a first audit message of each client application is extracted that includes an audit identification and a connecting IP address associated with the corresponding client application. Information from a second audit message of each client application is extracted that includes an audit identification and a process identification of the corresponding client application. The extracted information is used to identify one or more client applications as being connected to and consuming the service application.