Cloud API Traffic Reconstruction for Real-Time Security Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based security solutions rely on static analysis and are application-specific, failing to provide real-time visibility into API usage and security context, making it difficult to reconstruct the complete context of API calls and detect security threats effectively.
Innovation Solution
A system that dynamically reconstructs cloud application traffic by combining and analyzing partial log data from distributed cloud applications using a catalog and dynamic algorithms, generating enriched reconstruction of API network traffic to identify security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis methods are used for cloud security monitoring, then implementation simplicity is maintained, but real-time visibility and detection capability are lost
Solution Approach 1:
The patent implements dynamic reconstruction of API traffic by continuously collecting and correlating log data from multiple distributed sources in real-time. The system dynamically assembles complete API call contexts by matching requests with responses based on correlation identifiers, timestamps, and other contextual information, enabling real-time security analysis that adapts to changing traffic patterns rather than relying on static baselines.
Solution Approach 2:
The patent segments the distributed log data from multiple cloud applications into discrete, analyzable units. Each log entry is treated as a separate fragment containing partial information about API calls. The system then reconstructs complete API traffic contexts by correlating these segmented log fragments across different applications, transforming unstructured distributed logs into structured, analyzable security events.
2Loss of information
If distributed log data from multiple cloud applications is collected, then comprehensive security context is available, but data integration and reconstruction difficulty increases
Solution Approach 1:
The patent introduces a central security information management system that acts as an intermediary between distributed cloud applications and security analysts. This intermediary collects log data from multiple applications, standardizes the data formats, correlates log entries using matching algorithms, and reconstructs complete API call contexts. The intermediary transforms fragmented distributed logs into unified, comprehensive security views, eliminating the need for manual data integration at each analysis point.
Solution Approach 2:
The patent changes the parameters of log data representation by introducing correlation identifiers, standardized timestamp formats, and unified data schemas. Log entries are transformed from application-specific formats into a standardized structure that includes common security-relevant parameters. This parameter standardization enables efficient correlation and reconstruction of API traffic contexts across different applications without complex custom integration logic for each application pair.
3Measurement precision
If application-specific security tools are used, then tailored security analysis is achieved, but scalability and universality are reduced
Solution Approach 1:
The patent creates a universal security information management system that can analyze API traffic across multiple different cloud applications through a single platform. The system uses application-agnostic log collection methods and correlation algorithms that work with any API-based application. By standardizing data intake and using universal correlation criteria, the system provides tailored security analysis for each application while maintaining the ability to scale to any number of applications without requiring application-specific tool deployments.
Data Source
AI summary
A system and a method are disclosed for dynamic reconstruction of cloud traffic for security monitoring. A catalog is maintained that includes application programming interface (API) data associated with one or more APIs of cloud applications. One or more collectors, that are each specific to a different API of the one or more APIs, collect network information describing communications associated with the one or more cloud applications used by devices of an organization, the network information including partial log data from some of the one or more collectors. A reconstruction of API network traffic is generated using at least the partial log data and the catalog. Security information is determined that identifies a security risk using the reconstruction of the API network traffic. The security information is provided to an administrator device of the organization.