Protocol-Layer Traffic Duplication for Computing Interface Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting API abuse are inadequate in adapting to new and evolving threats, and they struggle to effectively duplicate intra-organization traffic and accurately detect anomalies in API communications.
Innovation Solution
The method involves duplicating traffic across multiple layers of communication protocols, performing full session reconstruction, and using machine learning to identify anomalous behaviors in computing interface communications, including intra-organization and external traffic, without relying on protocol-specific data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing solutions look at communications through an API to detect abnormal traffic, then anomaly detection is performed, but the solutions face challenges in adapting to new and constantly evolving threats
Solution Approach 1:
The system dynamically adapts to new threats by continuously learning from observed API communication patterns. The anomaly detection mechanism evolves over time by capturing baseline behavior and adjusting detection parameters based on observed traffic patterns, enabling the system to adapt to constantly evolving threats while maintaining reliable detection accuracy.
2Measurement precision
If traffic is duplicated across multiple layers of communication protocols, then comprehensive anomaly detection is enabled, but device complexity increases
Solution Approach 1:
The system segments traffic duplication across multiple protocol layers (transport, application, etc.), analyzing each layer separately to detect anomalies at different levels of the communication stack. This segmentation enables comprehensive anomaly detection by examining traffic characteristics at multiple abstraction levels without requiring a single complex monolithic system.
Solution Approach 2:
The system introduces an intermediary layer that captures and duplicates traffic from multiple protocol layers before analysis. This intermediary mechanism enables comprehensive traffic observation without directly modifying the underlying communication protocols, thereby achieving high detection accuracy while managing system complexity through a dedicated traffic capture component.
3Loss of information
If full session reconstruction is performed, then a comprehensive view of anomalies is provided, but loss of time increases due to processing requirements
Solution Approach 1:
The system performs preliminary actions by capturing and storing traffic data from multiple layers as it passes through, before full session reconstruction is required. This preliminary data capture enables faster session reconstruction when anomaly detection is needed, as the raw traffic data is already available and organized for analysis.
Solution Approach 2:
The system applies local quality by performing full session reconstruction only when anomaly detection is required, rather than continuously. Between anomaly detection events, the system maintains captured traffic data in a ready state, enabling comprehensive anomaly analysis on-demand without the ongoing time cost of continuous full session reconstruction.
4Measurement precision
If machine learning models are used to identify anomalous behaviors, then detection accuracy improves, but use of energy increases
Solution Approach 1:
The system applies partial action by using machine learning models selectively for anomaly detection rather than for all traffic processing. The ML models are applied to analyze captured traffic patterns and identify anomalies, while routine traffic processing uses simpler mechanisms. This selective application of computationally intensive ML analysis improves detection accuracy while managing energy consumption by avoiding continuous full ML processing of all traffic.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A system and method for identifying computing interface calls using communications protocols. A method includes extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers; duplicating traffic for the communications session based on the extracted data, wherein duplicating the traffic further comprises converting the extracted data into a unified data modeling format; and identifying at least one computing interface call based on the duplicated traffic.